Network fault positioning method and device and nonvolatile storage medium

Abstract

The application discloses a network fault positioning method and device and a nonvolatile storage medium. The method comprises the following steps: obtaining initial alarm information generated by an initial alarm device of a network fault; determining a root alarm device associated with the initial alarm device and preset root alarm information based on a cross-stage knowledge graph by using a fault positioning model; in the case that any one of the to-be-detected alarm information in the to-be-detected alarm information set matches the preset root alarm information, the to-be-detected alarm information is determined as the root alarm information; the root alarm information and the root alarm device are determined as network fault positioning information, and the network fault positioning information is pushed to a user terminal. The application solves the technical problem that the accuracy of network fault positioning is low due to the dependence on human experience when the network fault is positioned in multiple stages of service transmission in the related art.

Description

Technical Field

[0001] This application relates to the field of network technology, and more specifically, to a method, apparatus, and non-volatile storage medium for locating network faults. Background Technology

[0002] With the rapid development of next-generation information technologies such as the Internet of Things, 5G, cloud computing, industrial internet, and big data, the connectivity, intelligence level, and data processing and analysis capabilities of devices have been greatly improved. At the same time, driven by the demand for network self-intelligence, higher requirements have been placed on network fault self-localization.

[0003] In related technologies, network fault location often relies heavily on the experience of operations and maintenance (O&M) personnel. The dynamic fluctuations in human experience can significantly impact the accuracy of fault location. O&M personnel can use knowledge graphs to locate network faults. Knowledge graphs associate equipment operating parameters, operating status, and fault causes, improving fault handling efficiency. However, most enterprises manually construct their equipment knowledge graphs. O&M personnel collect information on equipment parameters, operating status, and fault causes, then manually create the knowledge graph. Manual knowledge graph construction suffers from low efficiency, long update cycles, and the presence of errors and inaccuracies. Furthermore, equipment alarm rules are often isolated and defined by the equipment manufacturer. O&M personnel can only rely on these rules to handle alarms and cannot optimize or improve alarm rules through changes. Additionally, the multi-stage, multi-person collaboration and cross-stage multi-person linkage in business processes also contribute to inefficiencies in network fault location.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This application provides a method, apparatus, and non-volatile storage medium for locating network faults, in order to at least solve the technical problem in the related art that the reliance on human experience leads to low accuracy in locating network faults during multi-stage service transmission.

[0006] According to one aspect of the embodiments of this application, a method for locating network faults is provided, comprising: acquiring initial alarm information generated by an initial alarm device of a network fault; using a fault location model based on a cross-stage knowledge graph to determine the root alarm device associated with the initial alarm device and preset root alarm information, wherein the cross-stage knowledge graph is used to display all alarm devices and preset root alarm information for each alarm device, and each topology node in the cross-stage knowledge graph corresponds to an alarm device; if any alarm information to be detected in the set of alarm information to be detected matches the preset root alarm information, the alarm information to be detected is determined as root alarm information; the root alarm information and the root alarm device are determined as network fault location information, and the network fault location information is pushed to a user terminal.

[0007] In some embodiments of this application, the cross-stage knowledge graph is constructed in the following manner: multiple initial stage knowledge graphs are constructed based on the device logical relationships of different stages of business processing, wherein the device logical relationship of each stage is used to indicate the connection relationship between alarm devices belonging to the corresponding stage, and each initial knowledge graph corresponds to a stage of business processing; multiple initial stage knowledge graphs are associated to obtain an initial cross-stage knowledge graph; and the preset fundamental alarm information of each alarm device is mapped to the initial cross-stage knowledge graph to obtain the cross-stage knowledge graph.

[0008] In some embodiments of this application, multiple initial stage knowledge graphs are associated to obtain an initial cross-stage knowledge graph, including: associating multiple initial stage knowledge graphs based on boundary resource information to obtain an initial cross-stage knowledge graph, wherein the boundary resource information is used to indicate resource information shared by two adjacent stages of business processing.

[0009] In some embodiments of this application, when any alarm information to be detected in the set of alarm information to be detected does not match any preset fundamental alarm information, the method further includes: if it is determined that the mismatch is caused by an error in the preset fundamental alarm information, increasing the cumulative matching count of the target knowledge graph entry in the cross-stage knowledge graph by 1, wherein the initial value of the matching count is 0, and the target knowledge graph entry is the connection path in the cross-stage knowledge graph from the topology node corresponding to the alarm device that generated the alarm information to the topology node corresponding to the fundamental alarm device; if the matching count exceeds a preset matching threshold, deleting the target knowledge graph entry from the cross-stage knowledge graph.

[0010] In some embodiments of this application, when any alarm information to be detected in the set of alarm information to be detected does not match the preset fundamental alarm information, the method further includes: when it is determined that the mismatch is caused by the lack of preset fundamental alarm information in the set of alarm information to be detected, modifying the alarm rules that generate the set of alarm information to be detected, and updating the cross-stage knowledge graph based on the modified alarm rules.

[0011] In some embodiments of this application, when it is determined that the stage to which the root alarm device belongs is different from the stage to which the initial alarm device belongs, the method further includes: updating the first boundary resource information between the stages corresponding to the root alarm device and the initial alarm device; obtaining sub-initial alarm information of the same type as the initial alarm information; and, if an alarm associated with the updated first boundary resource information is found in the sub-initial alarm information, determining the updated first boundary resource information as the new first boundary resource information.

