Method and device for positioning network fault and nonvolatile storage medium
By building an alarm tree and utilizing hierarchical and cross-layer associations, network faults can be located quickly and accurately, solving the problems of non-real-time and low accuracy in existing network fault location technologies and achieving efficient location of network faults.
Patent Information
- Application Number
- CN202510928742.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-04
- Publication Date
- 2025-09-23
AI Technical Summary
Existing technologies have difficulty achieving real-time positioning in network fault location and have low accuracy, especially in complex and changing network environments. Rule-based methods have low accuracy, machine learning algorithms have difficulty identifying new fault modes, and big data technology has time lags and cannot achieve real-time positioning.
By acquiring the basic data and networking structure of the network to be tested, an alarm tree is constructed. By utilizing the hierarchical and cross-layer association relationships of the alarm tree, the alarm concentration point is determined at each layer based on the alarm data, and the root cause of the fault that causes the alarm is identified.
It achieves fast and accurate network fault location, improves the accuracy and real-time performance of location, and solves the problem of difficulty in locating network faults in real time and low accuracy in existing technologies.
Smart Images
Figure CN120692141A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of network security technology, and in particular to a method and device for locating network faults, and a non-volatile storage medium. Background Art
[0002] In related technologies, when locating network faults, rule-based methods, machine learning algorithms or big data technologies are usually used to analyze network faults. Among them, when using rule-based methods to locate network faults, they rely on predefined rules and thresholds to identify faults. This method is difficult to adapt to complex and changeable network environments and has the problem of low accuracy. When using machine learning algorithms to locate network faults, models trained with historical data are used to identify fault modes, which makes it difficult to identify new fault modes that do not exist in historical data. When identifying new faults, there is a problem of low accuracy. When locating network faults based on big data technology, a large amount of network logs and alarm data need to be analyzed to identify fault modes. There is a time lag problem, and real-time location of network faults cannot be achieved.
[0003] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention
[0004] The embodiments of the present application provide a method and apparatus for locating a network fault, and a non-volatile storage medium, to at least solve the technical problems of network fault locating methods used in related technologies, such as difficulty in locating network faults in real time and low accuracy.
[0005] According to one aspect of an embodiment of the present application, a method for locating network faults is provided, comprising: obtaining basic data of a network to be tested and a networking structure of the network to be tested, wherein the network to be tested is a network that generates an alarm, and the basic data includes at least: network elements in the network to be tested, and the networking structure is used to define at least the network layer to which each network element belongs and the association relationship between multiple network elements; constructing an alarm tree based on the networking structure and the basic data, wherein each network element is a node of the alarm tree, and multiple network elements corresponding to multiple nodes at the same layer of the alarm tree belong to the same network layer; determining an alarm concentration point at each layer of the alarm tree based on the alarm data of the network to be tested within a detection period, wherein each alarm concentration point is used to indicate the network elements related to the alarm in the layer to which the alarm concentration point belongs; and determining the root cause of the fault that caused the alarm based on the multiple alarm concentration points.
[0006] Optionally, the association relationship is used to indicate the connection relationship between network elements belonging to adjacent levels; constructing an alarm tree based on the networking structure and basic data, including: determining the number of levels of the alarm tree based on the networking structure, and determining the nodes of each tree level in the alarm tree and the branches of the alarm tree based on the networking structure and basic data, where the tree level is the level in the alarm tree; constructing an alarm tree based on the number of levels of the alarm tree, the nodes of each tree level of the alarm tree and the branches of the alarm tree.
[0007] Optionally, determining the number of levels of the alarm tree according to the networking structure includes: determining the number of network levels of the network to be tested according to the networking structure; and determining the number of network levels as the number of levels of the alarm tree.
[0008] Optionally, the nodes of each tree level in the alarm tree are determined according to the network structure and basic data, including: classifying network elements belonging to the same network level into data sets according to the network structure to obtain multiple data sets; for each data set, determining a first correspondence between the data set and the network level; determining a second correspondence between the network level and the tree level of the alarm tree, and determining the nodes of each tree level in the alarm tree according to the first correspondence and the second correspondence.
[0009] Optionally, determining the branches of the alarm tree according to the networking structure and basic data includes: determining target nodes with an associated relationship in two adjacent tree levels according to the networking structure; and generating branches of the alarm tree according to multiple target nodes and straight lines connecting the multiple target nodes.
[0010] Optionally, before determining the alarm concentration point, the method includes: comparing the alarm data in the current detection cycle with the alarm data in the previous detection cycle to obtain a comparison result, wherein the comparison result is used to indicate whether there is incremental alarm data in the current detection cycle; when the comparison result indicates that there is incremental alarm data, determining an alarm concentration point at each layer of the alarm tree based on the alarm data of the network to be tested within the detection cycle; when the comparison result indicates that there is no incremental alarm data, refusing to determine the alarm concentration point.
