Method and system for analyzing resource dependency relationship based on alarm data

Abstract

The embodiment of the invention provides a method and system for analyzing a resource dependency relationship based on alarm data, and the method comprises the steps: firstly obtaining full-amount equipment alarm data containing multi-dimensional information from multiple sources, and providing comprehensive original data support for analysis; and the input and analyzed alarm data are ensured to be accurate and reliable through preprocessing operation. And mining a time sequence causal relationship under multiple time windows by using a PrefixSpan algorithm, and generating a primary and secondary alarm relationship table containing causal intensity and average delay. And finally, constructing an actual resource map based on a resource entity and the credible primary and secondary alarm relation table, training a GAT model by using historical alarm data and the map, so that the model can capture a complex dependency mode, constructing a sub-graph in combination with real-time data, inputting the trained model, dynamically generating a resource dependency relation graph, and ensuring that an analysis result adapts to real-time change. Through the organic combination of the links, the defects of the traditional artificial experience in the aspect of dynamic adaptation are effectively overcome, so that the reliability of a resource dependency relationship analysis result is remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and system for analyzing resource dependencies based on alarm data. Background Art

[0002] With the explosive growth of communication networks and the popularization of cloud computing and microservice architectures, the dependencies between resources have become highly dynamic and cross-disciplinary. Efficiently analyzing resource dependencies has become a core challenge for fault location and system optimization.

[0003] Currently, traditional resource dependency analysis mainly involves collecting full data and then relying on operations and maintenance personnel to manually sort out resource dependencies.

[0004] However, traditional analysis methods rely on manual experience and are difficult to adapt to the dynamic topological changes of resources in cloud architecture, resulting in low reliability of resource dependency analysis results. Summary of the Invention

[0005] The embodiments of the present invention provide a method and system for analyzing resource dependencies based on alarm data, which can improve the reliability of resource dependency analysis results.

[0006] In a first aspect, an embodiment of the present invention provides a method for analyzing resource dependencies based on alarm data, the method comprising:

[0007] A1: Obtain all device alarm data from the network management system and operation and maintenance platform to construct an original data set. The full device alarm data includes alarm title, alarm occurrence time, resource ID, device type, fault event, and manufacturer information.

[0008] A2: performing preprocessing operations on the data in the original data set to generate a target data set, wherein the preprocessing operations include: denoising, repeated aggregation, normalization mapping, topological aggregation, and alarm fault grouping, and the target data set is a set of items with the same event;

[0009] A3: Use the PrefixSpan algorithm to perform multi-window timing analysis and causal strength calculation operations on the same event item set to generate a primary and secondary alarm relationship table including primary alarm type, secondary alarm type, causal strength and average delay;

[0010] A4: Based on the resource entities and the primary and secondary alarm relationship table, an actual resource graph is constructed, and the historical alarm data and the actual resource graph are input into a graph attention network model (GAT) to generate a trained GAT model. The nodes of the actual resource graph are resource entities, and the initial edges are directed edges generated based on the primary and secondary alarm relationship table.

[0011] A5: A real-time alarm subgraph is constructed based on the real-time alarm data and the real-time resource data, and the subgraph is input into the trained GAT model to generate a resource dependency graph to analyze resource dependencies.

[0012] Preferably,

[0013] Said A2 includes:

[0014] For all the alarm data of the device in the original data set, delete the instantaneous alarms whose alarm occurrence time is less than a preset alarm occurrence time threshold to generate a first target data set;

[0015] Based on the sliding time window and the first target data set, the alarm data with the same resource ID are aggregated and merged to generate a second target data set;

[0016] Based on the second target data set, performing a standardization operation on the alarm codes included in the manufacturer information to generate a third target data set;

[0017] filtering the alarm data in the same topology area in the third target data set based on the network topology structure to generate a fourth target data set;

[0018] Clustering is performed on the data in the fourth target data set to generate at least one same-event item set, wherein each of the same-event item sets is used to represent alarm data of the same type of faults.

[0019] Preferably,

[0020] The A3 includes:

[0021] For the current same-event item set, at least three time windows are set, and the current same-event item set is divided into discrete time series subsequences according to the time windows, wherein each subsequence contains the alarm data recorded in each time window;

[0022] The PrefixSpan algorithm is used to obtain frequent 2-item sets in the subsequences of each time window and generate candidate causal pairs;

[0023] Take the intersection of the support of the same candidate causal pair in different time windows, and take the minimum support as the final support;

[0024] The candidate causal pairs are screened based on the final support and a preset support threshold, and the primary and secondary alarm relationship table including the primary alarm type, secondary alarm type, causal strength and average delay is generated.

[0025] Preferably,

[0026] The A4 includes:

[0027] Based on the primary and secondary alarm relationship table, construct alarm association rule pairs and encode them into numerical indexes to generate a rule code set;

[0028] Based on a preset causal strength threshold, determining whether the current causal strength included in the primary and secondary alarm relationships is greater than the preset causal strength threshold;

[0029] When the current causal strength is greater than the preset causal strength threshold, the resource entity is used as a node, and directed edges are established between corresponding resource nodes to construct an actual resource graph, wherein the node features include: historical alarm data statistics and corresponding rule codes, and the edge features include: causal strength, average delay, and co-occurrence frequency;

[0030] The historical alarm data and the actual resource map are input into the graph attention network model GAT, and the multi-head attention mechanism is used to learn the features of the actual resource map to generate a trained GAT model.