[0012] In some embodiments of this application, the fault location model is obtained by: acquiring labeled historical alarm data, wherein the labeled historical alarm data includes labeled data and historical alarm data, wherein the labeled data is the first fundamental alarm device and the first preset fundamental alarm information correctly labeled corresponding to the historical alarm data; training the initial fault location model based on the labeled historical alarm data, calculating the training accuracy of the initial fault location model after each training, stopping training when the training accuracy is greater than a preset accuracy threshold, thereby obtaining the fault location model, wherein the training accuracy is determined based on the functional relationship between the number of correctly located faults and the total number of labeled historical alarm data, the number of correctly located faults is the number of predicted data that successfully matches the labeled historical alarm data, and the predicted data is the second fundamental alarm device and the second preset fundamental alarm information obtained by the initial fault location model from the historical alarm data fault location.

[0013] According to another aspect of the embodiments of this application, a network fault location device is also provided, comprising: an acquisition module, configured to acquire initial alarm information generated by an initial alarm device of a network fault; a first determination module, configured to determine the root alarm device associated with the initial alarm device and preset root alarm information based on a cross-stage knowledge graph using a fault location model, wherein the cross-stage knowledge graph is used to display all alarm devices and preset root alarm information for each alarm device, and each topology node in the cross-stage knowledge graph corresponds to an alarm device; a second determination module, configured to determine the alarm information to be detected as root alarm information if any alarm information to be detected in the set of alarm information to be detected matches the preset root alarm information; and a third determination module, configured to determine the root alarm information and the root alarm device as network fault location information, and push the network fault location information to a user terminal.

[0014] According to another aspect of the embodiments of this application, a non-volatile storage medium is also provided, wherein a program is stored in the non-volatile storage medium, wherein the program controls the device where the non-volatile storage medium is located to execute the above-mentioned network fault location method when it runs.

[0015] According to another aspect of the embodiments of this application, an electronic device is also provided, including: a memory and a processor, wherein the processor is configured to run a program stored in the memory, wherein the program executes the above-described network fault location method during runtime.

[0016] In this embodiment, the method involves acquiring initial alarm information generated by the initial alarm device of the network fault; using a fault location model based on a cross-stage knowledge graph to determine the root alarm device associated with the initial alarm device and the preset root alarm information, wherein the cross-stage knowledge graph is used to display all alarm devices and the preset root alarm information of each alarm device, and each topology node in the cross-stage knowledge graph corresponds to one alarm device; if any alarm information to be detected in the set of alarm information to be detected matches the preset root alarm information, the alarm information to be detected is determined as the root alarm information; the root alarm information is then... The method involves identifying the root alarm device as network fault location information and pushing this information to the user terminal. It utilizes a fault location model based on a cross-stage knowledge graph to determine the root alarm device associated with the initial alarm device and preset root alarm information. Then, the preset root alarm information and the set of alarm information to be detected are used to determine the final root alarm information. This achieves rapid network fault location based on the fault location model and cross-stage knowledge graph, thus solving the technical problem of low accuracy in network fault location due to reliance on human experience when performing network fault location in multiple stages of service transmission. Attached Figure Description

[0017] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0018] Figure 1 This is a hardware structure block diagram of a computer terminal for implementing a network fault location method according to an embodiment of this application;

[0019] Figure 2 This is a flowchart of a network fault location method provided according to an embodiment of this application;

[0020] Figure 3 This is a flowchart of a knowledge graph lifecycle management method provided according to an embodiment of this application;

[0021] Figure 4 This is a schematic diagram of a network fault location device provided according to an embodiment of this application. Detailed Implementation

[0022] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0023] The information collected in this application embodiment is information and data authorized by the user or fully authorized by all parties. The collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data all comply with the relevant laws, regulations and standards of the relevant regions, and necessary confidentiality measures have been taken. It does not violate public order and good morals, and provides corresponding operation entry points for users to choose to authorize or reject the automated decision results. If the user chooses to reject, the process will proceed to the expert decision-making process.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] To better understand the embodiments of this application, the technical terms involved in the embodiments of this application are explained below:

[0026] Knowledge Graph: In the library and information science field, knowledge graphs are called knowledge domain visualization or knowledge domain mapping maps. They are a series of different graphics that show the development process and structural relationships of knowledge. They use visualization technology to describe knowledge resources and their carriers, and to mine, analyze, construct, draw and display knowledge and the interrelationships between them.

[0027] Network alarms: In network management, a fault is defined as the cause of functional abnormalities, which is the reason for alarm events. An alarm is an event report consisting of a notification issued by a managed object when a specific event occurs, used to transmit alarm information. It is predefined by the manufacturer and generated by devices in the network. It is a message issued by a system indicating that something has happened or an anomaly has occurred, and is ultimately observed by network administrators.

[0028] Neo4j is a high-performance NoSQL (Not Only SQL) graph database management system that stores structured data on a network instead of tables. It's an embedded, disk-based Java persistence engine with full transactional features, but it stores structured data on a network (mathematically called a graph) instead of tables. Neo4j can also be viewed as a high-performance graph engine with all the features of a mature database. In Neo4j, data is stored in the form of nodes and relationships, a storage method well-suited for handling highly connected and complex data structures, such as social networks, recommendation systems, and knowledge graphs.

[0029] In related technologies, network fault location often relies on the experience of operations and maintenance personnel. The dynamic fluctuations in human experience can significantly impact the accuracy of fault location. While knowledge graphs can improve fault handling efficiency by associating device operating parameters, operating status, and fault causes, most enterprises manually construct their device knowledge graphs. Operations and maintenance personnel collect information on device parameters, operating status, and fault causes, resulting in low efficiency, long update cycles, and the potential for errors and inaccuracies. Therefore, in related technologies, relying on human experience for network fault location during multi-stage service transmission leads to low accuracy. To address this issue, this application provides a solution, detailed below.