[0011] Optionally, the alarm data includes: the number of alarms generated by each network element; determining an alarm concentration point at each tree level of the alarm tree based on the alarm data of the network to be tested within the detection period, including: for each tree level of the alarm tree, determining the target network element corresponding to the number of alarms with the largest value, and determining the node corresponding to the target network element as the alarm concentration point.
[0012] Optionally, the root cause of the fault that caused the alarm is determined based on multiple alarm concentration points, including: determining multiple tree levels corresponding to the multiple alarm concentration points, wherein the tree level is the level of the alarm tree; determining a target tree level in which the number of alarm concentration points included is 1 among the multiple tree levels; when there is 1 target tree level, determining the network element corresponding to the alarm concentration point in the target tree level as the root cause of the fault; when there are multiple target tree levels, determining the root cause of the fault based on the multiple alarm concentration points in the multiple target tree levels and the alarm time of each alarm concentration point, wherein the alarm time is recorded in the alarm data.
[0013] According to another aspect of an embodiment of the present application, a device for locating network faults is also provided, including: an acquisition module for acquiring basic data of the network to be tested and the networking structure of the network to be tested, wherein the network to be tested is a network that generates an alarm, and the basic data at least includes: network elements in the network to be tested, and the networking structure is at least used to define the network layer to which each network element belongs and the association relationship between multiple network elements; an alarm tree construction module for constructing an alarm tree according to the networking structure and the basic data, wherein each network element is a node of the alarm tree, and multiple network elements corresponding to multiple nodes at the same layer of the alarm tree belong to the same network layer; a first determination module for determining an alarm concentration point at each layer of the alarm tree according to the alarm data of the network to be tested within a detection period, wherein each alarm concentration point is used to indicate the network elements related to the alarm in the layer to which the alarm concentration point belongs; a second determination module for determining the root cause of the fault that caused the alarm based on multiple alarm concentration points.
[0014] According to another aspect of an embodiment of the present application, a non-volatile storage medium is provided, in which a computer program is stored. The device where the non-volatile storage medium is located executes the above-mentioned method for locating network faults by running the computer program.
[0015] According to another aspect of an embodiment of the present application, an electronic device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the above-mentioned method for locating a network fault through the computer program.
[0016] According to another aspect of an embodiment of the present application, a computer program product is further provided, including computer instructions, which implement the steps of the above-mentioned method for locating network faults when executed by a processor.
[0017] In an embodiment of the present application, the basic data of the network to be tested and the networking structure of the network to be tested are obtained, wherein the network to be tested is a network that generates an alarm, and the basic data at least includes: network elements in the network to be tested, and the networking structure is at least used to define the network level to which each network element belongs and the association relationship between multiple network elements; an alarm tree is constructed according to the networking structure and the basic data, wherein each network element is a node of the alarm tree, and multiple network elements corresponding to multiple nodes at the same layer of the alarm tree belong to the same network level; an alarm concentration point is determined at each layer of the alarm tree according to the alarm data of the network to be tested within the detection period, wherein each alarm concentration point is used to indicate the alarm level. The network elements related to the alarm in the layer to which the alarm concentration point belongs; the method of determining the root cause of the fault that causes the alarm based on multiple alarm concentration points, through personalized stratification of the network, and cross-layer association of network elements, the network elements that have alarmed in unit time are formed into an alarm tree according to the stratification rules and association rules, and the network element nodes of each layer in the alarm tree are scanned. The purpose of locating the network fault quickly and accurately is achieved according to the uniqueness of the alarm concentration point, thereby achieving the technical effect of improving the accuracy and real-time performance of network fault locating, and further solving the technical problems of the network fault locating method adopted in related technologies that are difficult to locate the network fault in real time and have low accuracy. BRIEF DESCRIPTION OF THE DRAWINGS
[0018] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:
[0019] Figure 1 is a hardware structure block diagram of a computer terminal for implementing a method for locating a network fault according to an embodiment of the present application;
[0020] Figure 2 is a flowchart of the steps of a method for locating a network fault according to an embodiment of the present application;
[0021] Figure 3 is a schematic diagram of a network to be tested according to an embodiment of the present application;
[0022] Figure 4 is a schematic diagram of fault location at a single target tree level according to an embodiment of the present application;
[0023] Figure 5 This is a structural diagram of a device for locating network faults according to an embodiment of the present application. DETAILED DESCRIPTION
[0024] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.
[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.
[0026] In order to better understand the embodiments of the present application, the technical terms involved in the embodiments of the present application are explained as follows:
[0027] Network elements: basic units that make up a network, such as routers, switches, servers, etc.
[0028] Cross-layer association: the association relationship between different network layers.
[0029] In related technologies, network fault location suffers from the following problems: The inability to locate network faults in real time due to time lags in data processing, resulting in a lack of real-time performance; the inability to identify all faults when using rule-based methods and machine learning models for network fault location, especially in complex network environments; and the difficulty in handling multi-layer and cross-layer faults. To address the above issues, the present application provides relevant solutions in its embodiments, which are described in detail below.