[0031] In a second aspect, an embodiment of the present invention provides a system for analyzing resource dependencies based on alarm data, the system comprising:

[0032] Acquisition module: used to acquire full device alarm data from the network management system and operation and maintenance platform to construct the original data set, where the full device alarm data includes alarm title, alarm occurrence time, resource ID, device type, fault event and manufacturer information;

[0033] Preprocessing module: performs preprocessing operations on the data in the original data set acquired by the acquisition module to generate a target data set, wherein the preprocessing operations include: denoising, repeated aggregation, normalized mapping, topological aggregation and alarm fault grouping, and the target data set is a set of items with the same event;

[0034] Primary and secondary alarm generation module: used to perform multi-window timing analysis and causal strength calculation operations on the same event item set generated by the preprocessing module using the PrefixSpan algorithm, and generate a primary and secondary alarm relationship table including primary alarm type, secondary alarm type, causal strength and average delay;

[0035] Training module: used to construct an actual resource graph based on resource entities and the primary and secondary alarm relationship table generated by the primary and secondary alarm generation module, and input historical alarm data and the actual resource graph into the graph attention network model GAT to generate a trained GAT model, wherein the nodes of the actual resource graph are resource entities and the initial edges are directed edges generated based on the primary and secondary alarm relationship table;

[0036] Relationship generation module: constructs a real-time alarm subgraph based on real-time alarm data and real-time resource data, and inputs the trained GAT model of the training module to generate a resource dependency graph to analyze resource dependency relationships.

[0037] Preferably,

[0038] The preprocessing module is further configured to execute:

[0039] For all the device alarm data in the original data set, delete the instantaneous alarms whose alarm occurrence time is less than a preset alarm occurrence time threshold to generate a first target data set;

[0040] Based on the sliding time window and the first target data set, the alarm data with the same resource ID are aggregated and merged to generate a second target data set;

[0041] Based on the second target data set, performing a standardization operation on the alarm codes included in the manufacturer information to generate a third target data set;

[0042] filtering the alarm data in the same topology area in the third target data set based on the network topology structure to generate a fourth target data set;

[0043] Clustering is performed on the data in the fourth target data set to generate at least one same-event item set, wherein each of the same-event item sets is used to represent alarm data of the same type of faults.

[0044] Preferably,

[0045] The primary and secondary alarm generation module is further configured to execute:

[0046] For the current same-event item set, at least three time windows are set, and the current same-event item set is divided into discrete time series subsequences according to the time windows, wherein each subsequence contains the alarm data recorded in each time window;

[0047] The PrefixSpan algorithm is used to obtain frequent 2-item sets in the subsequences of each time window and generate candidate causal pairs;

[0048] Take the intersection of the support of the same candidate causal pair in different time windows, and take the minimum support as the final support;

[0049] The candidate causal pairs are screened based on the final support and a preset support threshold, and the primary and secondary alarm relationship table including the primary alarm type, secondary alarm type, causal strength and average delay is generated.

[0050] Preferably,

[0051] The training module is further configured to execute:

[0052] Based on the primary and secondary alarm relationship table, construct alarm association rule pairs and encode them into numerical indexes to generate a rule code set;

[0053] Based on a preset causal strength threshold, determining whether the current causal strength included in the primary and secondary alarm relationships is greater than the preset causal strength threshold;

[0054] When the current causal strength is greater than the preset causal strength threshold, the resource entity is used as a node, and directed edges are established between corresponding resource nodes to construct an actual resource graph, wherein the node features include: historical alarm data statistics and corresponding rule codes, and the edge features include: causal strength, average delay, and co-occurrence frequency;

[0055] The historical alarm data and the actual resource map are input into a graph attention network model GAT, and the multi-head attention mechanism is used to learn the features of the actual resource map to generate a trained GAT model. In a third aspect, an embodiment of the present invention provides a system for analyzing resource dependencies based on alarm data, comprising: at least one memory and at least one processor;

[0056] The at least one memory is configured to store a machine-readable program;

[0057] The at least one processor is configured to call the machine-readable program to execute any one of the methods described in the first aspect.

[0058] In a fourth aspect, an embodiment of the present invention provides a computer-readable medium having computer instructions stored thereon. When the computer instructions are executed by a processor, the processor is caused to execute any of the methods described in the first aspect.