[0030] According to an embodiment of this application, an embodiment of a method for locating network faults is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0031] The methods and embodiments provided in this application can be executed on a computer terminal or similar computing device. Figure 1A hardware block diagram of a computer terminal for implementing a method for locating network faults is shown. Figure 1 As shown, the computer terminal 10 may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission module 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0032] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10. As involved in the embodiments of this application, the data processing circuits serve as a form of processor control (e.g., selection of a variable resistor termination path connected to an interface).

[0033] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the network fault location method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned network fault location method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0034] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0035] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10.

[0036] In the above operating environment, this application provides an embodiment of a method for locating network faults. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Also, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0037] like Figure 2 The diagram shown is a flowchart of a network fault location method provided according to an embodiment of this application.

[0038] Step S202: Obtain the initial alarm information generated by the initial alarm device for network faults.

[0039] The alarm system generates and collects alarm information from all alarm devices. When it is necessary to determine the root alarm corresponding to an alarm and the root alarm device that generated the root alarm, the alarm information is obtained from the alarm system as the initial alarm information. The root alarm information is the source of the alarm information, and the root alarm device is the alarm device that first generated the alarm. Finding the source of the problem is the key to handling network faults and locating network faults.

[0040] Step S204: Using a fault location model (e.g., an AI large model), the fundamental alarm device associated with the initial alarm device and the preset fundamental alarm information are determined based on a cross-stage knowledge graph. The cross-stage knowledge graph is used to display all alarm devices and the preset fundamental alarm information of each alarm device. Each topology node in the cross-stage knowledge graph corresponds to one alarm device.

[0041] In the technical solution provided in step S204, the cross-stage knowledge graph is constructed in the following way: multiple initial stage knowledge graphs are constructed based on the device logical relationships of different stages of business processing, wherein the device logical relationship of each stage is used to indicate the connection relationship between alarm devices belonging to the corresponding stage, and each initial knowledge graph corresponds to a stage of business processing; multiple initial stage knowledge graphs are associated to obtain an initial cross-stage knowledge graph; and the preset fundamental alarm information of each alarm device is mapped to the initial cross-stage knowledge graph to obtain the cross-stage knowledge graph.

[0042] In the above steps, there are several ways to associate multiple initial stage knowledge graphs to obtain an initial cross-stage knowledge graph. For example, multiple initial stage knowledge graphs can be associated based on boundary resource information to obtain an initial cross-stage knowledge graph (also known as a professional knowledge graph). Boundary resource information is used to indicate the resource information shared by two adjacent stages of business processing.

[0043] The following are specific examples:

[0044] As the initial stage of the cross-stage knowledge graph lifecycle, multiple initial-stage knowledge graphs are constructed based on the logical relationships between devices for different business processing stages. Specifically, the logical relationships between devices refer to the interconnection relationships between devices (i.e., alarm devices) based on their functions and configurations. These relationships include both physical connections (such as cable connections) and logical data flow paths and control links. When constructing the knowledge graph, these logical relationships are transformed into a topology structure. In the initial-stage knowledge graph, topology vertices represent specific devices in the network that can generate or receive alarm information; therefore, they are also called alarm devices. For example, in the IP routing stage of business processing, which belongs to the IP specialty, topology vertices can be network devices such as routers, switches, and firewalls (i.e., alarm devices). The attributes of each vertex can include device ID, type, location, status, and other information. Topology edges reflect the physical or logical connections between alarm devices. When constructing the initial-stage knowledge graph, based on the logical relationships between devices, topology edges express how data flows between devices and their interdependencies in the business process. For example, the connection between a router and a switch can be represented as an edge in a knowledge graph, with attributes that may include connection type (such as Ethernet connection), port, bandwidth, etc.

[0045] Specifically: Obtain the logical relationships of devices from the resource network management system. The resource network management system stores a large number of logical relationships of devices (i.e., device resource information), including but not limited to: OLT-SW-BAS link information: describing the connection relationship between the Optical Line Terminal (OLT), Switch (SW), and Broadband Access Server (BAS), including interface, link type, bandwidth, etc. Base Station-AB-ER Link Information: This includes connection information for base stations, A / B interfaces (in GSM networks, the A interface is the interface between the base station controller and the mobile switching center, used for transmitting voice and data information; in CDMA networks, the B interface is the interface between the base station controller and the mobile switching center, equivalent to the A interface in GSM networks), E interfaces (in GSM networks, the E interface is the interface between base station controllers, used for control and data transmission between base station controllers), and R interfaces (in Universal Mobile Telecommunications System (UMTS) networks, the R interface is the interface between base station controllers, used for control and data transmission between base station controllers), reflecting the link structure of the mobile network. Equipment / Module and Port Information: This includes the equipment model, serial number, software version, hardware module information, and the status and configuration of physical ports. Information on network stations, computer rooms, and environmental conditions: This describes the geographical location, computer room environment, and power environment of network devices, which helps in understanding the physical location and operating environment of the devices. This resource information forms the basis for building a knowledge graph, providing the physical and logical layout of the network architecture, as well as the status and attributes of each device. Collected resource data is associated with network management codes, which are unique identifiers for network devices and resources in resource management. Through this association, each piece of resource data has a location identifier in network management, facilitating subsequent data integration and querying. The logical relationships of devices are mapped to the topological vertices and edges of multiple initial-stage knowledge graphs according to different stages of business processing (corresponding to different specialties). Then, by identifying the shared boundary resource information between two adjacent business stages, these independent initial-stage knowledge graphs are associated to obtain a cross-stage knowledge graph. When different network services or professional networks at different stages rely on the same alarm devices for connection or data exchange, the information of these shared alarm devices is included as part of the boundary resource information.Boundary resource information can include physical connection points, shared network devices, or protocols. It also involves connection interfaces and links between devices in cross-disciplinary networks, including interface type (e.g., Ethernet, fiber optic), link status (e.g., active, faulty), bandwidth, latency, and possible Quality of Service (QoS) and Service Level Agreement (SLA) information. Operational guidelines, maintenance manuals, and troubleshooting manuals for boundary resources in professional handbooks also constitute part of the boundary resource information. When multiple initial-stage knowledge graphs are associated based on boundary resource information, the attributes of the associated topological edges represent the boundary resource information shared by the two stages.

