Network fault positioning method and device and nonvolatile storage medium

Abstract

The invention discloses a network fault positioning method and device and a nonvolatile storage medium. The method comprises the following steps: acquiring initial alarm information generated by initial alarm equipment of a network fault; determining a root alarm device associated with the initial alarm device and preset root alarm information based on the cross-stage knowledge graph by using a fault positioning model; under the condition that any one piece of to-be-detected alarm information in the to-be-detected alarm information set is matched with preset basic alarm information, determining the to-be-detected alarm information as basic alarm information; and determining the basic alarm information and the basic alarm equipment as network fault positioning information, and pushing the network fault positioning information to a user terminal. According to the method and the device, the technical problem of low accuracy of network fault positioning caused by dependence on human experience when network fault positioning is carried out in multiple stages of service transmission in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to a method and device for locating a network fault, and a non-volatile storage medium. Background Art

[0002] With the rapid development of new-generation information technologies such as the Internet of Things, 5G, cloud computing, industrial Internet, and big data, the connectivity, intelligence, and data processing and analysis capabilities of equipment have been greatly improved. At the same time, driven by the demand for network self-intelligence, higher requirements have been put forward for network fault self-location.

[0003] In the related technologies, the process of locating network faults often relies on the experience of operation and maintenance personnel. The dynamic fluctuation of human experience will greatly affect the accuracy of fault location. Operation and maintenance personnel can locate network faults through knowledge graphs. Knowledge graphs associate equipment operation parameters, operating status, fault causes, etc., which can improve the efficiency of fault handling. However, the knowledge graphs of most enterprises' equipment are manually drawn. Operation and maintenance personnel collect information such as equipment parameters, equipment operating status, fault causes, and then manually create equipment knowledge graphs. Manual construction of knowledge graphs has problems such as low construction efficiency, long update cycle, errors and inaccuracies in knowledge graphs. In addition, equipment alarm rules are often isolated and formulated by equipment manufacturers. Operation and maintenance personnel can only rely on these rules to handle equipment alarms, and cannot optimize and improve alarm rules through rule changes. At the same time, due to the multi-stage multi-person collaboration of business processing and multi-person linkage across stages, inefficiency will also occur when locating network faults.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a method, device and non-volatile storage medium for locating a network fault, so as to at least solve the technical problem in the related art that when locating a network fault in multiple stages of service transmission, the accuracy of locating the network fault is low due to reliance on human experience.

[0006] According to one aspect of an embodiment of the present application, a method for locating a network fault is provided, including: obtaining initial alarm information generated by an initial alarm device of the network fault; using a fault location model to determine a fundamental alarm device and preset fundamental alarm information associated with the initial alarm device based on a cross-stage knowledge graph, wherein the cross-stage knowledge graph is used to display all alarm devices and preset fundamental alarm information of each alarm device, and each topological node in the cross-stage knowledge graph corresponds to an alarm device; when any one of the alarm information to be detected in the set of alarm information to be detected matches the preset fundamental alarm information, the alarm information to be detected is determined as the fundamental alarm information; the fundamental alarm information and the fundamental alarm device are determined as network fault location information, and the network fault location information is pushed to a user terminal.

[0007] In some embodiments of the present application, a cross-stage knowledge graph is constructed in the following manner: multiple initial stage knowledge graphs are constructed based on the device logical relationships of different stages of business processing, wherein the device logical relationships of each stage are used to indicate the connection relationship between the alarm devices belonging to the corresponding stage, and each initial knowledge graph corresponds to a stage of business processing; multiple initial stage knowledge graphs are associated to obtain an initial cross-stage knowledge graph; and the preset fundamental alarm information of each alarm device is mapped to the initial cross-stage knowledge graph to obtain a cross-stage knowledge graph.

[0008] In some embodiments of the present application, multiple initial stage knowledge graphs are associated to obtain an initial cross-stage knowledge graph, including: associating multiple initial stage knowledge graphs based on boundary resource information to obtain an initial cross-stage knowledge graph, wherein the boundary resource information is used to indicate resource information commonly used by two adjacent stages of business processing.

[0009] In some embodiments of the present application, when any one of the alarm information to be detected in the set of alarm information to be detected does not match the preset fundamental alarm information, the method also includes: when it is determined that the mismatch is caused by an error in the preset fundamental alarm information, the number of matches of the target knowledge graph entry in the cross-stage knowledge graph is cumulatively increased by 1, wherein the initial value of the number of matches is 0, and the target knowledge graph entry is the connection path in the cross-stage knowledge graph, from the topological node corresponding to the alarm device that generates the alarm information to the topological node corresponding to the fundamental alarm device; when the number of matches exceeds the preset matching threshold, the target knowledge graph entry is deleted from the cross-stage knowledge graph.

[0010] In some embodiments of the present application, when any one of the alarm information to be detected in the alarm information set to be detected does not match the preset fundamental alarm information, the method also includes: when it is determined that the mismatch is caused by the lack of preset fundamental alarm information in the alarm information set to be detected, modifying the alarm rules for generating the alarm information set to be detected, and updating the cross-stage knowledge graph based on the modified alarm rules.

[0011] In some embodiments of the present application, when it is determined that the stage to which the fundamental alarm device belongs is different from the stage to which the initial alarm device belongs, the method also includes: updating the first boundary resource information between the stages corresponding to the fundamental alarm device and the initial alarm device; obtaining sub-initial alarm information of the same type as the initial alarm information; in the case of an alarm associated with the updated first boundary resource information in the sub-initial alarm information, determining the updated first boundary resource information as the new first boundary resource information.