[0030] According to an embodiment of the present application, an embodiment of a method for locating a network fault is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.
[0031] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG1 shows a hardware structure block diagram of a computer terminal for implementing a method for locating network faults. Figure 1 As shown, the computer terminal 10 may include one or more (illustrated as 102a, 102b, ..., 102n in the figure) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It will be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown.
[0032] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuitry." The data processing circuitry may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuitry may be a single, independent processing module, or may be incorporated in whole or in part into any of the other components of the computer terminal 10. As described in the embodiments of the present application, the data processing circuitry serves as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).
[0033] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the method for locating network faults in the embodiments of the present application. The processor 102 executes the software programs and modules stored in the memory 104 to perform various functional applications and data processing, thereby implementing the aforementioned method for locating network faults. The memory 104 may include high-speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.
[0034] The transmission device 106 is configured to receive or transmit data via a network. A specific example of the aforementioned network may include a wireless network provided by the communications provider of the computer terminal 10. In one embodiment, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, the transmission device 106 may be a radio frequency (RF) module, which is configured to communicate with the Internet wirelessly.
[0035] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 .
[0036] The embodiment of the present application provides a method for locating network faults that can be run in the above operating environment. Figure 2 is a flowchart of the steps of the method for locating network faults provided in an embodiment of the present application, such as Figure 2 As shown, the method includes the following steps:
[0037] Step S202, obtaining basic data of the network to be tested and the networking structure of the network to be tested, wherein the network to be tested is the network generating the alarm, the basic data at least includes: network elements in the network to be tested, and the networking structure is used to define at least the network level to which each network element belongs and the association relationship between multiple network elements.
[0038] The embodiment of the present application provides a method for locating network faults based on layer-by-layer correlation analysis, which achieves layering by classifying network elements in the network as needed, wherein network elements are devices in the network, such as routers, firewalls, switches, physical hosts, virtual machines, network elements, etc.; network faults are located based on the network layers to which the network elements belong after layering and the correlation between the network elements contained in each network layer, and the accuracy of network fault locating is improved by performing layer-by-layer correlation analysis on network elements. In step S202, after detecting that a network generates an alarm or receiving an alarm message, the network generating the alarm or the network to which the faulty device indicated by the alarm message belongs is determined. The network generating the alarm or the network to which the faulty device indicated by the alarm message belongs is the network to be tested for fault location. In step S202, after determining the network to be tested, the basic data and networking structure of the network to be tested are obtained to locate the network fault based on these data, wherein the basic data of the network to be tested are multiple network elements that constitute the network. Generally, a network is composed of routers, firewalls, switches, physical hosts, virtual machines, network elements, etc. that are physically or logically connected in accordance with business requirements and communication principles. The network to be tested is no exception. Therefore, the above-mentioned network elements refer to devices such as routers, firewalls, switches, physical hosts, virtual machines, network elements, etc. The embodiment of the present application provides a method for layering network elements, wherein the networking structure defines the network layer to which each network element in the network to be tested belongs, and the information of the networking structure also records the association relationship between network elements.
[0039] Figure 3 It is a schematic diagram of the network to be tested. In the embodiment of the present application, the basic data source is all the network elements in the network to be tested. The network to be tested is a hierarchical network obtained by classifying and layering the network elements contained therein according to the hierarchical rules. Figure 3 As shown, when layering, network elements are classified according to the predefined networking architecture, each category is a layer, and finally a layered network element (a network element carrying layered information) is formed. For example, the total number of network elements is Te, and the network is divided into n layers (i.e., i=n) according to the preset rules. Among them, there are M network elements in the i-th layer (M<Te), and the identifier of the k-th network element in the i-th layer is A i K(K≤M),A i K is the unique identifier of a hierarchical network element. Figure 3 In the network to be tested, the first layer contains 11 network elements A11...A111, the second layer contains 12 network elements A21...A112, the third layer contains 13 network elements A31...A113, the nth layer contains A n 1……A n 1n There are 1n network elements in total.
[0040] Step S204 : constructing an alarm tree according to the networking structure and basic data, wherein each network element is a node of the alarm tree, and multiple network elements corresponding to multiple nodes at the same layer of the alarm tree belong to the same network level.
[0041] In step S204, an alarm tree is constructed based on the relevant data of the network to be tested obtained in S202, wherein the alarm tree is a tree-like data structure. The alarm tree constructed in the embodiment of the present application uses the network elements of the network to be tested as nodes, and the constructed alarm tree is layered according to the layering rules of the network elements. Therefore, in the obtained alarm tree, the network elements represented by multiple nodes located at the same layer of the alarm tree belong to the same network level.
[0042] Optionally, the association relationship is used to indicate the connection relationship between network elements belonging to adjacent levels; constructing an alarm tree based on the networking structure and basic data, including: determining the number of levels of the alarm tree based on the networking structure, and determining the nodes of each tree level in the alarm tree and the branches of the alarm tree based on the networking structure and basic data, where the tree level is the level in the alarm tree; constructing an alarm tree based on the number of levels of the alarm tree, the nodes of each tree level of the alarm tree and the branches of the alarm tree.
