A self-learning method and system for event recognition rules based on algorithms

Abstract

This invention relates to the field of intelligent operation and maintenance technology for communication networks, specifically to an algorithm-based event recognition rule self-learning method and system, comprising the following steps: data preprocessing and topology modeling, fault recognition rule generation, and closed-loop self-learning optimization. The beneficial effects are: candidate rules are generated through large-scale model reasoning, requiring experts only to review the rationality of the reasoning logic; the reasoning path of experts is simulated using thought chain technology, and dynamic optimization is achieved through feedback mechanisms; the model output is corrected in reverse through live network verification results, forming a self-intelligent process of rule generation-verification-iteration; and the output provides location steps that conform to human logic, increasing the trust of operation and maintenance personnel in the automated rules.

Description

Technical Field

[0001] This invention relates to the field of intelligent operation and maintenance technology for communication networks, specifically to an algorithm-based event recognition rule self-learning method and system. Background Technology

[0002] Current fault rules are primarily compiled by experts, resulting in strong reliance on experience, poor topology adaptability, and inefficiency in cross-domain analysis. Existing rule bases rely on manual experience for construction, leading to insufficient coverage of new fault modes (such as NFV virtual link outages and network slice resource contention). According to TM Forum statistics, traditional methods have a false negative rate exceeding 40% for unknown fault scenarios. Static rules struggle to respond promptly to dynamic changes in network topology (such as real-time route adjustments by the SDN controller), increasing false positive rates. Test data shows that the average rule expiration period after a topology change is 72 hours. Multi-level network alarm correlation requires manual configuration of filtering strategies.

[0003] The fault judgment criteria driven by expert experience rules, such as determining an optical cable breakage when ≥3 nodes in the same ring network generate LOS alarms, can be expressed as an optical cable breakage event triggered when the fault subgraph satisfies: betweenness centrality > 0.7, alarm timing conforms to Granger causality, and propagation delay deviation ≥ 20% (92% confidence). This increases the time investment required for expert rule development. Summary of the Invention

[0004] The purpose of this invention is to provide an algorithm-based event recognition rule self-learning method and system to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: an algorithm-based event recognition rule self-learning method, comprising the following steps: Data preprocessing and topology modeling: fusing multi-source heterogeneous data to construct multi-dimensional attribute graphs. G =( V , E , A The process involves creating a topology map by reading basic resource data on network elements, devices, ports, optical cables, circuits, and links from the resource management system. Nodes have attribute information, including equipment manufacturers and software versions. Edge attributes are populated by adding performance data, which includes latency and bandwidth utilization. Real-time alarm information is injected into the topology map for dynamic rendering, and alarm levels are distinguished by color depth. A spectral clustering algorithm is used to implement a topology enhancement strategy, identify hidden connections, and define the probability of link existence to fill in the missing links caused by incomplete resource data.

[0006] Fault identification rule generation: Dynamic graph analysis is used to define the propagation relationship of faults with the help of a fault propagation model; a fault probability heatmap is generated by combining node shrinkage and proximity centrality to reconstruct the basic fault dynamic topology; alarm causal relationships are modeled using a time Petri net and the spatial coupling degree is defined. Alarm ranges with coupling degrees that meet the threshold are identified as fault subgraphs. The root cause of the current aggregated fault is obtained through a graph centrality algorithm, generating a set of alarm data and fault root cause information.

[0007] Closed-loop self-learning optimization: A dual-dimensional verification mechanism is adopted to improve rule credibility. The first method involves analyzing historical fault records using the aforementioned data preprocessing, topology modeling, and fault identification rule generation methods. After multiple iterations, a fault alarm range correspondence is generated, from which the alarm range with the highest confidence is obtained. Rule optimization is then completed by manually adjusting the weights of the labeled data. The second method employs real-time data verification, calculating the rule benefit index. BEI Alternatively, a rule evaluation matrix can be constructed and weighted to perform backtesting on the rules, ensuring that the rules meet production needs.