[0012] In some embodiments of the present application, a fault location model is obtained in the following manner: obtaining labeled historical alarm data, wherein the labeled historical alarm data includes labeled data and historical alarm data, wherein the labeled data is the correctly labeled first fundamental alarm device and the first preset fundamental alarm information corresponding to the historical alarm data; training the initial fault location model based on the labeled historical alarm data, calculating the training accuracy of the initial fault location model after each training, stopping the training when the training accuracy is greater than a preset accuracy threshold, and obtaining the fault location model, wherein the training accuracy is determined based on a functional relationship between the number of correct locations and the total number of labeled historical alarm data, the number of correct locations is the number of successful matches between the predicted data and the labeled historical alarm data, and the predicted data is the second fundamental alarm device and the second preset fundamental alarm information obtained by the initial fault location model by performing fault location on the historical alarm data.

[0013] According to another aspect of an embodiment of the present application, a network fault locating device is also provided, including: an acquisition module, used to acquire the initial alarm information generated by the initial alarm device of the network fault; a first determination module, used to determine the fundamental alarm device and preset fundamental alarm information associated with the initial alarm device based on the cross-stage knowledge graph using a fault location model, wherein the cross-stage knowledge graph is used to display all alarm devices and the preset fundamental alarm information of each alarm device, and each topological node in the cross-stage knowledge graph corresponds to an alarm device; a second determination module, used to determine the alarm information to be detected as the fundamental alarm information when any one of the alarm information to be detected in the alarm information set to be detected matches the preset fundamental alarm information; a third determination module, used to determine the fundamental alarm information and the fundamental alarm device as network fault location information, and push the network fault location information to the user terminal.

[0014] According to another aspect of an embodiment of the present application, a non-volatile storage medium is provided, in which a program is stored, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the above-mentioned network fault locating method.

[0015] According to another aspect of an embodiment of the present application, an electronic device is further provided, including: a memory and a processor, the processor being configured to run a program stored in the memory, wherein the above-mentioned network fault locating method is executed when the program is run.

[0016] In an embodiment of the present application, the initial alarm information generated by the initial alarm device of the network fault is obtained; the fault location model is used to determine the fundamental alarm device associated with the initial alarm device and the preset fundamental alarm information based on the cross-stage knowledge graph, wherein the cross-stage knowledge graph is used to display all alarm devices and the preset fundamental alarm information of each alarm device, and each topological node in the cross-stage knowledge graph corresponds to an alarm device; when any one of the alarm information to be detected in the set of alarm information to be detected matches the preset fundamental alarm information, the alarm information to be detected is determined as the fundamental alarm information; the fundamental alarm information is used as The fundamental alarm device is determined as network fault location information, and the network fault location information is pushed to the user terminal. The fundamental alarm device associated with the initial alarm device and the preset fundamental alarm information are determined based on the cross-stage knowledge graph through the fault location model, and then the preset fundamental alarm information and the alarm information to be detected are set to determine the final fundamental alarm information, thereby achieving the purpose of quickly locating the network fault based on the fault location model and the cross-stage knowledge graph, and further solving the technical problem of low accuracy of network fault location due to reliance on human experience when locating the network fault in multiple stages of business transmission in the related technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 It is a hardware structure block diagram of a computer terminal for implementing a method for locating a network fault according to an embodiment of the present application;

[0019] Figure 2 It is a flowchart of a method for locating a network fault according to an embodiment of the present application;

[0020] Figure 3 It is a flowchart of lifecycle management of a knowledge graph provided according to an embodiment of the present application;

[0021] Figure 4 It is a structural schematic diagram of a network fault locating device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0023] The information collected in the embodiments of the present application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or reject automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] In order to better understand the embodiments of the present application, the technical terms involved in the embodiments of the present application are explained as follows:

[0026] Knowledge Graph: Knowledge graph is called knowledge domain visualization or knowledge domain mapping map in the library and information industry. It is a series of various graphs that show the development process and structural relationship of knowledge. It uses visualization technology to describe knowledge resources and their carriers, and to mine, analyze, construct, draw and display knowledge and their interrelationships.

[0027] Network alarm: In the field of network management, a fault is defined as the cause of a functional abnormality, which is the cause of an alarm event. An alarm is an event report consisting of a notification issued by a managed object when a specific event occurs, which is used to transmit alarm information. It is defined by the manufacturer and is generated by devices in the network. It is a message sent by a system, indicating that something has happened or an abnormality has occurred, which is finally observed by network management personnel.

[0028] Neo4j: A high-performance non-relational database (NOSQL) graph database management system that stores structured data on the network instead of in tables. It is an embedded, disk-based Java persistence engine with full transactional features, but it stores structured data on the network (called a graph from a mathematical perspective) instead of in tables. Neo4j can also be seen as a high-performance graph engine that has all the features of a mature database. In Neo4j, data is stored in the form of nodes and relationships, which is very suitable for processing highly connected and complex data structures, such as social networks, recommendation systems, knowledge graphs, and other scenarios.