[0043] The source of the association relationship of the above-mentioned multiple network elements is the connection relationship between network elements of adjacent layers in the existing hierarchical network (i.e., the network to be tested). The tree structure includes leaf nodes, branches, and multiple levels (i.e., tree levels). Therefore, in the embodiment of the present application, when constructing the alarm tree, it is necessary to determine the leaf nodes, branches, and tree levels of the alarm tree, as well as the number of nodes contained in each tree level. In this embodiment, the branches are branches composed of leaf nodes with associated relationships, and the leaf nodes (i.e., nodes) are network elements in the network to be tested. Therefore, whether different leaf nodes are connected as branches by straight lines can be determined by whether there is an association relationship between the network elements represented by the leaf nodes. As mentioned in step S202, the network elements are included in the acquired basic data, and the association relationship between the network elements is defined by the network structure. That is, in the embodiment of the present application, the branches of the alarm tree are determined according to the network structure and basic data of the network to be tested. In addition, since the alarm tree is layered according to the layering rules of the network elements in the embodiment of the present application, the number of tree levels contained in the alarm tree (i.e., the number of levels) can be determined according to the network structure of the network level to which the network elements belong. To determine the nodes at each level (tree) of the alarm tree, it is necessary to know both the network elements represented by each leaf node and the layer corresponding to each leaf node (i.e., node). The nodes contained in each level (tree level) of the alarm tree need to be determined based on the basic data of the network to be tested (used to determine the network elements represented by the leaf nodes) and the association relationship between the network elements (used to determine the layer corresponding to the leaf nodes).
[0044] According to some optional embodiments of the present application, determining the number of levels of the alarm tree according to the networking structure includes: determining the number of network levels of the network to be tested according to the networking structure; and determining the number of network levels as the number of levels of the alarm tree.
[0045] In this embodiment, since the alarm tree is layered according to the layering rules of network elements, the number of (tree) levels included in the alarm tree is the same as the number of network layers recorded in the networking architecture. The number of (tree) levels is used to indicate the number of levels included in the alarm tree, and the number of network layers is used to indicate the number of levels included in the network to be tested. Therefore, in this embodiment, when determining the number of levels of the alarm tree, the number of network layer types defined for network elements in the networking architecture (i.e., the number of network layers of the network to be tested) can be determined first. The number of network layer types defined for network elements in the networking architecture is the number of levels of the alarm tree. For example, if the networking structure defines that all network elements are divided into the application layer (layer 1), virtualization layer (layer 2), physical host layer (layer 3), and network bearer layer (layer 4), then the layering rules can be determined to define the network to be tested as having a total of 4 layers, i.e., the number of network layers is 4. Then, the constructed alarm tree also contains 4 layers, i.e., the number of levels of the alarm tree is 4.
[0046] Among them, in the embodiment of the present application, when network elements are classified on demand according to the layering rules to implement network layering, the classification basis (i.e., the predefined networking architecture) that can be used includes: the physical location of the network elements (such as classification and layering according to the geographical location of the network elements), the logical relationship of the network elements, and the service level agreement (SLA) correlation. For example, when layering according to the physical location of the network elements, network elements with the same geographical location can be classified together, and different geographical locations correspond to different network layers; when layering according to the service level agreement (SLA) correlation, network elements can be classified and layered based on the level and protocol of the services provided by the network elements.
[0047] According to other optional embodiments of the present application, the nodes of each tree level in the alarm tree are determined according to the networking structure and basic data, including: classifying network elements belonging to the same network level into data sets according to the networking structure to obtain multiple data sets; for each data set, determining a first correspondence between the data set and the network level; determining a second correspondence between the network level and the tree level of the alarm tree, and determining the nodes of each tree level in the alarm tree according to the first correspondence and the second correspondence.
[0048] In this embodiment, the alarm tree and the network elements to be tested follow the same hierarchical rules. Therefore, each level of the alarm tree (i.e., tree level) corresponds to a network level of the network to be tested. For example, the network levels of the network to be tested include: application layer (layer 1), virtualization layer (layer 2), physical host layer (layer 3), and network bearer layer (layer 4). Then, the alarm tree corresponds to the application layer, the virtualization layer, the physical host layer, and the network bearer layer in a bottom-up or top-down order. In this embodiment, when the leaf nodes (i.e., nodes) contained in each (tree) level of the alarm tree are jointly determined based on the association relationship between the network elements contained in the network to be tested and the multiple network elements defined by the networking structure, the multiple network elements contained in the network to be tested are classified according to the network level to which the network elements defined by the networking structure belong, and the network elements belonging to the same network level are combined into a data set to form multiple data sets. Next, the nodes of each (tree) level in the alarm tree are jointly determined based on the attribution relationship between the data set and the network level (i.e., the first correspondence relationship) and the correspondence relationship between the network level and the tree level (i.e., the second correspondence relationship). In this embodiment, the multiple network elements corresponding to the multiple leaf nodes (i.e., nodes) belonging to the same tree level in the alarm tree should also belong to the same network level in the network to be tested. For example, when the correspondence relationship between the network level and the tree level (i.e., the second correspondence relationship) is: the first layer corresponds to the application layer, the second layer corresponds to the virtualization layer, the third layer corresponds to the physical host layer, and the fourth layer corresponds to the network bearer layer, the nodes in the first layer of the alarm tree are generated by the network elements included in the application layer, the nodes in the second layer of the alarm tree are generated by the network elements included in the virtualization layer, the nodes in the third layer of the alarm tree are generated by the network elements included in the physical host layer, and the nodes in the fourth layer of the alarm tree are generated by the network elements included in the network bearer layer.