[0059] Embodiments of the present invention provide a method and system for analyzing resource dependencies based on alarm data. This method first acquires full device alarm data containing multidimensional information from multiple sources, providing comprehensive raw data support for analysis. Preprocessing operations eliminate instantaneous alarm noise, repeated aggregation reduces redundancy, standardized mapping eliminates vendor differences, topological aggregation limits spatial correlations, and fault grouping focuses on similar events. This layer-by-layer data purification ensures the accuracy and reliability of the alarm data input for analysis. The PrefixSpan algorithm then mines temporal causal relationships under multiple time windows, generating a primary and secondary alarm relationship table containing causal strength and average latency, achieving a reliable conversion from data to causal relationships. Finally, an actual resource graph is constructed based on resource entities and a trusted primary and secondary alarm relationship table. A GAT model is trained using historical alarm data and the graph, enabling the model to capture complex dependency patterns. A subgraph is constructed in conjunction with real-time data and fed into the trained model to dynamically generate a resource dependency graph, ensuring that the analysis results adapt to real-time changes. This organic combination of these steps effectively overcomes the shortcomings of traditional manual experience in dynamic adaptation, significantly improving the reliability of resource dependency analysis results. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0061] Figure 1 This is a flow chart of a method for analyzing resource dependencies based on alarm data provided by one embodiment of the present invention;

[0062] Figure 2 This is a flowchart of another method for analyzing resource dependencies based on alarm data provided by one embodiment of the present invention;

[0063] Figure 3 This is a schematic diagram of a system for analyzing resource dependencies based on alarm data provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0064] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0065] like Figure 1 As shown, an embodiment of the present invention provides a method for analyzing resource dependencies based on alarm data, which may include the following steps:

[0066] Step 101: Obtain all device alarm data from the network management system and operation and maintenance platform to construct an original data set. The full device alarm data includes alarm title, alarm occurrence time, resource ID, device type, fault event, and manufacturer information.

[0067] Step 102: Perform preprocessing operations on the data in the original dataset to generate a target dataset, wherein the preprocessing operations include: denoising, repeated aggregation, normalization mapping, topological aggregation, and alarm fault grouping. The target dataset is a set of items with the same event.

[0068] Step 103: Use the PrefixSpan algorithm to perform multi-window timing analysis and causal strength calculation operations on the same event item set to generate a primary and secondary alarm relationship table including primary alarm type, secondary alarm type, causal strength and average delay;

[0069] Step 104: Based on the resource entities and the primary and secondary alarm relationship table, an actual resource graph is constructed, and the historical alarm data and the actual resource graph are input into the graph attention network model GAT to generate a trained GAT model, where the nodes of the actual resource graph are resource entities and the initial edges are directed edges generated based on the primary and secondary alarm relationship table;

[0070] A5: Build a real-time alarm subgraph based on real-time alarm data and real-time resource data, and input it into the trained GAT model to generate a resource dependency graph to analyze resource dependencies.

[0071] In an embodiment of the present invention, a method for analyzing resource dependencies based on alarm data is provided. First, full device alarm data containing multidimensional information is acquired from multiple sources to provide comprehensive raw data support for analysis. Preprocessing operations eliminate instantaneous alarm noise, repeated aggregation reduces redundancy, standardized mapping eliminates vendor differences, topological aggregation limits spatial correlations, and fault grouping focuses on similar events. Data is purified layer by layer to ensure the accuracy and reliability of the alarm data input for analysis. The PrefixSpan algorithm is then used to mine temporal causal relationships under multiple time windows, generating a primary and secondary alarm relationship table containing causal strength and average latency, achieving a reliable conversion from data to causal relationships. Finally, an actual resource graph is constructed based on resource entities and the trusted primary and secondary alarm relationship table. A GAT model is trained using historical alarm data and the graph, enabling the model to capture complex dependency patterns. Subgraphs are constructed in conjunction with real-time data and fed into the trained model to dynamically generate a resource dependency graph, ensuring that the analysis results adapt to real-time changes. This organic combination of these steps effectively overcomes the shortcomings of traditional manual experience in dynamic adaptation, significantly improving the reliability of resource dependency analysis results.

[0072] To improve data reliability and analysis efficiency, in one embodiment of the present invention, step 102 in the above embodiment may specifically include the following steps:

[0073] For all the device alarm data in the original data set, delete the instantaneous alarms whose alarm occurrence time is less than a preset alarm occurrence time threshold to generate a first target data set;

[0074] Based on the sliding time window and the first target data set, the alarm data with the same resource ID are aggregated and merged to generate a second target data set;

[0075] Based on the second target data set, performing a standardization operation on the alarm codes included in the manufacturer information to generate a third target data set;

[0076] filtering the alarm data in the same topology area in the third target data set based on the network topology structure to generate a fourth target data set;

[0077] Clustering is performed on the data in the fourth target data set to generate at least one same-event item set, wherein each of the same-event item sets is used to represent alarm data of the same type of faults.