[0046] Identify the professional manuals to determine the preset root alarm information for each alarm device. These manuals, which may include operation guidelines, maintenance manuals, fault diagnosis manuals, etc., are written by equipment manufacturers, technology providers, or industry experts to provide technicians with comprehensive information on equipment functions, operating procedures, maintenance guidelines, fault diagnosis, and solutions. The content of the professional manuals may include, but is not limited to: detailed technical specifications and parameters of the equipment or system; steps for installing and configuring the equipment; procedures for daily operation and maintenance; methods for identifying abnormal situations and faults; guidance on troubleshooting and repair; safe operating procedures and precautions; guidance on equipment or system upgrades and updates; frequently asked questions and fault case analyses. Also included is all alarm information generated by each alarm device, the reason for the alarm information, and the root cause of the alarm information (i.e., the corresponding root alarm device and the expected handling method). Based on Neo4j, entity recognition is performed in the professional manual, mapping the preset fundamental alarm information of each alarm device to the constructed cross-stage knowledge graph. The attributes of each topological vertex also include preset fundamental alarm information (i.e., all alarm information that each alarm device can generate based on the professional manual) and preset alarm information association information (i.e., the fundamental alarm devices associated with the preset alarm information and the expected processing methods based on the professional manual).

[0047] For example, in a business scenario where a user accesses the internet via a wireless network, this process can be subdivided into several business processing stages: Access Stage: User equipment (such as a mobile phone) accesses the network through a wireless base station. This stage involves expertise in wireless networks and is handled by wireless or access network specialists. In this stage, user equipment connects to the network via a wireless network or wired access technology (such as fiber optic). Transmission Stage: Data is transmitted from the base station to the core network. This process may involve specialized equipment in the transmission network, such as transmission lines, optical network units, and transmission nodes, and is handled by transmission specialists. Data is transmitted from the access point to the core network. IP Routing Stage: Once data enters the core network, IP specialists come into play. Data packets pass through IP routers and switches, and routing decisions are made based on IP addresses to ensure the data reaches the correct destination. This stage involves the logical relationships and resource management of IP specialist equipment to ensure efficient and reliable data transmission. An initial stage knowledge graph is constructed for each stage, and correlations are made based on boundary resource information to obtain a cross-knowledge knowledge graph. This integrates the logical relationships of equipment, resource information, and alarm correlations across these different business processing stages to form a comprehensive network fault location and analysis graph.

[0048] The fault location model is used to determine the fundamental alarm device associated with the initial alarm device and the preset fundamental alarm information based on the cross-stage knowledge graph. That is, the fault location model determines the topology node to which the initial alarm device belongs in the cross-stage knowledge graph, and identifies the fundamental alarm device and preset fundamental alarm information associated with the attributes of the topology node.

[0049] Step S206: If any alarm information to be detected in the set of alarm information to be detected matches a preset fundamental alarm information, the alarm information to be detected is determined as the fundamental alarm information.

[0050] In the technical solution provided in step S206, if any alarm information to be detected in the set of alarm information to be detected does not match the preset fundamental alarm information, and if it is determined that the mismatch is caused by an error in the preset fundamental alarm information, the matching count of the target knowledge graph entry in the cross-stage knowledge graph is increased by 1. The initial value of the matching count is 0, and the target knowledge graph entry is the connection path in the cross-stage knowledge graph from the topology node corresponding to the alarm device that generated the alarm information back to the topology node corresponding to the fundamental alarm device. If the matching count exceeds a preset matching threshold, the target knowledge graph entry is deleted from the cross-stage knowledge graph. If it is determined that the mismatch is caused by the lack of preset fundamental alarm information in the set of alarm information to be detected, the alarm rules that generated the set of alarm information to be detected are modified, and the cross-stage knowledge graph is updated based on the modified alarm rules.

[0051] In cases where a mismatch occurs due to an error in the preset fundamental alarm information or due to a lack of preset fundamental alarm information in the set of alarm information to be detected, it is determined whether the stage to which the fundamental alarm device belongs is the same as the stage to which the initial alarm device belongs. If it is determined that the stage to which the fundamental alarm device belongs is different from the stage to which the initial alarm device belongs, the first boundary resource information between the stages corresponding to the fundamental alarm device and the initial alarm device is updated; a sub-initial alarm information of the same type as the initial alarm information is obtained; if an alarm associated with the updated first boundary resource information is found in the sub-initial alarm information, the updated first boundary resource information is determined as the new first boundary resource information.

[0052] The following are specific examples:

[0053] The alarm system queries the set of alarm information to be detected. The set of alarm information to be detected contains all alarm information generated by all current alarm devices. If any alarm information to be detected in the set of alarm information to be detected matches the preset fundamental alarm information (i.e. the alarm information is the same), the alarm information to be detected is determined as the fundamental alarm information.