[0008] Preferably, a multi-dimensional attribute graph is constructed during the data preprocessing and topology modeling stages. G =( V , E , A The specific process is as follows: Retrieve basic resource data for network elements, devices, ports, optical cables, circuits, and links from the resource management system, and treat each basic resource entity as a node in the topology graph. V The node attribute information includes the device manufacturer and software version; The edges of the topology graph are determined based on the connectivity relationships between basic resource entities. E The attributes of the edges are populated by adding performance data, which includes, but is not limited to, latency and bandwidth utilization. Real-time acquisition of alarm information, association of alarm information with nodes or edges in the topology graph, and color depth rendering of associated nodes or edges according to alarm level to intuitively display alarm status.

[0009] Preferably, in the fault identification rule generation stage, the specific steps for generating a fault probability heatmap using dynamic graph analysis are as follows: Based on the fault propagation model, analyze the propagation path and influence range of the fault in the topology graph, and determine the nodes and edges that the fault may propagate to; calculate the contraction degree and proximity centrality index of each node, where the contraction degree reflects the node's convergence ability during fault propagation, and the proximity centrality reflects the degree of the node's central position in the topology graph; combine the node contraction degree and proximity centrality index to assign a fault probability value to each node in the topology graph, and generate a fault probability heatmap based on the fault probability values ​​to intuitively display the probability distribution of fault occurrence.

[0010] Preferably, in the fault identification rule generation stage, the specific process of using a temporal Petri net to model alarm causal relationships and identify fault subgraphs is as follows: Construct a temporal Petri net model, treating alarm events as transitions in the Petri net, and the temporal and causal relationships between alarm events as places and directed arcs in the Petri net; define the coupling degree of the space to measure the degree of correlation between alarm events in space; traverse the Petri net model to find alarm ranges where the coupling degree meets a threshold, and identify this range as a fault subgraph; use graph centrality algorithms, such as degree centrality and betweenness centrality, to calculate the centrality index of each node in the fault subgraph, and obtain the root cause of the current aggregated fault based on the centrality index.

[0011] Preferably, in the closed-loop self-learning optimization phase, the specific steps for backtracking testing of rules using real-time data verification are as follows: Collect data during system operation in real time, including alarm information and basic resource data; generate fault identification results using real-time data according to the aforementioned data preprocessing, topology modeling, and fault identification rule generation methods; calculate the rule benefit index. BEI , BEI The calculation formula is BEI =(Total number of identified faults / Number of correctly identified faults) × 100%, or construct a rule evaluation matrix, where the elements of the matrix are the rule's performance indicators in different scenarios, such as precision and recall, and calculate a weighted comprehensive score; based on the rule benefit index BEI Alternatively, the weighted comprehensive score of the rule evaluation matrix can be used to evaluate and adjust the rules. If a rule does not meet production needs, it can be optimized until the rule meets the production requirements.

[0012] A system for an algorithm-based self-learning method for event recognition rules includes: a data preprocessing and topology modeling module: used to fuse multi-source heterogeneous data and construct a multi-dimensional attribute graph. G =( V , E , A This module reads basic resource data on network elements, devices, ports, optical cables, circuits, and links from the resource management system to create a topology map, where nodes... V It contains attribute information, including device manufacturer and software version; E The attributes are populated by adding performance data, which includes latency and bandwidth utilization; it is used to inject real-time alarm information into the topology map and perform dynamic rendering, and to distinguish and display the alarm level by color depth; it is used to implement topology enhancement strategies using spectral clustering algorithms, identify hidden connections, define the probability of link existence, and supplement the missing links caused by incomplete resource data. The fault identification rule generation module is used to define the propagation relationship of faults using dynamic graph analysis and a fault propagation model; it generates a fault probability heatmap by combining node shrinkage and proximity centrality, and restores the basic dynamic fault topology; it uses a time-based Petri net to model the causal relationship of alarms and defines the spatial coupling degree, identifies the alarm range that meets the coupling degree threshold as a fault subgraph, obtains the root cause of the current aggregated fault through a graph centrality algorithm, and generates a set of alarm data and root cause information of the fault. Closed-loop self-learning optimization module: Used to improve rule credibility using a two-dimensional verification mechanism; The first verification method: Historical fault records are analyzed through data preprocessing and the topology modeling and fault identification rule generation modules. After multiple iterations, a correspondence between fault alarm ranges is generated, from which the alarm range with the highest confidence is obtained. Rule optimization is completed by manually adjusting the weights of the labeled data; The second verification method: Real-time data verification is used, by calculating the rule benefit index. BEI Alternatively, a rule evaluation matrix can be constructed and weighted to perform backtesting on the rules, ensuring that the rules meet production needs.