[0029] In the related art, the process of locating network faults often relies on the experience of operation and maintenance personnel. The dynamic fluctuation of human experience will greatly affect the accuracy of fault location. Operation and maintenance personnel can locate network faults through knowledge graphs. Knowledge graphs associate equipment operation parameters, operating status, fault causes, etc., which can improve the efficiency of fault handling. However, the knowledge graphs of equipment in most companies are manually drawn. Operation and maintenance personnel collect information such as equipment parameters, equipment operating status, fault causes, and then manually create knowledge graphs for equipment. Manually constructing knowledge graphs has problems such as low construction efficiency, long update cycle, errors and inaccuracies in knowledge graphs. Therefore, there is a technical problem in the related art that when locating network faults in multiple stages of business transmission, it relies on human experience, resulting in low accuracy of network fault location. In order to solve this problem, a relevant solution is provided in the embodiments of the present application, which is described in detail below.

[0030] According to an embodiment of the present application, an embodiment of a method for locating a network fault is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0031] The method embodiments provided in the embodiments of the present application can be executed in a computer terminal or a similar computing device. Figure 1FIG. 1 shows a hardware structure block diagram of a computer terminal for implementing a method for locating a network fault. Figure 1 As shown, the computer terminal 10 may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission module 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0032] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0033] The memory 104 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the method for locating network faults in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the method for locating network faults described above is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0034] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0035] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 .

[0036] In the above operating environment, an embodiment of the present application provides an embodiment of a method for locating a network fault. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0037] like Figure 2 FIG. 1 is a flow chart of a method for locating a network fault according to an embodiment of the present application.

[0038] Step S202: acquiring initial alarm information generated by an initial alarm device for network failure.

[0039] The alarm system generates and collects alarm information from all alarm devices. When it is necessary to determine the fundamental alarm corresponding to an alarm message and the fundamental alarm device that generates the fundamental alarm information, the alarm information is obtained from the alarm system as the initial alarm information, wherein the fundamental alarm information is the source of the alarm information, and the fundamental alarm device is the alarm device that initially generates the alarm. Finding the source of the problem is the key to dealing with network faults and locating network faults.

[0040] Step S204, using a fault location model (for example, a large AI model) to determine the fundamental alarm device associated with the initial alarm device and the preset fundamental alarm information based on the cross-stage knowledge graph, wherein the cross-stage knowledge graph is used to display all alarm devices and the preset fundamental alarm information of each alarm device, and each topological node in the cross-stage knowledge graph corresponds to an alarm device.

[0041] In the technical solution provided in step S204, the cross-stage knowledge graph is constructed in the following manner: multiple initial stage knowledge graphs are constructed based on the equipment logical relationship of different stages of business processing, wherein the equipment logical relationship of each stage is used to indicate the connection relationship between the alarm devices belonging to the corresponding stage, and each initial knowledge graph corresponds to a stage of business processing; multiple initial stage knowledge graphs are associated to obtain an initial cross-stage knowledge graph; the preset fundamental alarm information of each alarm device is mapped to the initial cross-stage knowledge graph to obtain a cross-stage knowledge graph.

[0042] In the above steps, there are many ways to associate multiple initial stage knowledge graphs to obtain an initial cross-stage knowledge graph, for example: based on boundary resource information, multiple initial stage knowledge graphs are associated to obtain an initial cross-stage knowledge graph (also called a professional knowledge graph), wherein the boundary resource information is used to indicate resource information commonly used by two adjacent stages of business processing.

[0043] The following are specific embodiments:

[0044] As the initial stage of the knowledge graph of the cross-stage knowledge graph life cycle, multiple initial stage knowledge graphs are constructed based on the logical relationship of the equipment for different business processing stages. Specifically: The logical relationship of the equipment refers to the interconnection relationship between the equipment (i.e., the alarm equipment) based on its function and configuration. This relationship includes both the physical connection between the equipment (such as cable connection) and the logical data flow path and control link. When constructing the knowledge graph, these logical relationships are converted into the topological structure in the graph. In the initial stage knowledge graph, the topological vertices represent specific devices in the network. These devices can generate or receive alarm information, so they are also called alarm devices. For example, in the IP routing stage of business processing, which belongs to the IP profession, the topological vertices can be network devices such as routers, switches, and firewalls (i.e., alarm devices). The attributes of each vertex can include information such as device ID, type, location, and status. The topological edge reflects the physical connection or logical connection relationship between the alarm devices. When constructing the initial stage knowledge graph, based on the logical relationship of the equipment, the topological edge expresses how the data flows between the devices and their mutual dependence in the business process. For example, the connection between a router and a switch can be represented as an edge in the knowledge graph, and the attributes may include connection type (such as Ethernet connection), port, bandwidth, etc.