[0049] According to some optional embodiments of the present application, the branches of the alarm tree are determined based on the networking structure and basic data, including: determining the target nodes with an associated relationship in two adjacent tree levels based on the networking structure; and generating branches of the alarm tree based on multiple target nodes and straight lines connecting the multiple target nodes.
[0050] In an embodiment of the present application, when constructing a branch of an alarm tree, nodes (i.e., target nodes) that have an association relationship and belong to adjacent tree levels are determined among the multiple leaf nodes (i.e., nodes) constituting the alarm tree based on the association relationship of the multiple network elements obtained in step S202, and branches of the alarm tree are formed by connecting the target nodes; for example, starting from the network elements contained in the i=1th layer, with the network element of the i=1 layer as the root node (one network element is a root node), the association is performed layer by layer (i=i+1) according to the association relationship until i=n-1, forming a tree structure with one or more root nodes, that is, the association relationship of the multiple network elements obtained in step S202 is actually the connection relationship (including physical connection relationship and logical connection relationship) between the network elements contained in adjacent network levels.
[0051] According to the method provided in the above embodiment, the method provided in the embodiment of the present application can follow the following steps when constructing the alarm tree: Step 1, constructing the alarm tree structure: parsing the networking structure of the network to be tested, and determining the number of alarm levels by identifying the network level to which the network elements belong, for example, there are n levels in total. Step 2, constructing the tree node: in the alarm tree, for each network element A in the network to be tested, i K creates a node and determines the tree level to which the node belongs according to the network level to which the network element belongs. Step 3: Based on the association relationship of network elements, if A i K related network elements of adjacent layers are connected to form branches of the alarm tree. Step 4: After completing the traversal of all layers and the construction of subtrees, the alarm tree will fully represent the hierarchical association relationship between network elements. The constructed alarm tree can be expressed as follows: T = (N, E, A), where T is the alarm tree, N is the set of (leaf) nodes in the alarm tree, E is the set of edges (branches) in the alarm tree, and A is the set of network elements that generate alarms.
[0052] Step S206 , determining an alarm concentration point at each layer of the alarm tree according to the alarm data of the network to be tested within the detection period, wherein each alarm concentration point is used to indicate the network element related to the alarm in the layer to which the alarm concentration point belongs.
[0053] Furthermore, in step S206, network fault location is performed based on the alarm tree constructed in step S204. Specifically, the alarm data of the network to be tested within the detection period is obtained, wherein the detection period is pre-set. For example, the time length of the detection period can be set to 5 minutes, 15 minutes or other durations. The network elements related to the alarms generated by the network to be tested are determined in the alarm tree based on the alarm data. In this embodiment, the nodes in the alarm tree that represent these network elements related to the alarms generated by the network to be tested are called alarm concentration nodes. The alarm data in the embodiment of the present application can be obtained in the following ways: real-time collection of logs, alarms and other data that affect the normal operation of network elements, and through data regularization and cleaning, retaining logs and alarms that affect business health (the contents of these logs and alarms are prompts at various levels that affect the normal operation of the business). The alarm data contains at least the network element identifier (A), log or alarm content and title (defined as B). Based on the above, in the method provided in the embodiment of the present application, the alarm data is defined as ALARM[A,B]; if A in the alarm data is used as an index and the basic data is traversed, the hierarchical network element identifier A will be output. i K.
[0054] It should be noted that when an alarm concentration point is determined at each layer of the alarm tree based on the alarm data of the network to be tested during the detection period, the alarm data can be input into the alarm tree. Specifically, after determining the network element corresponding to each alarm data, the alarm data of each network element is stored in the (leaf) node corresponding to the network element, so as to subsequently determine the root cause of the fault.
[0055] Optionally, the alarm data includes: the number of alarms generated by each network element; determining an alarm concentration point at each tree level of the alarm tree based on the alarm data of the network to be tested within the detection period, including: for each tree level of the alarm tree, determining the target network element corresponding to the number of alarms with the largest value, and determining the node corresponding to the target network element as the alarm concentration point.