[0013] Preferably, the data preprocessing and topology modeling module constructs a multi-dimensional attribute graph. G =( V , E , A The specific implementation method is as follows: a data reading unit obtains basic resource data of network elements, devices, ports, optical cables, circuits, and links from the resource management system; a node creation unit uses each basic resource entity as a node in the topology graph. V It also adds device manufacturer and software version attribute information to nodes; edges are created and attribute-filled units, and the edges of the topology graph are determined based on the connection relationships between basic resource entities. E The system fills the edge attributes by adding latency and bandwidth utilization performance data; the alarm information injection and rendering unit obtains alarm information in real time, associates the alarm information with nodes or edges in the topology graph, and performs color depth rendering on the associated nodes or edges according to the alarm level.

[0014] Preferably, the specific implementation steps of generating a fault probability heatmap using dynamic graph analysis in the fault identification rule generation module are as follows: A fault propagation relationship definition unit, based on a fault diffusion model, analyzes the propagation path and influence range of the fault in the topology graph, and determines the nodes and edges that the fault may propagate to; a node index calculation unit calculates the contraction degree and proximity centrality index of each node, where the contraction degree reflects the node's convergence ability during fault propagation, and proximity centrality reflects the degree of the node's central position in the topology graph; a fault probability heatmap generation unit, combining node contraction degree and proximity centrality index, assigns a fault probability value to each node in the topology graph, and generates a fault probability heatmap based on the fault probability values.

[0015] Preferably, the specific implementation process of using a temporal Petri net to model alarm causal relationships and identify fault subgraphs in the fault identification rule generation module is as follows: A temporal Petri net model construction unit treats alarm events as transitions in the Petri net, and the temporal and causal relationships between alarm events as places and directed arcs in the Petri net; a spatial coupling degree definition unit defines the spatial coupling degree to measure the degree of correlation between alarm events in space; a fault subgraph identification unit traverses the Petri net model to find alarm ranges where the coupling degree meets a threshold, and identifies this range as a fault subgraph; a fault root cause acquisition unit uses graph centrality algorithms, such as degree centrality and betweenness centrality, to calculate the centrality index of each node in the fault subgraph, and obtains the root cause of the current aggregated fault based on the centrality index.

[0016] Preferably, the specific implementation steps for backtracking testing of rules using real-time data verification in the closed-loop self-learning optimization module are as follows: A real-time data collection unit collects data during system operation, including alarm information and basic resource data; a rule testing unit generates fault identification results using real-time data, following the methods of the data preprocessing and topology modeling module and the fault identification rule generation module; and a rule evaluation unit calculates the rule benefit index. BEI , BEI The calculation formula is BEI = (Total number of identified faults / Number of correctly identified faults) × 100%, or construct a rule evaluation matrix, where the elements of the matrix are the performance indicators of the rules in different scenarios, such as accuracy and recall, and calculate the weighted comprehensive score; The rule optimization unit, based on the rule benefit index BEI Alternatively, the weighted comprehensive score of the rule evaluation matrix can be used to evaluate and adjust the rules. If a rule does not meet production needs, it can be optimized until the rule meets the production requirements.

[0017] Compared with the prior art, the beneficial effects of the present invention are: The proposed algorithm-based event recognition rule self-learning method and system generates candidate rules through large-scale model reasoning, requiring experts to only review the rationality of the reasoning logic. It combines thought chain technology to simulate the expert reasoning path and uses a feedback mechanism for dynamic optimization. The model output is corrected in reverse through live network verification results, forming a self-intelligent process of rule generation-verification-iteration. It outputs positioning steps that conform to human logic, improving the trust of operation and maintenance personnel in automated rules. Attached Figure Description