[0045] Specifically: Get the logical relationship of the equipment from the resource network management. The resource network management stores a large number of logical relationships of equipment (i.e., equipment resource information), including but not limited to: OLT-SW-BAS link information: describes the connection relationship between the optical line terminal (Optical Line Terminal, referred to as OLT), the switch (Switch, referred to as SW) and the broadband access server (Broadband Access Server, referred to as BAS), including the interface, link type, bandwidth, etc. Base station-AB-ER link information: involves connection information of base stations, A / B interfaces (in the Global System for Mobile Communications (GSM) network, the A interface is the interface between the base station controller and the mobile switching center, used to transmit voice and data information; in the Code Division Multiple Access Network (CDMA network), the B interface is the interface between the base station controller and the mobile switching center, equivalent to the A interface in the GSM network), E interface (in the GSM network, the E interface is the interface between the base station controller and the base station, used for control and data transmission between the base station and the base station controller) and R interface (in the Universal Mobile Telecommunications System (UMTS) network, the R interface is the interface between the base station controller and the base station, used for control and data transmission) in the mobile network, reflecting the link structure of the mobile network. Equipment / module and port information: including equipment model, serial number, software version, hardware module information, and physical port status and configuration. Station, computer room, and power environment information: describes the geographical location, computer room environment, power environment, etc. of the network equipment, which helps to understand the physical location and operating environment of the equipment. These resource information are the basis for building the knowledge graph. They provide the physical and logical layout of the network architecture, as well as the status and attributes of each device. The collected resource data is associated with the network management code, which is the code used to uniquely identify network devices and resources in the resource network management. Through this association, each resource data has a location identifier in the network management, which is convenient for subsequent data integration and query. The logical relationship of the equipment is mapped to the topological vertices and topological edges of multiple initial stage knowledge graphs according to the different stages of business processing (corresponding to different professions). Then, by identifying the boundary resource information shared between two adjacent business stages, these independent initial stage knowledge graphs are associated to obtain a cross-stage knowledge graph. When different network services or professional networks at different stages rely on the same alarm device for connection or data exchange, the information of these shared alarm devices is used as part of the boundary resource information.Boundary resource information can be physical connection points, commonly used network devices or protocols, etc. Boundary resource information also involves connection interfaces and links between devices in cross-professional networks, including interface type (such as Ethernet, optical fiber), link status (such as activation, failure), bandwidth, delay and other parameters, as well as possible quality of service and service level agreement information. The operation guide, maintenance manual and troubleshooting manual for boundary resources in professional manuals also constitute part of the boundary resource information. When multiple initial stage knowledge graphs are associated based on boundary resource information, the attributes of the associated topological edges are the boundary resource information shared by the two stages.

[0046] Identify professional manuals and determine the preset fundamental alarm information for each alarm device. Professional manuals may include operation guides, maintenance manuals, fault diagnosis manuals, etc. They are written by equipment manufacturers, technology providers or industry experts to provide technicians with comprehensive information about equipment functions, operation procedures, maintenance guides, fault diagnosis and solutions. The content of professional manuals may include but is not limited to: detailed technical specifications and parameters of equipment or systems; steps for installing and configuring equipment; procedures for daily operation and maintenance; methods for identifying abnormal conditions and faults; guidance for troubleshooting and repair; safe operating procedures and precautions; guidance for equipment or system upgrades and updates; FAQs and fault case analysis. All alarm information generated by each alarm device, as well as the reasons for the alarm information and the root causes of the alarm information (i.e. the corresponding fundamental alarm device and the expected handling method). Based on Neo4j, entity recognition of professional manuals is performed, and the preset fundamental alarm information of each alarm device is mapped to the constructed cross-stage knowledge graph. The attributes of each topological vertex also include the preset fundamental alarm information (that is, all alarm information that can be generated by each alarm device determined based on the professional manual) and preset alarm information association information (that is, the fundamental alarm device associated with the preset alarm information determined based on the professional manual and the expected processing method).

[0047] For example, in a business scenario where a user accesses the Internet through a wireless network, this process can be divided into multiple business processing stages: Access stage: User equipment (such as mobile phones) accesses the network through a wireless base station. This stage involves wireless network expertise and is handled by wireless professionals or access network professionals. In this stage, user equipment is connected to the network through wireless networks or wired access technologies (such as optical fibers). Transmission stage: Data is transmitted from the base station to the core network. This process may pass through professional equipment of the transmission network, such as transmission lines, optical network units, transmission nodes, etc., which is handled by the transmission profession. Data is transmitted from the access point to the core network. IP routing stage: Once the data enters the core network, IP expertise comes into play. The data packet will pass through IP routers and switches, and routing decisions will be made based on the IP address to ensure that the data reaches the correct destination. This stage involves the logical relationship and resource management of IP professional equipment to ensure that data can be transmitted efficiently and reliably. For each stage, an initial stage knowledge graph is constructed and associated based on boundary resource information to obtain a cross-professional knowledge graph, which integrates the logical relationship, resource information and alarm correlation of the equipment in these different business processing stages to form a comprehensive network fault location and analysis graph.

[0048] The fault localization model is adopted to determine the fundamental alarm device associated with the initial alarm device and the preset fundamental alarm information based on the cross-stage knowledge graph, that is, the topological node to which the initial alarm device belongs in the cross-stage knowledge graph is determined based on the fault localization model, and the fundamental alarm device and the preset fundamental alarm information associated in the attributes of the topological node are identified.

[0049] Step S206: When any one of the alarm information to be detected in the alarm information to be detected set matches the preset fundamental alarm information, the alarm information to be detected is determined as the fundamental alarm information.

[0050] In the technical solution provided in step S206, when any of the alarm information to be detected in the alarm information set to be detected does not match the preset fundamental alarm information, and when it is determined that the mismatch is caused by an error in the preset fundamental alarm information, the number of matches of the target knowledge graph entry in the cross-stage knowledge graph is cumulatively increased by 1, wherein the initial value of the number of matches is 0, and the target knowledge graph entry is the connection path between the topological node corresponding to the alarm device that generates the alarm information and the topological node corresponding to the fundamental alarm device in the cross-stage knowledge graph; when the number of matches exceeds the preset matching threshold, the target knowledge graph entry is deleted from the cross-stage knowledge graph. When it is determined that the mismatch is caused by the lack of preset fundamental alarm information in the alarm information set to be detected, the alarm rule that generates the alarm information set to be detected is modified, and the cross-stage knowledge graph is updated based on the modified alarm rule.