[0054] If any alarm message in the set of alarm messages to be detected does not match the preset fundamental alarm message, there may be two reasons for the mismatch: the alarm rules of the alarm system that generate alarm messages are problematic, resulting in no alarm message to be detected matching the preset fundamental alarm message; or there is a problem with the cross-stage knowledge graph, resulting in an error in the preset fundamental alarm message. In this case, an alarm mismatch prompt is generated, and manual confirmation is performed. Based on the instructions from professionals regarding the cause of the mismatch, the specific reason for the mismatch is determined. If the mismatch is determined to be due to an error in the preset fundamental alarm message (i.e., a problem with the cross-stage knowledge graph), the matching count of the target knowledge graph entry corresponding to the initial alarm message in the cross-stage knowledge graph is increased by 1. If the matching count exceeds a preset matching threshold, the target knowledge graph entry is deleted from the cross-stage knowledge graph. For knowledge graph entries in the verification period, if an error exists during the first cross-stage knowledge graph matching of the target knowledge graph entry, the knowledge graph exit period is initiated, and the knowledge entry is directly deleted. After a successful initial match, the knowledge graph enters its runtime phase. During the runtime phase, the number of matches for the target knowledge graph entry increases by 1 for each incorrect match. If the number of matches exceeds a preset matching threshold (e.g., 5), the knowledge graph exit phase begins, and the target knowledge graph entry is removed from the cross-stage knowledge graph.

[0055] If a mismatch is determined to be due to the lack of preset fundamental alarm information in the set of alarm information to be detected, it indicates that there may be missing alarm information. Feedback is then sent to the alarm system. The collected system logs are manually traced to pinpoint the actual source of the alarm, obtaining the target log corresponding to the initial alarm information. Based on a large model, the manual is interpreted to identify key fields in the target system log, such as timestamp, device name, alarm level, and alarm description, thereby classifying and understanding the alarm information. Based on the above analysis results, if it is found that alarm rules fail to cover or accurately identify certain types of alarm information, the alarm rules are modified. This involves modifying the alarm rules that generate the set of alarm information to be detected in response to professional personnel's instructions. The modification process may involve adjusting alarm thresholds, adding new alarm types, or improving the alarm information matching algorithm. The optimized alarm rules should be applied to the alarm system promptly to ensure that the system can generate and report alarm information according to the updated rules. Based on the modified alarm rules, the topological nodes, topological edges, and resource information in the attributes of the knowledge entries involved in the cross-stage knowledge graph are updated, as well as the boundary resource information. If there is no corresponding knowledge entry in the cross-stage knowledge graph, a new knowledge graph entry is constructed in the knowledge graph.

[0056] Regardless of which of the two reasons mentioned above is causing the issue, if any alarm message in the set of alarm messages to be detected matches the preset fundamental alarm message, it is necessary to determine whether the stage to which the fundamental alarm device belongs is the same as the stage to which the initial alarm device belongs. If it is determined that the stage to which the fundamental alarm device belongs is different from the stage to which the initial alarm device belongs, it is also necessary to synchronously update the boundary resource information. Specifically, the first boundary resource information between the stages corresponding to the fundamental alarm device and the initial alarm device needs to be updated. At the same time, the updated first boundary resource information needs to be verified for resource association: In subsequent operation, when a sub-initial alarm message that belongs to the same stage, has the same alarm type, and has the same alarm device as the initial alarm message is received, if the alarm device of the sub-initial alarm message is associated with the updated first boundary resource information during the process of tracing back to the fundamental alarm device, that is, if the attribute of the topological edge corresponding to the boundary resource information in the target knowledge graph is associated with the first boundary resource information, then the update is determined to be correct, and the updated first boundary resource information is determined to be the new first boundary resource information. If no association is found, the first boundary resource information will not be updated, and resource association verification will continue until an association is found. The updated first boundary resource information will then be determined as the new first boundary resource information.

[0057] When updating a cross-stage knowledge graph, the topological edges, resource information in the attributes of topological nodes, and boundary resource information outside the target knowledge entry may also need to be updated. In this case, alert association is performed based on the time dimension, and resources with similar spatial dimensions are considered suspected related resources. The suspected related resources with the highest similarity ranking are considered related resources (including topological edges, resource information in the attributes of topological nodes, and boundary resource information) and updated synchronously. First, resources (including topological edges, resource information in the attributes of topological nodes, and boundary resource information) are standardized by time and space. Time standardization converts the time data of all resources into a unified time format, such as a timestamp in seconds. Let the original time T of resource i (i.e., the aforementioned related resource) be t, and the standardized time be t. The conversion formula is t = f(T), where f is the time conversion function, ensuring that all resources are compared on the same time scale. Spatial coordinateization: For spatial information, a target coordinate system is determined, such as a latitude and longitude coordinate system. If the spatial description of a resource is text information such as an address, it is converted into latitude and longitude coordinates using geocoding technology. Let the original spatial description of resource i be S... i The coordinates are converted using the geocoding function g, resulting in coordinates (x, y), where x is longitude and y is latitude, i.e., (x, y) = g(S i ).

[0058] Step S208: The fundamental alarm information and the fundamental alarm device are identified as network fault location information, and the network fault location information is pushed to the user terminal.

[0059] The following is a specific implementation: The fundamental alarm information and the fundamental alarm device are identified as network fault location information. This network fault location information specifically includes attribute information on the topology node corresponding to the fundamental alarm device, i.e., the expected handling method corresponding to the fundamental alarm information. The network fault location information is pushed to the user terminal for maintenance personnel to perform network fault repair.