[0078] In an embodiment of the present invention, multi-level preprocessing is performed on all the device alarm data in the original data set to improve data quality and lay the foundation for subsequent analysis. First, by deleting instantaneous alarms whose alarm occurrence time is less than a preset threshold (for example, 5 seconds), noise interference is eliminated to generate a first target data set, eliminating the impact of instantaneous jitter on the analysis; then, based on a sliding time window, the alarm data with the same resource ID in the first target data set are aggregated and merged to generate a second target data set, reducing duplicate alarm redundancy and highlighting key alarm features; then, the manufacturer alarm coding standardization operation is performed on the second target data set, and the heterogeneous coding of different manufacturers is unified to generate a third target data set, eliminating the analysis barriers caused by manufacturer differences; then, based on the network topology structure, the alarm data in the same topological area in the third target data set is filtered to generate a fourth target data set, limiting the spatial correlation range to focus on valid data. Finally, the fourth target data set is clustered, and similar fault alarm data are aggregated into the same event item set, so that subsequent temporal causal analysis can be carried out on similar events, ensuring the accuracy and relevance of the analysis results. Through this series of preprocessing operations, the original alarm data is effectively purified, the reliability of the data and the analysis efficiency are improved, and a high-quality data foundation is provided for subsequent dependency analysis based on the PrefixSpan algorithm and graph neural network.

[0079] In order to provide reliable causal relationship input for subsequent graph neural network modeling, in one embodiment of the present invention, step 103 in the above embodiment may specifically include the following steps:

[0080] For the current same-event item set, at least three time windows are set, and the current same-event item set is divided into discrete time series subsequences according to the time windows, wherein each subsequence contains the alarm data recorded in each time window;

[0081] The PrefixSpan algorithm is used to obtain frequent 2-item sets in the subsequences of each time window and generate candidate causal pairs;

[0082] Take the intersection of the support of the same candidate causal pair in different time windows, and take the minimum support as the final support;

[0083] The candidate causal pairs are screened based on the final support and a preset support threshold, and the primary and secondary alarm relationship table including the primary alarm type, secondary alarm type, causal strength and average delay is generated.

[0084] In an embodiment of the present invention, accurate mining of causal relationships in alarm data is achieved through multi-dimensional time series analysis and causal strength calculation. First, at least three time windows (such as 30 seconds, 1 minute, and 2 minutes) are set for the current same event item set, and they are divided into discrete time series subsequences to ensure that each subsequence focuses on similar fault alarm data within a specific time range and eliminates cross-window interference. Then, the PrefixSpan algorithm is used to mine frequent 2-item sets in each subsequence to generate candidate causal pairs of "primary alarm → secondary alarm". The algorithm recursively searches the prefix projection database to capture causal patterns that frequently appear in the time series. Then, the support of the same candidate causal pair in different time windows is intersected, and the minimum support is used as the final support. The credibility of the causal pair is improved through cross-validation of multi-window results. Finally, based on the final support and a preset threshold (such as support ≥ 0.7), strongly correlated causal pairs are screened to generate a primary and secondary alarm relationship table containing the primary alarm type, secondary alarm type, causal strength, and average delay. The above process effectively filters out noise and weak correlations through a combination of multi-window analysis, support aggregation, and threshold screening, ensuring that the generated causal relationship table accurately reflects the temporal causal dependencies between alarms, and provides reliable causal relationship input for subsequent graph neural network modeling.

[0085] To further improve the reliability of the resource dependency analysis results, in one embodiment of the present invention, step 104 in the above embodiment may specifically include the following steps:

[0086] Based on the primary and secondary alarm relationship table, construct alarm association rule pairs and encode them into numerical indexes to generate a rule code set;

[0087] Based on a preset causal strength threshold, determining whether the current causal strength included in the primary and secondary alarm relationships is greater than the preset causal strength threshold;

[0088] When the current causal strength is greater than the preset causal strength threshold, the resource entity is used as a node, and directed edges are established between corresponding resource nodes to construct an actual resource graph, wherein the node features include: historical alarm data statistics and corresponding rule codes, and the edge features include: causal strength, average delay, and co-occurrence frequency;

[0089] The historical alarm data and the actual resource map are input into the graph attention network model GAT, and the multi-head attention mechanism is used to learn the features of the actual resource map to generate a trained GAT model.

[0090] In an embodiment of the present invention, by constructing a resource map and graph neural network modeling, reasoning from alarm causal relationships to resource dependency relationships is achieved. First, based on the primary and secondary alarm relationship table, alarm association rule pairs are constructed and encoded as numerical indexes to form a rule encoding set, giving structured identification to the alarm causal relationship. Then, a strongly correlated causal pair is screened by a preset causal strength threshold. Only when the current causal strength is greater than the threshold, resource entities such as servers and switches are used as nodes, and directed edges containing causal strength, average delay and co-occurrence frequency are established between corresponding nodes to construct an actual resource map with temporal causal characteristics. Finally, the historical alarm data and the resource map are input into the graph attention network model GAT, and the multi-head attention mechanism is used to learn the historical alarm statistics, rule encoding and edge dependency features of the nodes in the map to generate a GAT model that can capture cross-professional resource dependencies. The above process converts alarm causal relationships into graph structure features, combines deep learning to automatically extract complex dependency patterns, breaks through the limitations of traditional manual combing and static modeling, and provides an efficient and reliable solution for resource dependency analysis in dynamic network environments.