[0018] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the present invention clear and complete, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only some, not all, embodiments of the present invention, and are merely illustrative of the embodiments of the present invention. They are not intended to limit the embodiments of the present invention. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Example 1, please refer to Figure 1 This invention provides a technical solution: an algorithm-based event recognition rule self-learning method, comprising the following steps: I. Data Preprocessing and Topology Modeling Stage Multi-source heterogeneous data fusion is used to construct a multi-dimensional attribute graph G=(V,E,A). The topology graph is created by reading basic resource data such as network elements, devices, ports, optical cables, circuits, and links from the resource management system. Nodes have attribute information, such as equipment manufacturers / software versions, and edge attributes are filled by adding performance data, such as latency / bandwidth utilization. Real-time alarm information is injected into the topology graph for dynamic rendering, and color depth rendering can be performed according to the alarm level.

[0021] The topology enhancement strategy uses spectral clustering to identify implicit connections, defines the probability of link existence, and fills in the missing links caused by incomplete resource data.

[0022] II. Fault Identification Rule Generation Stage The dynamic graph analysis method is adopted to define the propagation relationship of faults through a fault propagation model; a fault probability heatmap is generated by combining node shrinkage and proximity centrality to reconstruct the basic dynamic fault topology.

[0023] A temporal Petri net is used to model the causal relationship of alarms and the coupling degree of the space is defined. The alarm range that meets the coupling degree threshold is identified as the fault subgraph. The root cause of the current aggregated fault is obtained through the graph centrality algorithm, thereby generating a set of alarm data and the root cause information of the fault.

[0024] III. Closed-loop self-learning optimization stage A two-dimensional verification mechanism is adopted to improve the credibility of the rules; The first method analyzes historical fault records using the above method, generates a fault alarm range correspondence after multiple iterations, obtains the alarm range with the highest confidence, and completes rule optimization by manually adjusting the weight of the labeled data.

[0025] The second approach uses real-time data verification, calculating the Rule Effectiveness Index (BEI) or constructing a rule evaluation matrix to calculate weighted averages. Backtracking tests are then performed on the rules to ensure they ultimately meet production needs.

[0026] Example 2, based on Example 1, proposes a system for a self-learning method of event recognition rules based on an algorithm, including: Data preprocessing and topology modeling module: used to fuse multi-source heterogeneous data and construct multi-dimensional attribute graphs. G =( V , E , A This module reads basic resource data on network elements, devices, ports, optical cables, circuits, and links from the resource management system to create a topology map, where nodes... V It contains attribute information, including device manufacturer and software version; E The attributes are populated by adding performance data, which includes latency and bandwidth utilization; real-time alarm information is injected into the topology graph and dynamically rendered, distinguished by color depth according to alarm level; topology enhancement strategies are implemented using spectral clustering algorithms to identify hidden connections, define the probability of link existence, and supplement missing links caused by incomplete resource data; and a multi-dimensional attribute graph is constructed. G =( V , E , A The specific implementation method is as follows: a data reading unit obtains basic resource data of network elements, devices, ports, optical cables, circuits, and links from the resource management system; a node creation unit uses each basic resource entity as a node in the topology graph. V It also adds device manufacturer and software version attribute information to nodes; edges are created and attribute-filled units, and the edges of the topology graph are determined based on the connection relationships between basic resource entities. E The system fills the edge attributes by adding latency and bandwidth utilization performance data; the alarm information injection and rendering unit obtains alarm information in real time, associates the alarm information with nodes or edges in the topology graph, and performs color depth rendering on the associated nodes or edges according to the alarm level.

[0027] The fault identification rule generation module is used to define the propagation relationship of faults using dynamic graph analysis and a fault propagation model; it generates a fault probability heatmap by combining node shrinkage and proximity centrality, reconstructing the basic dynamic fault topology; it uses a time-based Petri net to model alarm causal relationships and define spatial coupling, identifying alarm ranges with coupling that meet a threshold as fault subgraphs, obtaining the root cause of the current aggregated fault through a graph centrality algorithm, and generating a set of alarm data and root cause information. The specific implementation steps for generating the fault probability heatmap using dynamic graph analysis are as follows: A fault propagation relationship definition unit analyzes the propagation path and impact range of the fault in the topology based on the fault propagation model, determining the nodes and edges that the fault may propagate to; a node index calculation unit calculates the shrinkage and proximity centrality indices of each node, where shrinkage reflects the node's convergence ability during fault propagation, and proximity centrality reflects the node's central position in the topology; a fault probability heatmap generation unit combines node shrinkage and proximity centrality indices to assign a fault probability value to each node in the topology and generates a fault probability heatmap based on the fault probability values.