[0051] In the case of a mismatch caused by an error in preset fundamental alarm information or a mismatch caused by a lack of preset fundamental alarm information in the alarm information set to be detected, determine whether the stage to which the fundamental alarm device belongs is the same stage as the stage to which the initial alarm device belongs; if it is determined that the stage to which the fundamental alarm device belongs is different from the stage to which the initial alarm device belongs, update the first boundary resource information between the stages corresponding to the fundamental alarm device and the initial alarm device; obtain sub-initial alarm information of the same type as the initial alarm information; and in the case of an alarm associated with the updated first boundary resource information in the sub-initial alarm information, determine the updated first boundary resource information as the new first boundary resource information.

[0052] The following are specific embodiments:

[0053] Query the alarm system's set of undetected alarm information, which contains all alarm information generated by all current alarm devices. When any undetected alarm information in the undetected alarm information set matches the preset fundamental alarm information (i.e., the alarm information is the same), the undetected alarm information is determined as the fundamental alarm information.

[0054] If any of the alarm information to be detected in the alarm information set does not match the preset fundamental alarm information, there may be two reasons for the mismatch: the alarm rule for the alarm system to generate alarm information has problems, resulting in the failure to generate alarm information to be detected that matches the preset fundamental alarm information, or there is a problem with the cross-stage knowledge graph, resulting in an error in the preset fundamental alarm information. At this time, an alarm mismatch prompt is generated, and manual determination is performed, and the specific cause of the mismatch is determined in accordance with the mismatch cause instruction of the professional. When it is determined that the mismatch is caused by an error in the preset fundamental alarm information (i.e., there is a problem with the cross-stage knowledge graph), the number of matches of the target knowledge graph entry corresponding to the initial alarm information in the cross-stage knowledge graph is cumulatively increased by 1. When the number of matches exceeds the preset matching threshold, the target knowledge graph entry is deleted from the cross-stage knowledge graph. For the knowledge entry of the knowledge graph in the verification period, if there is an error when the target knowledge graph entry is matched with the cross-stage knowledge graph for the first time, the exit period of the knowledge graph is performed, and the knowledge entry is directly deleted. After the first successful match, the knowledge graph enters its operating phase. During the operating phase, the number of matches of the target knowledge graph entry increases by 1 after each matching error. When the number of matches exceeds a preset matching threshold (for example, 5), the knowledge graph enters its exit phase and the target knowledge graph entry is deleted from the cross-stage knowledge graph.

[0055] When it is determined that the mismatch is caused by the lack of preset fundamental alarm information in the alarm information set to be detected, it indicates that there may be a situation where the alarm information is missing. Feedback to the alarm system. Manually trace the collected system logs, locate where the alarm actually originated, and obtain the target log corresponding to the initial alarm information. Based on the large model, interpret the manual, identify the key fields in the target system log, such as timestamp, device name, alarm level and alarm description, so as to classify and understand the alarm information. Based on the above analysis results, if it is found that the alarm rules fail to cover or accurately identify certain types of alarm information, modify the alarm rules, and modify the alarm rules that generate the alarm information set to be detected in response to the alarm rule modification instructions of professionals. The modification process may involve adjusting the alarm threshold, adding new alarm types, or improving the matching algorithm of alarm information. The optimized alarm rules should be applied to the alarm system in a timely manner to ensure that the system can generate and report alarm information according to the updated rules. Based on the modified alarm rules, the topological nodes, resource information in the topological edges and attributes, and boundary resource information of the knowledge items involved in the cross-stage knowledge graph are updated. If there is no corresponding knowledge entry in the cross-stage knowledge graph, a new knowledge graph entry is constructed in the knowledge graph.

[0056] Regardless of which of the above two reasons is the cause, if any one of the alarm information to be detected in the alarm information set to be detected matches the preset fundamental alarm information, it is necessary to determine whether the stage to which the fundamental alarm device belongs is the same stage as the stage to which the initial alarm device belongs. When it is determined that the stage to which the fundamental alarm device belongs is different from the stage to which the initial alarm device belongs, the boundary resource information needs to be updated synchronously, specifically: update the first boundary resource information between the stages corresponding to the fundamental alarm device and the initial alarm device, and at the same time, perform resource association verification on the updated first boundary resource information: in the subsequent operation process, when a sub-initial alarm information is received that belongs to the same stage as the initial alarm information, has the same alarm type and the same alarm device, and in the process of the alarm device of the sub-initial alarm information tracing back to the fundamental alarm device, it is associated with the alarm of the updated first boundary resource information, that is, the first boundary resource information is associated in the attributes of the topological edge corresponding to the boundary resource information in the target knowledge graph, then it is determined that the update is correct, and the updated first boundary resource information is determined as the new first boundary resource information. If the association is not achieved, the first boundary resource information is not updated, and resource association verification is continuously performed until the association is achieved, and the updated first boundary resource information is determined as the new first boundary resource information.

[0057] When updating the cross-stage knowledge graph, the topological edges outside the target knowledge items, the resource information in the attributes of the topological nodes, and the boundary resource information may also need to be updated. At this time, alarm association is performed according to the time dimension. The resources with similar spatial dimensions are suspected associated resources. The suspected associated resources with the highest similarity rank as the associated resources (including topological edges, resource information in the attributes of topological nodes, and boundary resource information) are synchronized and updated. First, the resources (including topological edges, resource information in the attributes of topological nodes, and boundary resource information) are standardized according to time and space. Time standardization converts the time data of all resources into a unified time format, such as a timestamp in seconds. Let the original time T of resource i (i.e. the above-mentioned associated resource) be standardized to t, and the conversion formula is t=f(T), where f is the time conversion function, ensuring that all resources are compared on the same time scale. Spatial coordinateization For spatial information, determine a target coordinate system, such as a latitude and longitude coordinate system. If the spatial description of the resource is text information such as an address, it is converted into latitude and longitude coordinates through geocoding technology. Let the original spatial description of resource i be S i , converted by geocoding function g, the converted coordinates are (x, y), where x is longitude and y is latitude, that is, (x, y) = g(S i ).