[0060] The fault location model used in each of the above steps is obtained as follows: Obtain the labeled historical alarm data, where the labeled historical alarm data includes the labeled data and the historical alarm data. The labeled data is the correctly labeled first root alarm device and the first preset root alarm information corresponding to the historical alarm data. Train the initial fault location model based on the labeled historical alarm data. Calculate the training accuracy of the initial fault location model after each training. Stop training when the training accuracy is greater than the preset accuracy threshold to obtain the fault location model. The training accuracy is determined based on the functional relationship between the number of correct locations and the total number of the labeled historical alarm data. The number of correct locations is the number of successful matches between the predicted data and the labeled historical alarm data. The predicted data is the second root alarm device and the second preset root alarm information obtained by the initial fault location model for fault location of the historical alarm data.

[0061] The following are specific embodiments:

[0062] Obtain the labeled historical alarm data. The labeled historical alarm data includes the labeled data and the historical alarm data. The correctly labeled first root alarm device and the first preset root alarm information corresponding to the historical alarm data, that is, the correct root alarm device and the preset root alarm information corresponding to the historical alarm data. Input the historical alarm information into the initial fault location model for training. The initial fault location model will predict the second root alarm device and the second preset root alarm information corresponding to each historical alarm information. Calculate the training accuracy of the initial fault location model after each training. Stop training when the training accuracy is greater than the preset accuracy threshold to obtain the fault location model. The training accuracy is determined based on the functional relationship between the number of correct locations and the total number of the labeled historical alarm data. For example, the functional relationship is determined by the following formula: Training accuracy (A) = the amount of correctly identified labeled data (C) (i.e., the above number of correct locations) ÷ the total number of the labeled historical alarm data (T). And calculate the performance of the trained model. The performance of the trained model (F) = training accuracy (A) × generalization ability coefficient (G, a constant, 0 < G < 1); When the performance of the trained model is less than the preset performance threshold, retrain the model.

[0063] After obtaining the fault location model, continuously monitor the fault location model. Calculate the alarm recognition accuracy (R) every preset time period. Alarm recognition accuracy = the number of correctly identified alarm information (N) ÷ the total number of alarm information within the preset time period (K). When the alarm recognition accuracy is less than the preset accuracy threshold (for example, 90%), retrain the fault location model.

[0064] The embodiment of the present application also provides a flowchart for the life cycle management of a knowledge graph, as Figure 3 As shown, the evaluation of the knowledge graph (i.e., the cross-stage knowledge graph) is performed. First, in the initial stage of the knowledge graph (i.e., the cross-stage knowledge graph), resource association is performed (i.e., in the above embodiment, multiple initial stage knowledge graphs are constructed based on the logical relationships of devices for different business processing stages). Then, fault tracing is performed, that is, a fault location model is used to determine the root alarm device associated with the initial alarm device and the preset root alarm information based on the cross-stage knowledge graph. Then, the knowledge graph is extended to determine if the knowledge graph is missing. If there are no missing parts, the knowledge graph is applied to perform source-cause alarms (i.e., alarms to be detected). If any alarm message to be detected in the information set matches a preset fundamental alarm message, the alarm message to be detected is identified as the fundamental alarm message, and the fundamental alarm message and the fundamental alarm device are identified as network fault location information, and the network fault location information is pushed to the user terminal. If there is a missing message, and it is determined that the mismatch is caused by an error in the preset fundamental alarm message, the matching count of the target knowledge graph entry in the cross-stage knowledge graph is increased by 1. If the matching count exceeds a preset matching threshold, the knowledge graph exit period is entered, and the target knowledge graph entry is deleted from the cross-stage knowledge graph. If it is determined that the mismatch is caused by the lack of preset fundamental alarm message in the alarm message set to be detected, and there is a missing alarm rule, an alarm is triggered and the knowledge graph regeneration period is entered (i.e., the alarm rules that generate the alarm message set to be detected are modified as described above, and the cross-stage knowledge graph is updated based on the modified alarm rules), and the boundary resources (i.e., the aforementioned boundary resource information) are updated simultaneously.

[0065] This application also provides a schematic diagram of the structure of a network fault location device, such as... Figure 4 As shown, it includes:

[0066] The acquisition module 402 is used to acquire the initial alarm information generated by the initial alarm device for network faults.

[0067] The first determining module 404 is used to determine the fundamental alarm device associated with the initial alarm device and the preset fundamental alarm information based on the cross-stage knowledge graph using the fault location model. The cross-stage knowledge graph is used to display all alarm devices and the preset fundamental alarm information of each alarm device. Each topology node in the cross-stage knowledge graph corresponds to one alarm device.

[0068] The first determining module 404 is also used to construct multiple initial stage knowledge graphs based on the device logical relationships of different stages of business processing. The device logical relationships of each stage are used to indicate the connection relationships between alarm devices belonging to the corresponding stage, and each initial knowledge graph corresponds to a stage of business processing. Multiple initial stage knowledge graphs are associated to obtain an initial cross-stage knowledge graph. The preset fundamental alarm information of each alarm device is mapped to the initial cross-stage knowledge graph to obtain a cross-stage knowledge graph.

[0069] The first determining module 404 is also used to associate multiple initial stage knowledge graphs based on boundary resource information to obtain an initial cross-stage knowledge graph, wherein the boundary resource information is used to indicate the resource information used by two adjacent stages of business processing.

[0070] The second determining module 406 is used to determine the alarm information to be detected as the fundamental alarm information when any alarm information to be detected in the set of alarm information to be detected matches the preset fundamental alarm information.