[0056] In the method provided in the embodiment of the present application, when determining the alarm concentration node, an alarm concentration node is determined at each layer of the alarm tree. Specifically, in the embodiment of the present application, the alarm concentration node is determined based on the number of times the network element represented by the node generates an alarm during the detection cycle. Therefore, when determining the alarm concentration node, it is necessary to use the alarm data generated by the network to be tested during the detection cycle, and in particular, the number of times each network element recorded in the alarm data generates an alarm (i.e., the number of alarms). In the method provided in the embodiment of the present application, in order to improve the accuracy of network fault location and increase the location speed, for each tree level, the node representing the network element with the largest number of alarms (i.e., the target network element) is directly determined as the alarm concentration node.
[0057] According to some optional embodiments of the present application, before determining the alarm concentration point, it includes: comparing the alarm data in the current detection cycle with the alarm data in the previous detection cycle to obtain a comparison result, wherein the comparison result is used to indicate whether there is incremental alarm data in the current detection cycle; when the comparison result indicates the existence of incremental alarm data, determining an alarm concentration point at each layer of the alarm tree according to the alarm data of the network to be tested within the detection cycle; when the comparison result indicates the absence of incremental alarm data, refusing to determine the alarm concentration point.
[0058] In the method provided in the embodiment of the present application, the trigger condition for locating the root cause of the fault in combination with the alarm data and the alarm tree is the existence of incremental alarm data in the current detection cycle relative to the previous detection cycle. Therefore, before determining the root cause of the fault, it is first determined whether the trigger condition is met, wherein the above-mentioned previous detection cycle is the previous detection cycle with the shortest time interval with the current detection cycle, and the incremental detection data is data that is not included in the alarm data generated by the network to be tested in the previous detection cycle, but is included in the alarm data generated in the current detection cycle. If it is determined that there is incremental alarm data, the current timestamp and the identifier of the incremental alarm data are recorded, and preparations are made for the next analysis process. If it is determined that there is no incremental alarm data, wait for the next detection cycle to check again whether the trigger condition is met.
[0059] Step S208: determining the root cause of the fault that causes the alarm based on multiple alarm concentration points.
[0060] In step S208, the network fault location is further performed based on the alarm concentration node determined in step S206, and the lowest-level network element that causes the alarm in the network under test is located among the multiple network elements corresponding to the multiple alarm concentration nodes. The located lowest-level network element is the root cause of the alarm in the network under test (i.e., the root cause of the fault).
[0061] Optionally, the root cause of the fault that caused the alarm is determined based on multiple alarm concentration points, including: determining multiple tree levels corresponding to the multiple alarm concentration points, wherein the tree level is the level of the alarm tree; determining a target tree level in which the number of alarm concentration points included is 1 among the multiple tree levels; when there is 1 target tree level, determining the network element corresponding to the alarm concentration point in the target tree level as the root cause of the fault; when there are multiple target tree levels, determining the root cause of the fault based on the multiple alarm concentration points in the multiple target tree levels and the alarm time of each alarm concentration point, wherein the alarm time is recorded in the alarm data.
[0062] In the method provided in the embodiment of the present application, when determining the root cause of the fault based on the alarm concentration node, the tree level corresponding to each alarm concentration node is first analyzed. Further, a tree level with 1 alarm concentration point (i.e., a target number level) is identified in multiple tree levels of the alarm tree. There may be only one target tree level or multiple target tree levels. If there is only one target tree level, the network element corresponding to the alarm concentration point in the tree level is directly determined as the root cause of the fault. It can be determined that the fault of the network device represented by this network element is the root cause of the alarm generated by the network under test. If there are multiple target tree levels, the alarm time of multiple alarm concentration points in the multiple tree levels is analyzed, and the network element corresponding to the alarm concentration point with the earliest alarm time is selected as the root cause of the fault. Alternatively, the tree levels where the multiple alarm concentration points are located can be analyzed according to the alarm tree, and the network element corresponding to the alarm concentration point in the tree level with the largest number of nodes (i.e., when tree level i=n, the tree level with the largest n) is determined as the root cause of the fault.
[0063] Figure 4 This is a schematic diagram of fault location at a single target tree level, such as Figure 4 As shown, each network level (corresponding to a tree level) contains only one alarm concentration point (marked in red), among which only the number of alarm concentration points of the third network level is 1, that is, only the third network level is the target network level. In this case, the network element represented by the alarm concentration point A33 of the third network level is determined to be the root cause of the fault.
[0064] Through the above steps, network elements in the network are classified as needed to achieve network stratification; an alarm tree is constructed based on the network's layered information and the correlation between cross-layer network elements, and network faults are located together with the alarm data generated by the network under test during the detection cycle and the alarm tree, thereby achieving rapid and accurate fault location, improving the accuracy of network fault location, and realizing real-time network fault location.