[0028] The specific implementation process of using temporal Petri nets to model alarm causal relationships and identify fault subgraphs in the fault identification rule generation module is as follows: The temporal Petri net model construction unit treats alarm events as transitions in the Petri net, and the temporal and causal relationships between alarm events as places and directed arcs in the Petri net; the spatial coupling degree definition unit defines the spatial coupling degree to measure the degree of correlation between alarm events in space; the fault subgraph identification unit traverses the Petri net model, finds alarm ranges whose coupling degree meets the threshold, and identifies this range as a fault subgraph; the fault root cause acquisition unit uses graph centrality algorithms, such as degree centrality and betweenness centrality, to calculate the centrality index of each node in the fault subgraph, and obtains the root cause of the current aggregated fault based on the centrality index.

[0029] Closed-loop self-learning optimization module: Used to improve rule credibility using a two-dimensional verification mechanism; The first verification method: Historical fault records are analyzed through data preprocessing and the topology modeling and fault identification rule generation modules. After multiple iterations, a correspondence between fault alarm ranges is generated, from which the alarm range with the highest confidence is obtained. Rule optimization is completed by manually adjusting the weights of the labeled data; The second verification method: Real-time data verification is used, by calculating the rule benefit index. BEI Alternatively, a rule evaluation matrix can be constructed and weighted to perform backtesting on the rules, ensuring that the rules meet production needs.

[0030] The specific implementation steps for backtracking testing of rules using real-time data verification are as follows: A real-time data collection unit collects data during system operation, including alarm information and basic resource data; a rule testing unit generates fault identification results using real-time data, following the methods of the data preprocessing and topology modeling module and the fault identification rule generation module; and a rule evaluation unit calculates the rule benefit index. BEI , BEI The calculation formula is BEI =(Total number of identified faults / Number of correctly identified faults) × 100%, or construct a rule evaluation matrix, where the elements of the matrix are the performance indicators of the rules in different scenarios, such as accuracy and recall, and calculate the weighted comprehensive score; the rule optimization unit, based on the rule benefit index... BEI Alternatively, the weighted comprehensive score of the rule evaluation matrix can be used to evaluate and adjust the rules. If a rule does not meet production needs, it can be optimized until the rule meets the production requirements.

[0031] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A self-learning method for event recognition rules based on algorithms, characterized in that: Includes the following steps: Data preprocessing and topology modeling specifically include: fusing multi-source heterogeneous data and constructing multi-dimensional attribute graphs. G =( V , E , A The process involves creating a topology map by reading basic resource data on network elements, devices, ports, optical cables, circuits, and links from the resource management system. Node V has attribute information, including device manufacturer and software version. The attributes of edge E are filled with performance data, including latency and bandwidth utilization. Real-time alarm information is injected into the topology map for dynamic rendering, and alarm levels are distinguished by color depth. A spectral clustering algorithm is used to implement a topology enhancement strategy, identify implicit connections, and define the probability of link existence to fill in missing links caused by incomplete resource data. The specific steps for generating fault identification rules include: using dynamic graph analysis to define the propagation relationship of faults with the help of a fault propagation model; generating a fault probability heatmap by combining node shrinkage and proximity centrality to reconstruct the basic fault dynamic topology; modeling alarm causal relationships using a time-based Petri net and defining spatial coupling degree; identifying alarm ranges with coupling degree meeting the threshold as fault subgraphs; obtaining the root cause of the current aggregated fault through a graph centrality algorithm; and generating a set of alarm data and fault root cause information. Closed-loop self-learning optimization specifically includes: employing a dual-dimensional verification mechanism to improve rule credibility; including the first verification method: analyzing historical fault records according to the aforementioned data preprocessing, topology modeling, and fault identification rule generation methods, generating fault alarm range correspondences through multiple iterations, obtaining the alarm range with the highest confidence, and completing rule optimization by manually adjusting the weights of the labeled data; and the second verification method: employing real-time data verification by calculating the rule benefit index. BEI Alternatively, a rule evaluation matrix can be constructed and weighted, and the rules can be backtested to ensure that they meet production requirements; In the fault identification rule generation stage, the specific steps for generating a fault probability heatmap using dynamic graph analysis are as follows: Based on the fault propagation model, analyze the propagation path and impact range of the fault in the topology graph, and determine the nodes and edges that the fault may propagate to; calculate the contraction degree and proximity centrality index of each node. The contraction degree reflects the node's convergence ability during the fault propagation process, and the proximity centrality reflects the degree of the node's central position in the topology graph; combine the node contraction degree and proximity centrality index to assign a fault probability value to each node in the topology graph, and generate a fault probability heatmap based on the fault probability values ​​to intuitively display the probability distribution of fault occurrence.