[0058] Step S208: determine the fundamental alarm information and the fundamental alarm device as network fault locating information, and push the network fault locating information to the user terminal.

[0059] The following is a specific embodiment: the fundamental alarm information and the fundamental alarm device are determined as network fault location information, and the network fault location information specifically includes attribute information on the topological node corresponding to the fundamental alarm device, that is, the expected processing method corresponding to the fundamental alarm information. The network fault location information is pushed to the user terminal, and the operation and maintenance personnel perform network fault inspection and repair.

[0060] The fault location model used in each of the above steps is obtained as follows: Obtain the labeled historical alarm data, where the labeled historical alarm data includes the labeled data and the historical alarm data, and the labeled data is the correctly labeled first root alarm device and the first preset root alarm information corresponding to the historical alarm data; Train the initial fault location model based on the labeled historical alarm data, calculate the training accuracy rate of the initial fault location model after each training, and stop training when the training accuracy rate is greater than the preset accuracy rate threshold to obtain the fault location model, where the training accuracy rate is determined based on the functional relationship between the number of correct locations and the total number of the labeled historical alarm data, and the number of correct locations is the number of successful matches between the predicted data and the labeled historical alarm data, and the predicted data is the second root alarm device and the second preset root alarm information obtained by the initial fault location model for fault location of the historical alarm data.

[0061] The following are specific embodiments:

[0062] Obtain the labeled historical alarm data. The labeled historical alarm data includes the labeled data and the historical alarm data. The correctly labeled first root alarm device and the first preset root alarm information corresponding to the historical alarm data, that is, the correct root alarm device and the preset root alarm information corresponding to the historical alarm data. Input the historical alarm information into the initial fault location model for training. The initial fault location model will predict the second root alarm device and the second preset root alarm information corresponding to each historical alarm information. Calculate the training accuracy rate of the initial fault location model after each training, and stop training when the training accuracy rate is greater than the preset accuracy rate threshold to obtain the fault location model. The training accuracy rate is determined based on the functional relationship between the number of correct locations and the total number of the labeled historical alarm data. For example, the functional relationship is determined by the following formula: Training accuracy rate (A) = the amount of labeled data correctly identified (C) (i.e., the above-mentioned number of correct locations) ÷ the total number of the labeled historical alarm data (T). And calculate the performance of the trained model. The performance of the trained model (F) = training accuracy rate (A) × generalization ability coefficient (G, a constant, 0 < G < 1); When the performance of the trained model is less than the preset performance threshold, retrain the model.

[0063] After obtaining the fault location model, continuously monitor the fault location model. Calculate the alarm recognition accuracy rate (R) every preset time period. Alarm recognition accuracy rate = the number of alarm information correctly identified (N) ÷ the total number of alarm information within the preset time period (K). When the alarm recognition accuracy rate is less than the preset accuracy rate threshold (for example, 90%), retrain the fault location model.

[0064] The embodiment of the present application also provides a flowchart for the life cycle management of a knowledge graph, as Figure 3 As shown, it is used to evaluate the knowledge graph (i.e., the cross-stage knowledge graph). First, in the initial stage of the knowledge graph (i.e., the cross-stage knowledge graph), resource association is performed (i.e., in the above embodiment, multiple initial stage knowledge graphs are constructed based on the logical relationship of the equipment for different business processing stages), and then fault tracing is performed, that is, the fundamental alarm device associated with the initial alarm device and the preset fundamental alarm information are determined based on the cross-stage knowledge graph using the fault location model, and the knowledge graph extension period is entered to determine whether the knowledge graph is missing. If there is no missing, the knowledge graph application period is entered to perform source alarm (i.e., in the alarm to be detected When any of the alarm information to be detected in the information set matches the preset fundamental alarm information, the alarm information to be detected is determined as the fundamental alarm information, the fundamental alarm information and the fundamental alarm device are determined as the network fault location information, and the network fault location information is pushed to the user terminal). If there is a missing, when it is determined that the mismatch is caused by an error in the preset fundamental alarm information, the number of matches of the target knowledge graph entry in the cross-stage knowledge graph is increased by 1. When the number of matches exceeds the preset matching threshold, the knowledge graph exit period is entered, and the target knowledge graph entry is deleted from the cross-stage knowledge graph. When it is determined that the mismatch is caused by the lack of preset fundamental alarm information in the alarm information set to be detected, there is a missing alarm rule, and an alarm is issued to enter the knowledge graph regeneration period (that is, the above-mentioned modification generates the alarm rules of the alarm information set to be detected, and the cross-stage knowledge graph is updated based on the modified alarm rules), and the boundary resources (that is, the above-mentioned boundary resource information) are updated at the same time.

[0065] The present application also provides a schematic diagram of a network fault location device. Figure 4 As shown, including:

[0066] The acquisition module 402 is used to acquire the initial alarm information generated by the initial alarm device of the network failure.