[0091] like Figure 2 To more clearly illustrate the technical solutions and advantages of the present invention, a method for analyzing resource dependencies based on alarm data is described in detail below. The method may include the following steps:

[0092] Step 201: Obtain all device alarm data from the network management system and operation and maintenance platform to construct an original data set. The full device alarm data includes alarm title, alarm occurrence time, resource ID, device type, fault event, and manufacturer information.

[0093] Step 202: For all device alarm data in the original data set, delete instantaneous alarms whose alarm occurrence time is less than a preset alarm occurrence time threshold to generate a first target data set;

[0094] Step 203: Based on the sliding time window and the first target data set, the alarm data with the same resource ID are aggregated and merged to generate a second target data set;

[0095] Step 204: Based on the second target data set, perform a standardization operation on the alarm codes included in the manufacturer information to generate a third target data set;

[0096] Step 205: Filter the alarm data in the same topology area in the third target data set based on the network topology structure to generate a fourth target data set;

[0097] Step 206: clustering the data in the fourth target data set to generate at least one same-event item set, wherein each same-event item set is used to represent alarm data of the same type of fault;

[0098] Step 207: For the current same-event item set, set at least three time windows, and divide the current same-event item set into discrete time series subsequences according to the time windows, wherein each subsequence contains the alarm data recorded in each time window;

[0099] Step 208: Use the PrefixSpan algorithm to obtain frequent two-item sets in the subsequences of each time window and generate candidate causal pairs;

[0100] Step 209: Take the intersection of the support of the same candidate causal pair in different time windows, and take the minimum support as the final support;

[0101] Step 210: Screen candidate causal pairs based on the final support and a preset support threshold, and generate a primary and secondary alarm relationship table including primary alarm type, secondary alarm type, causal strength, and average delay;

[0102] Step 211: Based on the primary and secondary alarm relationship table, construct alarm association rule pairs and encode them into numerical indexes to generate a rule code set;

[0103] Step 212: Based on a preset causal strength threshold, determine whether the current causal strength included in the primary and secondary alarm relationships is greater than the preset causal strength threshold;

[0104] Step 213: When the current causal strength is greater than the preset causal strength threshold, a directed edge is established between corresponding resource nodes with the resource entity as the node to construct an actual resource graph, wherein the node features include: historical alarm data statistics and corresponding rule encoding, and the edge features include: causal strength, average delay, and co-occurrence frequency;

[0105] Step 214: Input the historical alarm data and the actual resource map into the graph attention network model GAT, use the multi-head attention mechanism to learn the features of the actual resource map, and generate a trained GAT model;

[0106] Step 215: Construct a real-time alarm subgraph based on the real-time alarm data and the real-time resource data, and input the trained GAT model to generate a resource dependency graph to analyze resource dependencies.

[0107] like Figure 3 As shown, an embodiment of the present invention provides a system for analyzing resource dependencies based on alarm data, the system comprising:

[0108] Acquisition module 301: used to acquire full device alarm data from the network management system and operation and maintenance platform to construct an original data set, wherein the full device alarm data includes alarm title, alarm occurrence time, resource ID, device type, fault event, and manufacturer information;

[0109] Preprocessing module 302: performs preprocessing operations on the data in the original data set acquired by the acquisition module 301 to generate a target data set, wherein the preprocessing operations include: denoising, repeated aggregation, normalization mapping, topological aggregation and alarm fault grouping, and the target data set is a set of items with the same event;

[0110] The primary and secondary alarm generation module 303 is configured to perform multi-window timing analysis and causal strength calculation operations on the same event item set generated by the preprocessing module 302 using the PrefixSpan algorithm to generate a primary and secondary alarm relationship table including primary alarm type, secondary alarm type, causal strength, and average delay;

[0111] Training module 304: used to construct an actual resource graph based on resource entities and the primary and secondary alarm relationship table generated by the primary and secondary alarm generation module 303, and input historical alarm data and the actual resource graph into a graph attention network model GAT to generate a trained GAT model, wherein the nodes of the actual resource graph are resource entities and the initial edges are directed edges generated based on the primary and secondary alarm relationship table;

[0112] Relationship generation module 305: constructs a real-time alarm subgraph based on the real-time alarm data and the real-time resource data, and inputs the trained GAT model of the training module 304 to generate a resource dependency graph to analyze resource dependency relationships.

[0113] like Figure 3 As shown, the pre-processing module 302 is further configured to execute:

[0114] For all the device alarm data in the original data set, delete the instantaneous alarms whose alarm occurrence time is less than a preset alarm occurrence time threshold to generate a first target data set;

[0115] Based on the sliding time window and the first target data set, the alarm data with the same resource ID are aggregated and merged to generate a second target data set;

[0116] Based on the second target data set, performing a standardization operation on the alarm codes included in the manufacturer information to generate a third target data set;

[0117] filtering the alarm data in the same topology area in the third target data set based on the network topology structure to generate a fourth target data set;

[0118] Clustering is performed on the data in the fourth target data set to generate at least one same-event item set, wherein each of the same-event item sets is used to represent alarm data of the same type of faults.