[0065] Figure 5 FIG. 1 is a structural diagram of a device for locating network faults according to an embodiment of the present application. Figure 5As shown, the device for locating network faults includes: an acquisition module 50, which is used to obtain basic data of the network to be tested and the networking structure of the network to be tested, wherein the network to be tested is a network that generates an alarm, and the basic data at least includes: network elements in the network to be tested, and the networking structure is at least used to define the network layer to which each network element belongs and the association relationship between multiple network elements; an alarm tree construction module 52, which is used to construct an alarm tree according to the networking structure and the basic data, wherein each network element is a node of the alarm tree, and multiple network elements corresponding to multiple nodes at the same layer of the alarm tree belong to the same network layer; a first determination module 54, which is used to determine an alarm concentration point at each layer of the alarm tree according to the alarm data of the network to be tested within the detection period, wherein each alarm concentration point is used to indicate the network elements related to the alarm in the layer to which the alarm concentration point belongs; a second determination module 56, which is used to determine the root cause of the fault that caused the alarm based on multiple alarm concentration points.
[0066] In an embodiment of the present application, the process of locating a network fault using the above-mentioned network fault locating device is as follows: first, the basic data of the network generating the alarm (i.e., the network to be tested) and the network structure of the network to be tested are obtained by the acquisition module 50. For example, the obtained basic data and network structure include: the network hierarchy to which the network elements defined by the basic data and the network structure belong:
[0067]
[0068]
[0069] The relationship between multiple network elements:
[0070]
[0071] Next, the alarm tree construction module 52 constructs an alarm tree based on the networking structure and basic data acquired by the acquisition module 50. In the alarm tree, network elements are distributed among the layers of the alarm tree according to their network layers. Each network element is a node of the alarm tree, and the nodes corresponding to multiple network elements belonging to the same network layer also belong to the same tree layer. After the alarm tree is constructed, the first determination module 54 uses the alarm data generated by the network under test during the detection cycle to determine the alarm concentration point in each layer of the alarm tree. The network element represented by the alarm concentration point is the network element with the most alarms in that layer. Finally, the second determination module 56 determines the root cause network element (i.e., the root cause of the fault) that caused the alarm in the network under test by analyzing multiple alarm concentration points.
[0072] It should be noted that Figure 5 The preferred implementation of the embodiment shown can be found in Figure 2 The relevant description of the illustrated embodiment will not be repeated here.
[0073] An embodiment of the present application further provides a non-volatile storage medium, in which a computer program is stored. The device where the non-volatile storage medium is located executes the above method for locating network faults by running the computer program.
[0074] The above-mentioned non-volatile storage medium is used to store a program that performs the following functions: obtaining basic data of the network to be tested and the networking structure of the network to be tested, wherein the network to be tested is a network that generates an alarm, and the basic data at least includes: network elements in the network to be tested, and the networking structure is at least used to define the network layer to which each network element belongs and the association relationship between multiple network elements; constructing an alarm tree based on the networking structure and basic data, wherein each network element is a node of the alarm tree, and multiple network elements corresponding to multiple nodes at the same layer of the alarm tree belong to the same network layer; determining an alarm concentration point at each layer of the alarm tree based on the alarm data of the network to be tested within a detection period, wherein each alarm concentration point is used to indicate the network elements related to the alarm in the layer to which the alarm concentration point belongs; and determining the root cause of the fault that caused the alarm based on multiple alarm concentration points.
[0075] An embodiment of the present application further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the above method for locating a network fault through the computer program.
[0076] The processor in the above-mentioned electronic device is used to run a program that performs the following functions: obtaining basic data of the network to be tested and the networking structure of the network to be tested, wherein the network to be tested is a network that generates an alarm, and the basic data at least includes: network elements in the network to be tested, and the networking structure is at least used to define the network layer to which each network element belongs and the association relationship between multiple network elements; constructing an alarm tree based on the networking structure and basic data, wherein each network element is a node of the alarm tree, and multiple network elements corresponding to multiple nodes at the same layer of the alarm tree belong to the same network layer; determining an alarm concentration point at each layer of the alarm tree based on the alarm data of the network to be tested within a detection period, wherein each alarm concentration point is used to indicate the network elements related to the alarm in the layer to which the alarm concentration point belongs; and determining the root cause of the fault that caused the alarm based on multiple alarm concentration points.
[0077] An embodiment of the present application further provides a computer program product, including computer instructions, which implement the steps of the above method for locating network faults when executed by a processor.
[0078] It should be noted that the various modules in the above-mentioned device for locating network faults can be program modules (for example, a set of program instructions that implement a certain specific function) or hardware modules. For the latter, it can be expressed in the following forms, but is not limited to this: the expression form of each of the above-mentioned modules is a processor, or the functions of each of the above-mentioned modules are implemented by a processor.
[0079] The serial numbers of the above embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.
[0080] In the above embodiments of the present application, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.
[0081] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of the units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.
[0082] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.
[0083] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.
[0084] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the relevant technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.
[0085] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.