[0067] The first determination module 404 is used to determine the fundamental alarm device and preset fundamental alarm information associated with the initial alarm device based on the cross-stage knowledge graph using the fault location model, wherein the cross-stage knowledge graph is used to display all alarm devices and the preset fundamental alarm information of each alarm device, and each topological node in the cross-stage knowledge graph corresponds to an alarm device.

[0068] The first determination module 404 is also used to construct multiple initial stage knowledge graphs based on the equipment logical relationship of different stages of business processing, wherein the equipment logical relationship of each stage is used to indicate the connection relationship between the alarm devices belonging to the corresponding stage, and each initial knowledge graph corresponds to a stage of business processing; multiple initial stage knowledge graphs are associated to obtain an initial cross-stage knowledge graph; the preset fundamental alarm information of each alarm device is mapped to the initial cross-stage knowledge graph to obtain a cross-stage knowledge graph.

[0069] The first determination module 404 is also used to associate multiple initial stage knowledge graphs based on boundary resource information to obtain an initial cross-stage knowledge graph, wherein the boundary resource information is used to indicate resource information commonly used by two adjacent stages of business processing.

[0070] The second determining module 406 is configured to determine the alarm information to be detected as fundamental alarm information when any one of the alarm information to be detected in the alarm information to be detected set matches the preset fundamental alarm information.

[0071] The second determination module 406 is also used to increase the number of matches of the target knowledge graph entry in the cross-stage knowledge graph by 1 cumulatively when it is determined that the mismatch is caused by an error in the preset fundamental alarm information, wherein the initial value of the number of matches is 0, and the target knowledge graph entry is the connection path in the cross-stage knowledge graph, from the topological node corresponding to the alarm device that generates the alarm information to the topological node corresponding to the fundamental alarm device; when the number of matches exceeds the preset matching threshold, the target knowledge graph entry is deleted from the cross-stage knowledge graph.

[0072] The second determination module 406 is also used to modify the alarm rules for generating the alarm information set to be detected when it is determined that the mismatch is caused by the lack of preset fundamental alarm information in the alarm information set to be detected, and update the cross-stage knowledge graph based on the modified alarm rules.

[0073] The second determination module 406 is also used to, when it is determined that the stage to which the fundamental alarm device belongs is different from the stage to which the initial alarm device belongs, to: update the first boundary resource information between the stages corresponding to the fundamental alarm device and the initial alarm device; obtain sub-initial alarm information of the same type as the initial alarm information; and in the case of an alarm associated with the updated first boundary resource information in the sub-initial alarm information, determine the updated first boundary resource information as the new first boundary resource information.

[0074] The third determining module 408 is used to determine the fundamental alarm information and the fundamental alarm device as network fault locating information, and push the network fault locating information to the user terminal.

[0075] It should be noted that Figure 4 The network fault location device shown is used to perform Figure 2 The network fault location method shown in the figure is Figure 2 The relevant explanations in the method for locating a network fault in are also applicable to the device for locating a network fault, and will not be repeated here.

[0076] It should be noted that the various modules in the above-mentioned network fault locating device can be program modules (for example, a set of program instructions that implement a certain specific function) or hardware modules. For the latter, it can be expressed in the following forms, but is not limited to this: the expression form of each of the above-mentioned modules is a processor, or the functions of each of the above-mentioned modules are implemented by a processor.

[0077] The embodiment of the present application also provides a non-volatile storage medium, the non-volatile storage medium includes a stored program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the above network fault location method. For example, the initial alarm information generated by the initial alarm device of the network fault is obtained; the fundamental alarm device and the preset fundamental alarm information associated with the initial alarm device are determined based on the cross-stage knowledge graph using a fault location model, wherein the cross-stage knowledge graph is used to display all alarm devices and the preset fundamental alarm information of each alarm device, and each topological node in the cross-stage knowledge graph corresponds to an alarm device; when any one of the alarm information to be detected in the alarm information set to be detected matches the preset fundamental alarm information, the alarm information to be detected is determined as the fundamental alarm information; the fundamental alarm information and the fundamental alarm device are determined as network fault location information, and the network fault location information is pushed to the user terminal.

[0078] The embodiment of the present application also provides an electronic device, the electronic device includes a processor, the processor is used to run a program, wherein the above network fault location method is executed when the program is running. For example, the initial alarm information generated by the initial alarm device of the network fault is obtained; the fundamental alarm device and the preset fundamental alarm information associated with the initial alarm device are determined based on the cross-stage knowledge graph using a fault location model, wherein the cross-stage knowledge graph is used to display all alarm devices and the preset fundamental alarm information of each alarm device, and each topological node in the cross-stage knowledge graph corresponds to an alarm device; when any one of the alarm information to be detected in the alarm information set to be detected matches the preset fundamental alarm information, the alarm information to be detected is determined as the fundamental alarm information; the fundamental alarm information and the fundamental alarm device are determined as network fault location information, and the network fault location information is pushed to the user terminal.

[0079] According to another aspect of the embodiment of the present application, a computer program product is also provided, including a computer program, which implements the above network fault location method when executed by a processor. For example, the initial alarm information generated by the initial alarm device of the network fault is obtained; the fundamental alarm device and the preset fundamental alarm information associated with the initial alarm device are determined based on the cross-stage knowledge graph using a fault location model, wherein the cross-stage knowledge graph is used to display all alarm devices and the preset fundamental alarm information of each alarm device, and each topological node in the cross-stage knowledge graph corresponds to an alarm device; when any one of the alarm information to be detected in the alarm information set to be detected matches the preset fundamental alarm information, the alarm information to be detected is determined as the fundamental alarm information; the fundamental alarm information and the fundamental alarm device are determined as network fault location information, and the network fault location information is pushed to the user terminal.