2. The algorithm-based event recognition rule self-learning method according to claim 1, characterized in that: In the data preprocessing and topology modeling stages, a multi-dimensional attribute graph is constructed. G =( V , E , A The specific process is as follows: Retrieve basic resource data for network elements, devices, ports, optical cables, circuits, and links from the resource management system, and treat each basic resource entity as a node in the topology graph. V The node attribute information includes the device manufacturer and software version; The edges of the topology graph are determined based on the connectivity relationships between basic resource entities. E The attributes of the edges are populated by adding performance data, which includes, but is not limited to, latency and bandwidth utilization. Real-time acquisition of alarm information, association of alarm information with nodes or edges in the topology graph, and color depth rendering of associated nodes or edges according to alarm level to intuitively display alarm status.

3. The algorithm-based event recognition rule self-learning method according to claim 2, characterized in that: In the fault identification rule generation stage, the specific process of using a time Petri net to model alarm causal relationships and identify fault subgraphs is as follows: construct a time Petri net model, take alarm events as transitions in the Petri net, and take the temporal and causal relationships between alarm events as places and directed arcs in the Petri net; Define the coupling degree of the space to measure the degree of correlation between alarm events in the space; traverse the Petri net model to find the alarm range where the coupling degree meets the threshold, and identify the range as the fault subgraph; use the graph centrality algorithm to calculate the centrality index of each node in the fault subgraph, and obtain the root cause of the current aggregated fault based on the centrality index.

4. The algorithm-based event recognition rule self-learning method according to claim 3, characterized in that: In the closed-loop self-learning optimization phase, the specific steps for backtracking the rules using real-time data verification are as follows: collect data during system operation in real time, including alarm information and basic resource data; generate fault identification results using real-time data according to the above-mentioned data preprocessing, topology modeling, and fault identification rule generation methods. Calculate the rule benefit index BEI , BEI The calculation formula is: BEI =(Total number of identified faults / Number of correctly identified faults) × 100%, or construct a rule evaluation matrix, where the elements of the matrix are the performance indicators of the rules in different scenarios, and calculate the weighted comprehensive score; based on the rule benefit index BEI Alternatively, the weighted comprehensive score of the rule evaluation matrix can be used to evaluate and adjust the rules. If a rule does not meet production needs, it can be optimized until the rule meets the production requirements.