[0119] like Figure 3As shown, the primary and secondary alarm generation module 303 is further configured to execute:

[0120] For the current same-event item set, at least three time windows are set, and the current same-event item set is divided into discrete time series subsequences according to the time windows, wherein each subsequence contains the alarm data recorded in each time window;

[0121] The PrefixSpan algorithm is used to obtain frequent 2-item sets in the subsequences of each time window and generate candidate causal pairs;

[0122] Take the intersection of the support of the same candidate causal pair in different time windows, and take the minimum support as the final support;

[0123] The candidate causal pairs are screened based on the final support and a preset support threshold, and the primary and secondary alarm relationship table including the primary alarm type, secondary alarm type, causal strength and average delay is generated.

[0124] like Figure 3 As shown, the training module 304 is used to perform:

[0125] Based on the primary and secondary alarm relationship table, construct alarm association rule pairs and encode them into numerical indexes to generate a rule code set;

[0126] Based on a preset causal strength threshold, determining whether the current causal strength included in the primary and secondary alarm relationships is greater than the preset causal strength threshold;

[0127] When the current causal strength is greater than the preset causal strength threshold, the resource entity is used as a node, and directed edges are established between corresponding resource nodes to construct an actual resource graph, wherein the node features include: historical alarm data statistics and corresponding rule codes, and the edge features include: causal strength, average delay, and co-occurrence frequency;

[0128] The historical alarm data and the actual resource map are input into the graph attention network model GAT, and the multi-head attention mechanism is used to learn the features of the actual resource map to generate a trained GAT model.

[0129] It should be understood that the structure illustrated in the embodiments of the present invention does not constitute a specific limitation on a system for analyzing resource dependencies based on alarm data. In other embodiments of the present invention, a system for analyzing resource dependencies based on alarm data may include more or fewer components than illustrated, or may combine or separate certain components, or arrange the components differently. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0130] The information interaction, execution process, etc. between the units in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention. For specific contents, please refer to the description in the embodiment of the method of the present invention and will not be repeated here.

[0131] An embodiment of the present invention further provides a system for analyzing resource dependencies based on alarm data, comprising: at least one memory and at least one processor;

[0132] at least one memory for storing a machine-readable program;

[0133] At least one processor is configured to call a machine-readable program to execute a method for analyzing resource dependencies based on alarm data in any embodiment of the present invention.

[0134] An embodiment of the present invention further provides a computer-readable medium having computer instructions stored thereon. When the computer instructions are executed by a processor, the processor executes a method for analyzing resource dependencies based on alarm data according to any embodiment of the present invention.

[0135] Specifically, a system or device equipped with a storage medium can be provided, on which software program codes that implement the functions of any of the above-mentioned embodiments are stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program codes stored in the storage medium.

[0136] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute part of the present invention.

[0137] Examples of storage media for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the program code can be downloaded from a server computer via a communication network.

[0138] In addition, it should be clear that the functions of any of the above embodiments can be achieved not only by executing the program code read by the computer, but also by enabling the operating system operating on the computer to complete part or all of the actual operations based on the instructions of the program code.

[0139] In addition, it can be understood that the program code read from the storage medium is written into the memory provided in the expansion board inserted into the computer or into the memory provided in the expansion unit connected to the computer, and then based on the instructions of the program code, the CPU installed on the expansion board or expansion unit is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above embodiments.

[0140] Each embodiment of the present invention has at least the following beneficial effects:

[0141] 1. In an embodiment of the present invention, a method for analyzing resource dependencies based on alarm data is provided. First, full device alarm data containing multi-dimensional information is obtained from multiple sources to provide comprehensive raw data support for analysis. Preprocessing operations are used to eliminate instantaneous alarm noise, repeated aggregation reduces redundancy, standardized mapping eliminates manufacturer differences, topological aggregation limits spatial associations, and fault grouping focuses on similar events. Data is purified layer by layer to ensure that the alarm data input for analysis is accurate and reliable. The PrefixSpan algorithm is then used to mine temporal causal relationships under multiple time windows to generate a primary and secondary alarm relationship table containing causal strength and average delay, thereby achieving a reliable conversion from data to causal relationships. Finally, an actual resource map is constructed based on resource entities and a credible primary and secondary alarm relationship table. The GAT model is trained with historical alarm data and the map so that the model can capture complex dependency patterns. A subgraph is constructed in combination with real-time data and input into the trained model to dynamically generate a resource dependency graph to ensure that the analysis results adapt to real-time changes. Through the organic combination of the above links, the shortcomings of traditional manual experience in dynamic adaptation are effectively overcome, thereby significantly improving the reliability of resource dependency analysis results.