[0080] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0081] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0082] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0083] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0084] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0085] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for locating a network fault, characterized in that: include: Obtain the initial alarm information generated by the initial alarm device of the network failure; The fault location model is used to determine the fundamental alarm device and the preset fundamental alarm information associated with the initial alarm device based on the cross-stage knowledge graph, wherein the cross-stage knowledge graph is used to display all alarm devices and the preset fundamental alarm information of each alarm device, and each topological node in the cross-stage knowledge graph corresponds to an alarm device; In the case where any one of the alarm information to be detected in the alarm information to be detected set matches the preset fundamental alarm information, determining the alarm information to be detected as the fundamental alarm information; The fundamental alarm information and the fundamental alarm device are determined as network fault locating information, and the network fault locating information is pushed to a user terminal.

2. The method according to claim 1, characterized in that The cross-stage knowledge graph is constructed in the following way: Construct multiple initial stage knowledge graphs based on the logical relationship of devices at different stages of business processing, where the logical relationship of devices at each stage is used to indicate the connection relationship between alarm devices belonging to the corresponding stage, and each initial knowledge graph corresponds to a stage of business processing; Associating the multiple initial stage knowledge graphs to obtain an initial cross-stage knowledge graph; The preset fundamental alarm information of each of the alarm devices is mapped to the initial cross-stage knowledge graph to obtain the cross-stage knowledge graph.

3. The method according to claim 2, characterized in that The step of associating the multiple initial stage knowledge graphs to obtain an initial cross-stage knowledge graph includes: Based on the boundary resource information, multiple initial stage knowledge graphs are associated to obtain the initial cross-stage knowledge graph, wherein the boundary resource information is used to indicate resource information commonly used by two adjacent stages of business processing.

4. The method according to claim 1, characterized in that: In the case that any of the alarm information to be detected in the alarm information set to be detected does not match the preset fundamental alarm information, the method further includes: In the case where it is determined that the mismatch is caused by an error in the preset fundamental alarm information, the number of matches of the target knowledge graph entry in the cross-stage knowledge graph is cumulatively increased by 1, wherein the initial value of the number of matches is 0, and the target knowledge graph entry is the connection path in the cross-stage knowledge graph, from the topological node corresponding to the alarm device that generates the alarm information to the topological node corresponding to the fundamental alarm device; When the number of matches exceeds a preset matching threshold, the target knowledge graph entry is deleted from the cross-stage knowledge graph.

5. The method according to claim 1, characterized in that In the case where any of the to-be-detected alarm information in the to-be-detected alarm information set does not match the preset fundamental alarm information, the method further includes: When it is determined that the mismatch is caused by the lack of the preset fundamental alarm information in the alarm information set to be detected, the alarm rules for generating the alarm information set to be detected are modified, and the cross-stage knowledge graph is updated based on the modified alarm rules.

6. The method according to claim 4 or 5, characterized in that: In the case where it is determined that the stage to which the fundamental alarm device belongs is different from the stage to which the initial alarm device belongs, the method further includes: Updating first boundary resource information between the stages corresponding to the fundamental alarm device and the initial alarm device; Acquire sub-initial warning information of the same type as the initial warning information; In the case where the sub-initial alarm information is associated with an alarm of the updated first boundary resource information, the updated first boundary resource information is determined as new first boundary resource information.

7. The method according to claim 1, characterized in that The fault location model is obtained in the following way: Acquire annotated historical alarm data, wherein the annotated historical alarm data includes annotated data and the historical alarm data, wherein the annotated data is a correctly annotated first fundamental alarm device and a first preset fundamental alarm information corresponding to the historical alarm data; The initial fault location model is trained based on the labeled historical alarm data, and the training accuracy of the initial fault location model is calculated after each training. The training is stopped when the training accuracy is greater than a preset accuracy threshold to obtain the fault location model, wherein the training accuracy is determined based on a functional relationship between the number of correct positioning and the total number of the labeled historical alarm data, the number of correct positioning is the number of successful matches between the predicted data and the labeled historical alarm data, and the predicted data is the second fundamental alarm device and the second preset fundamental alarm information obtained by the initial fault location model performing fault positioning on the historical alarm data.

8. A network fault location device, characterized in that: include: An acquisition module, used to acquire initial alarm information generated by an initial alarm device of a network failure; A first determination module is used to determine the fundamental alarm device and preset fundamental alarm information associated with the initial alarm device based on the cross-stage knowledge graph using a fault location model, wherein the cross-stage knowledge graph is used to display all alarm devices and preset fundamental alarm information of each alarm device, and each topological node in the cross-stage knowledge graph corresponds to an alarm device; A second determination module is used to determine the alarm information to be detected as the fundamental alarm information when any one of the alarm information to be detected in the alarm information to be detected set matches the preset fundamental alarm information; The third determination module is used to determine the fundamental alarm information and the fundamental alarm device as network fault locating information, and push the network fault locating information to the user terminal.

9. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a program, wherein when the program is executed, the device where the non-volatile storage medium is located is controlled to execute the network fault locating method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: include: A memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the program executes the network fault locating method according to any one of claims 1 to 7 when running.

11. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the network fault locating method described in any one of claims 1 to 7 is implemented.

Images