[0071] The second determining module 406 is further configured to, when determining that a mismatch is caused by an error in the preset fundamental alarm information, increase the cumulative matching count of the target knowledge graph entry in the cross-stage knowledge graph by 1, wherein the initial value of the matching count is 0, and the target knowledge graph entry is the connection path in the cross-stage knowledge graph from the topology node corresponding to the alarm device that generated the alarm information to the topology node corresponding to the fundamental alarm device; and delete the target knowledge graph entry from the cross-stage knowledge graph when the matching count exceeds the preset matching threshold.

[0072] The second determining module 406 is also used to modify the alarm rules that generate the set of alarm information to be detected when it is determined that the mismatch is caused by the lack of preset fundamental alarm information in the set of alarm information to be detected, and to update the cross-stage knowledge graph based on the modified alarm rules.

[0073] The second determining module 406 is further configured to: update the first boundary resource information between the stages corresponding to the fundamental alarm device and the initial alarm device when the stage to which the fundamental alarm device belongs is different from the stage to which the initial alarm device belongs; obtain sub-initial alarm information of the same type as the initial alarm information; and determine the updated first boundary resource information as the new first boundary resource information when the sub-initial alarm information is associated with an alarm of the updated first boundary resource information.

[0074] The third determination module 408 is used to determine the fundamental alarm information and fundamental alarm devices as network fault location information, and push the network fault location information to the user terminal.

[0075] It should be noted that, Figure 4 The network fault location device shown is used to perform Figure 2 The method for locating network faults shown is therefore Figure 2 The explanations and descriptions in the network fault location method also apply to the network fault location device, and will not be repeated here.

[0076] It should be noted that each module in the above-mentioned network fault location device can be a program module (for example, a set of program instructions to implement a certain function) or a hardware module. For the latter, it can be manifested in the following forms, but is not limited to them: each of the above modules is manifested as a processor, or the functions of each of the above modules are implemented by a processor.

[0077] This application also provides a non-volatile storage medium, which includes a stored program. During program execution, the device containing the non-volatile storage medium executes the above-described network fault location method. For example, it acquires initial alarm information generated by the initial alarm device of the network fault; uses a fault location model based on a cross-stage knowledge graph to determine the root alarm device associated with the initial alarm device and preset root alarm information, wherein the cross-stage knowledge graph displays all alarm devices and preset root alarm information for each alarm device, and each topology node in the cross-stage knowledge graph corresponds to one alarm device; if any alarm information to be detected in the set of alarm information to be detected matches the preset root alarm information, the alarm information to be detected is determined as the root alarm information; the root alarm information and the root alarm device are determined as network fault location information, and the network fault location information is pushed to the user terminal.

[0078] This application also provides an electronic device, including a processor for running a program, wherein the above-described network fault location method is executed during program execution. For example, the method involves: acquiring initial alarm information generated by an initial alarm device of a network fault; using a fault location model based on a cross-stage knowledge graph to determine the root alarm device associated with the initial alarm device and preset root alarm information, wherein the cross-stage knowledge graph displays all alarm devices and preset root alarm information for each alarm device, and each topology node in the cross-stage knowledge graph corresponds to one alarm device; if any alarm information to be detected in the set of alarm information to be detected matches the preset root alarm information, the alarm information to be detected is determined as the root alarm information; the root alarm information and the root alarm device are determined as network fault location information, and the network fault location information is pushed to the user terminal.

[0079] According to another aspect of the embodiments of this application, a computer program product is also provided, including a computer program that, when executed by a processor, implements the above-described method for locating network faults. For example, it acquires initial alarm information generated by an initial alarm device of a network fault; uses a fault location model based on a cross-stage knowledge graph to determine the root alarm device associated with the initial alarm device and preset root alarm information, wherein the cross-stage knowledge graph is used to display all alarm devices and preset root alarm information for each alarm device, and each topology node in the cross-stage knowledge graph corresponds to one alarm device; if any alarm information to be detected in the set of alarm information to be detected matches the preset root alarm information, the alarm information to be detected is determined as the root alarm information; the root alarm information and the root alarm device are determined as network fault location information, and the network fault location information is pushed to a user terminal.

[0080] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0081] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0082] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0083] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0084] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to related technologies, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0085] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for locating network faults, characterized in that, include: Obtain the initial alarm information generated by the initial alarm device for network failure; A fault location model is used to determine the fundamental alarm device associated with the initial alarm device and the preset fundamental alarm information based on a cross-stage knowledge graph. The cross-stage knowledge graph is used to display all alarm devices and the preset fundamental alarm information of each alarm device. Each topology node in the cross-stage knowledge graph corresponds to one alarm device. If any alarm message to be detected in the set of alarm messages to be detected matches the preset fundamental alarm message, the alarm message to be detected will be determined as the fundamental alarm message. The fundamental alarm information and the fundamental alarm device are identified as network fault location information, and the network fault location information is pushed to the user terminal. The cross-stage knowledge graph is constructed in the following way: Multiple initial stage knowledge graphs are constructed based on the device logical relationships of different stages of business processing. The device logical relationships of each stage are used to indicate the connection relationships between alarm devices belonging to the corresponding stage. Each initial knowledge graph corresponds to a stage of business processing. The multiple initial stage knowledge graphs are associated to obtain an initial cross-stage knowledge graph. The preset fundamental alarm information of each alarm device is mapped to the initial cross-stage knowledge graph to obtain the cross-stage knowledge graph. The step of associating the multiple initial stage knowledge graphs to obtain an initial cross-stage knowledge graph includes: The initial cross-stage knowledge graph is obtained by associating multiple initial stage knowledge graphs based on boundary resource information, wherein the boundary resource information is used to indicate resource information shared by two adjacent stages of business processing. When any alarm message in the set of alarm messages to be detected does not match the preset fundamental alarm message, the method further includes: If it is determined that the mismatch is caused by the error of the preset fundamental alarm information, the number of matches of the target knowledge graph entry in the cross-stage knowledge graph is increased by 1. The initial value of the number of matches is 0. The target knowledge graph entry is the connection path in the cross-stage knowledge graph from the topology node corresponding to the alarm device that generated the alarm information to the topology node corresponding to the fundamental alarm device. If the number of matches exceeds a preset matching threshold, the target knowledge graph entry will be deleted from the cross-stage knowledge graph. If any one of the alarm messages to be detected in the set of alarm messages to be detected does not match the preset fundamental alarm message, the method further includes: If it is determined that the mismatch is caused by the lack of the preset fundamental alarm information in the set of alarm information to be detected, the alarm rule that generates the set of alarm information to be detected is modified, and the cross-stage knowledge graph is updated based on the modified alarm rule. If it is determined that the stage to which the fundamental alarm device belongs is different from the stage to which the initial alarm device belongs, the method further includes: Update the first boundary resource information between the stages corresponding to the fundamental alarm device and the initial alarm device; Obtain a sub-initial alarm message of the same type as the initial alarm message; In the case where the initial alarm information is associated with an alarm that is updated first boundary resource information, the updated first boundary resource information is determined as the new first boundary resource information.