[0142] 2. In an embodiment of the present invention, multi-level preprocessing is performed on all device alarm data in the original dataset to improve data quality and lay the foundation for subsequent analysis. First, by deleting instantaneous alarms whose alarm occurrence time is less than a preset threshold, noise interference is eliminated to generate a first target dataset, eliminating the impact of instantaneous jitter on analysis. Next, based on a sliding time window, the alarm data with the same resource ID in the first target dataset are aggregated and merged to generate a second target dataset, reducing duplicate alarm redundancy and highlighting key alarm features. Then, the manufacturer alarm coding standardization operation is performed on the second target dataset, and the heterogeneous coding of different manufacturers is unified to generate a third target dataset, eliminating the analysis barriers caused by manufacturer differences. Then, based on the network topology structure, the alarm data within the same topological area in the third target dataset is filtered to generate a fourth target dataset, limiting the spatial correlation range to focus on valid data. Finally, the fourth target dataset is clustered to aggregate similar fault alarm data into a set of items with the same event, so that subsequent temporal causal analysis can be carried out on similar events, ensuring the accuracy and relevance of the analysis results. This series of preprocessing operations effectively purifies the original alarm data, improves data reliability and analysis efficiency, and provides a high-quality data foundation for subsequent dependency analysis based on the PrefixSpan algorithm and graph neural network.

[0143] 3. In an embodiment of the present invention, accurate mining of causal relationships in alarm data is achieved through multi-dimensional time series analysis and causal strength calculation. First, at least three time windows are set for the current same event item set, which are divided into discrete time series subsequences to ensure that each subsequence focuses on similar fault alarm data within a specific time range and eliminates cross-window interference. Then, the PrefixSpan algorithm is used to mine frequent 2-item sets in each subsequence to generate candidate causal pairs of "primary alarm → secondary alarm". The algorithm recursively searches the prefix projection database to capture causal patterns that frequently appear in time series. Then, the intersection of the support of the same candidate causal pair in different time windows is taken, and the minimum support is used as the final support. The credibility of the causal pair is improved through cross-validation of multi-window results. Finally, based on the final support and a preset threshold (for example, support ≥ 0.7), strongly correlated causal pairs are screened to generate a primary and secondary alarm relationship table containing the primary alarm type, secondary alarm type, causal strength and average delay. The above process effectively filters out noise and weak correlations through a combination of multi-window analysis, support aggregation, and threshold screening, ensuring that the generated causal relationship table accurately reflects the temporal causal dependencies between alarms, and provides reliable causal relationship input for subsequent graph neural network modeling.

[0144] It should be noted that not all steps and modules in the above processes and system structure diagrams are required, and certain steps or modules can be omitted according to actual needs. The execution order of each step is not fixed and can be adjusted as needed. The system structure described in the above embodiments can be a physical structure or a logical structure, that is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or may be implemented by certain components in multiple independent devices.

[0145] In the above embodiments, the hardware unit can be realized by mechanical means or electrical means. For example, a hardware unit can include permanent dedicated circuits or logic (such as special processors, FPGA or ASIC) to complete the corresponding operations. The hardware unit can also include programmable logic or circuits (such as general-purpose processors or other programmable processors), which can be temporarily set up by software to complete the corresponding operations. Concrete implementation (mechanical means or dedicated permanent circuits or temporarily set circuits) can be determined based on the consideration on cost and time.

[0146] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for analyzing resource dependencies based on alarm data, characterized in that: The method includes: A1: Obtain all device alarm data from the network management system and operation and maintenance platform to construct an original data set. The full device alarm data includes alarm title, alarm occurrence time, resource ID, device type, fault event, and manufacturer information. A2: performing preprocessing operations on the data in the original data set to generate a target data set, wherein the preprocessing operations include: denoising, repeated aggregation, normalization mapping, topological aggregation, and alarm fault grouping, and the target data set is a set of items with the same event; A3: Use the PrefixSpan algorithm to perform multi-window timing analysis and causal strength calculation operations on the same event item set to generate a primary and secondary alarm relationship table including primary alarm type, secondary alarm type, causal strength and average delay; A4: Based on the resource entities and the primary and secondary alarm relationship table, an actual resource graph is constructed, and the historical alarm data and the actual resource graph are input into a graph attention network model (GAT) to generate a trained GAT model. The nodes of the actual resource graph are resource entities, and the initial edges are directed edges generated based on the primary and secondary alarm relationship table. A5: A real-time alarm subgraph is constructed based on the real-time alarm data and the real-time resource data, and the subgraph is input into the trained GAT model to generate a resource dependency graph to analyze resource dependencies.

2. The method according to claim 1, characterized in that Said A2 includes: For all the device alarm data in the original data set, delete the instantaneous alarms whose alarm occurrence time is less than a preset alarm occurrence time threshold to generate a first target data set; Based on the sliding time window and the first target data set, the alarm data with the same resource ID are aggregated and merged to generate a second target data set; Based on the second target data set, performing a standardization operation on the alarm codes included in the manufacturer information to generate a third target data set; filtering the alarm data in the same topology area in the third target data set based on the network topology structure to generate a fourth target data set; Clustering is performed on the data in the fourth target data set to generate at least one same-event item set, wherein each of the same-event item sets is used to represent alarm data of the same type of faults.