Claims
1. A method for locating a network fault, characterized in that: include: Obtaining basic data of a network to be tested and a networking structure of the network to be tested, wherein the network to be tested is a network generating an alarm, the basic data including at least network elements in the network to be tested, and the networking structure defining at least a network hierarchy to which each network element belongs and an association relationship between multiple network elements; Constructing an alarm tree according to the networking structure and the basic data, wherein each of the network elements is a node of the alarm tree, and multiple network elements corresponding to multiple nodes at the same layer of the alarm tree belong to the same network level; Determining an alarm concentration point at each layer of the alarm tree according to the alarm data of the network to be tested within a detection period, wherein each of the alarm concentration points is used to indicate a network element related to the alarm in the layer to which the alarm concentration point belongs; The root cause of the fault causing the alarm is determined based on the multiple alarm concentration points.
2. The method according to claim 1, characterized in that The association relationship is used to indicate the connection relationship between network elements belonging to adjacent layers; Construct an alarm tree based on the network structure and the basic data, including: Determining the number of levels of the alarm tree according to the networking structure, and determining nodes of each tree level in the alarm tree and branches of the alarm tree according to the networking structure and the basic data, wherein the tree level is a level in the alarm tree; The alarm tree is constructed according to the number of levels of the alarm tree, the nodes of each tree level of the alarm tree and the branches of the alarm tree.
3. The method according to claim 2, characterized in that Determining the number of levels of the alarm tree according to the networking structure includes: determining the number of network levels of the network to be tested according to the networking structure; and determining the number of network levels as the number of levels of the alarm tree.
4. The method according to claim 2, characterized in that Determining a node at each tree level in the alarm tree according to the networking structure and the basic data includes: Classifying network elements belonging to the same network layer into data sets according to the networking structure to obtain a plurality of data sets; For each of the data sets, determining a first correspondence between the data set and the network layer; A second correspondence between the network level and the tree level of the alarm tree is determined, and a node of each tree level in the alarm tree is determined according to the first correspondence and the second correspondence.
5. The method according to claim 2, characterized in that Determining branches of the alarm tree according to the networking structure and the basic data includes: Determine, according to the networking structure, target nodes having an association relationship in two adjacent tree levels; The branches of the alarm tree are generated according to the multiple target nodes and the straight lines connecting the multiple target nodes.
6. The method according to claim 1, wherein Before determining the alarm concentration point, the following steps are included: Comparing the alarm data in the current detection cycle with the alarm data in the previous detection cycle to obtain a comparison result, wherein the comparison result is used to indicate whether there is incremental alarm data in the current detection cycle; In the case where the comparison result indicates the presence of the incremental alarm data, determining an alarm concentration point at each layer of the alarm tree according to the alarm data of the network to be tested within a detection period; If the comparison result indicates that the incremental alarm data does not exist, the alarm concentration point is rejected.
7. The method according to claim 1, characterized in that The alarm data includes: the number of alarms generated by each of the network elements; Determining an alarm concentration point at each tree level of the alarm tree according to the alarm data of the network to be tested within a detection period includes: For each tree level of the alarm tree, a target network element corresponding to the alarm number with the largest value is determined, and a node corresponding to the target network element is determined as the alarm concentration point.
8. The method according to claim 1, characterized in that Determining the root cause of the fault causing the alarm according to the multiple alarm concentration points includes: Determining a plurality of tree levels corresponding to a plurality of the alarm concentration points, wherein the tree levels are levels of the alarm tree; Determining a target tree level in the plurality of tree levels, the target tree level including one alarm concentration point; In the case that there is one target tree level, determining the network element corresponding to the alarm concentration point in the target tree level as the root cause of the fault; In the case where there are multiple target tree levels, the root cause of the fault is determined based on the multiple alarm concentration points in the multiple target tree levels and the alarm time of each alarm concentration point, wherein the alarm time is recorded in the alarm data.
9. A device for locating network faults, characterized in that: include: an acquisition module, configured to acquire basic data of a network to be tested and a networking structure of the network to be tested, wherein the network to be tested is a network generating an alarm, the basic data including at least network elements in the network to be tested, and the networking structure defining at least a network hierarchy to which each network element belongs and an association relationship between multiple network elements; An alarm tree construction module is configured to construct an alarm tree according to the networking structure and the basic data, wherein each of the network elements is a node of the alarm tree, and multiple network elements corresponding to multiple nodes at the same layer of the alarm tree belong to the same network level; A first determination module is configured to determine an alarm concentration point at each layer of the alarm tree based on the alarm data of the network to be tested within a detection period, wherein each of the alarm concentration points is used to indicate a network element related to the alarm in the layer to which the alarm concentration point belongs; The second determining module is used to determine the root cause of the fault that causes the alarm based on the multiple alarm concentration points.
10. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a computer program, wherein the method for locating a network fault according to any one of claims 1 to 8 is executed by running the computer program on the device where the non-volatile storage medium is located.
11. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to execute the method for locating a network fault according to any one of claims 1 to 8 through the computer program.
12. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by a processor, the steps of the method for locating a network fault according to any one of claims 1 to 8 are implemented.