2. The method according to claim 1, characterized in that, The fault location model is obtained in the following way: Obtain labeled historical alarm data, wherein the labeled historical alarm data includes labeled data and the historical alarm data, wherein the labeled data is the first fundamental alarm device and the first preset fundamental alarm information that are correctly labeled corresponding to the historical alarm data; The initial fault location model is trained based on the labeled historical alarm data. After each training session, the training accuracy of the initial fault location model is calculated. Training is stopped when the training accuracy exceeds a preset accuracy threshold, thus obtaining the fault location model. The training accuracy is determined based on the functional relationship between the number of correctly located faults and the total number of labeled historical alarm data. The number of correctly located faults is the number of times the predicted data successfully matches the labeled historical alarm data. The predicted data consists of the second fundamental alarm device and the second preset fundamental alarm information obtained by the initial fault location model from the historical alarm data.

3. A network fault location device, characterized in that, include: The acquisition module is used to acquire the initial alarm information generated by the initial alarm device for network faults; The first determining module is used to determine the fundamental alarm device associated with the initial alarm device and the preset fundamental alarm information based on a cross-stage knowledge graph using a fault location model. The cross-stage knowledge graph displays all alarm devices and the preset fundamental alarm information for each alarm device. Each topology node in the cross-stage knowledge graph corresponds to one alarm device. The cross-stage knowledge graph is constructed as follows: multiple initial stage knowledge graphs are constructed based on the device logical relationships of different stages of business processing. The device logical relationships of each stage indicate the connection relationships between alarm devices belonging to the corresponding stage. Each initial knowledge graph corresponds to a stage of business processing; the multiple initial stage knowledge graphs are associated to obtain an initial cross-stage knowledge graph; the preset fundamental alarm information of each alarm device is mapped to the initial cross-stage knowledge graph to obtain the cross-stage knowledge graph; the step of associating the multiple initial stage knowledge graphs to obtain the initial cross-stage knowledge graph includes: associating the multiple initial stage knowledge graphs based on boundary resource information to obtain the initial cross-stage knowledge graph, wherein the boundary resource information is used to indicate resource information shared by two adjacent stages of business processing; The second determining module is used to determine the alarm information to be detected as the fundamental alarm information when any alarm information to be detected in the set of alarm information to be detected matches the preset fundamental alarm information; and when no alarm information to be detected in the set of alarm information to be detected matches the preset fundamental alarm information, the module further includes: if it is determined that the mismatch is due to an error in the preset fundamental alarm information, increasing the cumulative matching count of the target knowledge graph entry in the cross-stage knowledge graph by 1, wherein the initial value of the matching count is 0, and the target knowledge graph entry is the connection path in the cross-stage knowledge graph from the topology node corresponding to the alarm device that generated the alarm information to the topology node corresponding to the fundamental alarm device; and deleting the target knowledge graph from the cross-stage knowledge graph when the matching count exceeds a preset matching threshold. The method further includes: if any alarm message to be detected in the set of alarm messages to be detected does not match the preset fundamental alarm message, then if it is determined that the mismatch is caused by the lack of the preset fundamental alarm message in the set of alarm messages to be detected, modify the alarm rule that generates the set of alarm messages to be detected, and update the cross-stage knowledge graph based on the modified alarm rule; if it is determined that the stage to which the fundamental alarm device belongs is different from the stage to which the initial alarm device belongs, then the method further includes: updating the first boundary resource information between the stages corresponding to the fundamental alarm device and the initial alarm device; obtaining a sub-initial alarm message of the same type as the initial alarm message; and if the sub-initial alarm message is associated with an alarm of the updated first boundary resource information, determining the updated first boundary resource information as the new first boundary resource information. The third determination module is used to determine the fundamental alarm information and the fundamental alarm device as network fault location information, and push the network fault location information to the user terminal.

4. A non-volatile storage medium, characterized in that, The non-volatile storage medium stores a program, wherein when the program is executed, it controls the device containing the non-volatile storage medium to execute the network fault location method according to any one of claims 1 to 2.

5. An electronic device, characterized in that, include: A memory and a processor, the processor being configured to run a program stored in the memory, wherein the program, when running, executes the network fault location method according to any one of claims 1 to 2.

6. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the network fault location method according to any one of claims 1 to 2.

Images