3. The method according to claim 2, characterized in that The A3 includes: For the current same-event item set, at least three time windows are set, and the current same-event item set is divided into discrete time series subsequences according to the time windows, wherein each subsequence contains the alarm data recorded in each time window; The PrefixSpan algorithm is used to obtain frequent 2-item sets in the subsequences of each time window and generate candidate causal pairs; Take the intersection of the support of the same candidate causal pair in different time windows, and take the minimum support as the final support; The candidate causal pairs are screened based on the final support and a preset support threshold, and the primary and secondary alarm relationship table including the primary alarm type, secondary alarm type, causal strength and average delay is generated.

4. The method according to claims 1-3, characterized in that The A4 includes: Based on the primary and secondary alarm relationship table, construct alarm association rule pairs and encode them into numerical indexes to generate a rule code set; Based on a preset causal strength threshold, determining whether the current causal strength included in the primary and secondary alarm relationships is greater than the preset causal strength threshold; When the current causal strength is greater than the preset causal strength threshold, the resource entity is used as a node, and directed edges are established between corresponding resource nodes to construct an actual resource graph, wherein the node features include: historical alarm data statistics and corresponding rule codes, and the edge features include: causal strength, average delay, and co-occurrence frequency; The historical alarm data and the actual resource map are input into the graph attention network model GAT, and the multi-head attention mechanism is used to learn the features of the actual resource map to generate a trained GAT model.

5. A system for analyzing resource dependencies based on alarm data, characterized in that: The system includes: Acquisition module: used to acquire full device alarm data from the network management system and operation and maintenance platform to construct the original data set, where the full device alarm data includes alarm title, alarm occurrence time, resource ID, device type, fault event and manufacturer information; Preprocessing module: performs preprocessing operations on the data in the original data set acquired by the acquisition module to generate a target data set, wherein the preprocessing operations include: denoising, repeated aggregation, normalized mapping, topological aggregation and alarm fault grouping, and the target data set is a set of items with the same event; Primary and secondary alarm generation module: used to perform multi-window timing analysis and causal strength calculation operations on the same event item set generated by the preprocessing module using the PrefixSpan algorithm, and generate a primary and secondary alarm relationship table including primary alarm type, secondary alarm type, causal strength and average delay; training module: used to construct an actual resource map based on resource entities and the primary and secondary alarm relationship table generated by the primary and secondary alarm generation module, and input historical alarm data and the actual resource map into the graph attention network model GAT to generate a trained GAT model, wherein the nodes of the actual resource map are resource entities, and the initial edges are directed edges generated based on the primary and secondary alarm relationship table; Relationship generation module: constructs a real-time alarm subgraph based on real-time alarm data and real-time resource data, and inputs the trained GAT model of the training module to generate a resource dependency graph to analyze resource dependency relationships.

6. The system according to claim 5, characterized in that The preprocessing module is further configured to execute: For all the device alarm data in the original data set, delete the instantaneous alarms whose alarm occurrence time is less than a preset alarm occurrence time threshold to generate a first target data set; Based on the sliding time window and the first target data set, the alarm data with the same resource ID are aggregated and merged to generate a second target data set; Based on the second target data set, performing a standardization operation on the alarm codes included in the manufacturer information to generate a third target data set; filtering the alarm data in the same topology area in the third target data set based on the network topology structure to generate a fourth target data set; Clustering is performed on the data in the fourth target data set to generate at least one same-event item set, wherein each of the same-event item sets is used to represent alarm data of the same type of faults.

7. The system according to claim 6, characterized in that The primary and secondary alarm generation module is further configured to execute: For the current same-event item set, at least three time windows are set, and the current same-event item set is divided into discrete time series subsequences according to the time windows, wherein each subsequence contains the alarm data recorded in each time window; The PrefixSpan algorithm is used to obtain frequent 2-item sets in the subsequences of each time window and generate candidate causal pairs; Take the intersection of the support of the same candidate causal pair in different time windows, and take the minimum support as the final support; The candidate causal pairs are screened based on the final support and a preset support threshold, and the primary and secondary alarm relationship table including the primary alarm type, secondary alarm type, causal strength and average delay is generated.

8. The system according to claims 5-7, characterized in that The training module is further configured to execute: Based on the primary and secondary alarm relationship table, construct alarm association rule pairs and encode them into numerical indexes to generate a rule code set; Based on a preset causal strength threshold, determining whether the current causal strength included in the primary and secondary alarm relationships is greater than the preset causal strength threshold; When the current causal strength is greater than the preset causal strength threshold, the resource entity is used as a node, and directed edges are established between corresponding resource nodes to construct an actual resource graph, wherein the node features include: historical alarm data statistics and corresponding rule codes, and the edge features include: causal strength, average delay, and co-occurrence frequency; The historical alarm data and the actual resource map are input into the graph attention network model GAT, and the multi-head attention mechanism is used to learn the features of the actual resource map to generate a trained GAT model.

9. A system for analyzing resource dependencies based on alarm data, characterized in that: include: at least one memory and at least one processor; The at least one memory is configured to store a machine-readable program; The at least one processor is configured to call the machine-readable program to execute the method according to any one of claims 1 to 4.

10. A computer-readable medium, characterized in that The computer-readable medium stores computer instructions, which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 4.

Images