5. A system for a self-learning method of event recognition rules based on an algorithm according to claim 4, characterized in that: include: Data preprocessing and topology modeling module: used to fuse multi-source heterogeneous data and construct multi-dimensional attribute graphs. G =( V , E , A This module reads basic resource data on network elements, devices, ports, optical cables, circuits, and links from the resource management system to create a topology map, where nodes... V It contains attribute information, including device manufacturer and software version; E The attributes are populated by adding performance data, which includes latency and bandwidth utilization. Used to inject real-time alarm information into the topology graph and render it dynamically, displaying it by color depth according to the alarm level; This is used to implement topology enhancement strategies using spectral clustering algorithms, identify implicit connections, define the probability of link existence, and supplement missing links caused by incomplete resource data. Fault identification rule generation module: used to define the propagation relationship of faults using dynamic graph analysis and fault propagation model; By combining node shrinkage and proximity centrality, a fault probability heatmap is generated, and the basic fault dynamic topology is reconstructed. This is used to model alarm causal relationships using temporal Petri nets and define the spatial coupling degree. Alarm ranges with coupling degrees meeting the threshold are identified as fault subgraphs. The root cause of the current aggregated fault is obtained through a graph centrality algorithm, generating a set of alarm data and fault root cause information. Closed-loop self-learning optimization module: Used to improve the credibility of rules by adopting a two-dimensional verification mechanism, including the first verification method: Historical fault records are analyzed by data preprocessing and topology modeling module and fault identification rule generation module. After multiple iterations, the corresponding relationship of fault alarm range is generated, and the alarm range with the highest confidence is obtained. Rule optimization is completed by manually correcting the weight of the labeled data. The second verification method: using real-time data verification, by calculating the rule benefit index. BEI Alternatively, a rule evaluation matrix can be constructed and weighted to perform backtesting on the rules, ensuring that the rules meet production needs.

6. The system according to claim 5, characterized in that: Building multi-dimensional attribute graphs in the data preprocessing and topology modeling module G =( V , E , A The specific implementation method is as follows: the data reading unit obtains basic resource data of network elements, devices, ports, optical cables, circuits, and links from the resource management system; The node creation unit treats each basic resource entity as a node in the topology graph. V It also adds device manufacturer and software version attribute information to nodes; edges are created and attribute-filled units, and the edges of the topology graph are determined based on the connection relationships between basic resource entities. E The system fills the edge attributes by adding latency and bandwidth utilization performance data; the alarm information injection and rendering unit obtains alarm information in real time, associates the alarm information with nodes or edges in the topology graph, and performs color depth rendering on the associated nodes or edges according to the alarm level.

7. The system according to claim 6, characterized in that: The specific implementation steps of generating a fault probability heatmap using dynamic graph analysis in the fault identification rule generation module are as follows: Fault propagation relationship definition unit, based on the fault diffusion model, analyzes the propagation path and influence range of the fault in the topology graph, and determines the nodes and edges that the fault may propagate to; Node index calculation unit, calculates the shrinkage degree and proximity centrality index of each node, where the shrinkage degree reflects the node's convergence ability in the fault propagation process, and the proximity centrality reflects the degree of the node's central position in the topology graph; The fault probability heatmap generation unit combines node shrinkage and proximity centrality indices to assign a fault probability value to each node in the topology graph and generates a fault probability heatmap based on the fault probability value.

8. The system according to claim 7, characterized in that: The specific implementation process of using time Petri nets to model alarm causal relationships and identify fault subgraphs in the fault identification rule generation module is as follows: the time Petri net model construction unit takes alarm events as transitions in the Petri net, and the temporal and causal relationships between alarm events as places and directed arcs in the Petri net; The spatial coupling degree definition unit is used to define the spatial coupling degree to measure the degree of correlation between alarm events in space; the fault subgraph identification unit traverses the Petri net model to find the alarm range where the coupling degree meets the threshold and identifies the range as the fault subgraph; the fault root cause acquisition unit uses the graph centrality algorithm to calculate the centrality index of each node in the fault subgraph and obtains the root cause of the current aggregated fault based on the centrality index.

9. A system according to claim 8, characterized in that: The specific implementation steps of using real-time data verification to backtrack the rules in the closed-loop self-learning optimization module are as follows: Real-time data collection unit, which collects data during system operation in real time, including alarm information and basic resource data; The rule testing unit generates fault identification results using real-time data, following the methods of the data preprocessing and topology modeling module and the fault identification rule generation module. The rule evaluation unit calculates the rule effectiveness index. BEI , BEI The calculation formula is: BEI = (Total number of identified faults / Number of correctly identified faults) × 100%, or construct a rule evaluation matrix, where the elements of the matrix are the performance indicators of the rules in different scenarios, and calculate the weighted comprehensive score; The rule optimization unit, based on the rule benefit index BEI Alternatively, the weighted comprehensive score of the rule evaluation matrix can be used to evaluate and adjust the rules. If a rule does not meet production needs, it can be optimized until the rule meets the production requirements.

Images