Information processing method, computing device, storage medium and computer program product

Abstract

The embodiment of the invention provides an information processing method, computing equipment, a storage medium and a computer program product, and the information processing method comprises the steps: responding to alarm information of to-be-detected equipment, and determining an initial network change event corresponding to the occurrence time according to the occurrence time of the alarm information and a preset event determination rule; determining a correlation degree between the initial network change event and the alarm information according to a plurality of correlation dimensions; and when it is determined that the association degree meets an association degree threshold, sending the alarm information to a target device, so that the target device processes the alarm information. According to the embodiment of the invention, the correlation between the initial network change event and the alarm information is determined through correlation analysis, so that whether the alarm information is caused by the initial network change event or not can be judged according to the correlation, and a plurality of correlation dimensions are used during correlation analysis, so that the accuracy of the obtained correlation degree is further improved.

Description

Technical Field

[0001] The embodiments in this specification relate to the field of computer technology, and in particular to information processing methods, computing devices, storage media, and computer program products. Background Technology

[0002] Network changes refer to modifications or adjustments to network structure, equipment, configuration, or functionality. These typically include adding, replacing, or upgrading hardware, updating or patching software, adjusting network configurations, and optimizing network architecture to improve network performance and security. However, as networks grow in scale and complexity, network monitoring systems generate an increasing number of alarms after network changes. Many of these alarms are unrelated to the changes, requiring network administrators to spend significant time identifying them and hindering timely anomaly detection. This further impacts anomaly handling efficiency and the normal operation of network equipment or systems. Therefore, an effective technical solution is urgently needed to address these issues. Summary of the Invention

[0003] In view of the above, embodiments of this specification provide an information processing method. One or more embodiments of this specification also relate to an information processing apparatus, a computing device, a computer-readable storage medium, and a computer program product, to address the technical deficiencies existing in the prior art.

[0004] According to a first aspect of the embodiments of this specification, an information processing method is provided, comprising:

[0005] In response to an alarm message from the device under test, the initial network change event corresponding to the alarm message occurrence time is determined based on the occurrence time of the alarm message and a preset event determination rule.

[0006] The degree of correlation between the initial network change event and the alarm information is determined based on multiple correlation dimensions;

[0007] If the correlation degree is determined to meet the correlation degree threshold, the alarm information is sent to the target device so that the target device can process the alarm information.

[0008] According to a second aspect of the embodiments of this specification, an information processing apparatus is provided, comprising:

[0009] The first determining module is configured to respond to alarm information from the device under test and determine the initial network change event corresponding to the occurrence time based on the occurrence time of the alarm information and preset event determining rules.

[0010] The second determining module is configured to determine the degree of correlation between the initial network change event and the alarm information based on multiple correlation dimensions;

[0011] The sending module is configured to send the alarm information to the target device when it is determined that the correlation degree meets the correlation degree threshold, so that the target device can process the alarm information.

[0012] According to a third aspect of the embodiments of this specification, a computing device is provided, comprising:

[0013] Memory and processor;

[0014] The memory is used to store computer programs / instructions, and the processor is used to execute the computer programs / instructions, which, when executed by the processor, implement the steps of the above-described information processing method.

[0015] According to a fourth aspect of the embodiments of this specification, a computer-readable storage medium is provided that stores a computer program / instructions that, when executed by a processor, implement the steps of the information processing method described above.

[0016] According to a fifth aspect of the embodiments of this specification, a computer program product is provided, including a computer program / instructions that, when executed by a processor, implement the steps of the information processing method described above.

[0017] One embodiment of this specification provides an information processing method, comprising: responding to an alarm message from a device under test; determining an initial network change event corresponding to the occurrence time of the alarm message based on the occurrence time of the alarm message and a preset event determination rule; determining the degree of correlation between the initial network change event and the alarm message based on multiple correlation dimensions; and, if the degree of correlation is determined to meet a correlation threshold, sending the alarm message to a target device so that the target device processes the alarm message.

[0018] In the above method, in response to an alarm message from the device under test, the initial network change event corresponding to the alarm message's occurrence time is determined based on the alarm message's occurrence time and preset event determination rules. The correlation between the initial network change event and the alarm message is then determined based on multiple correlation dimensions. Correlation analysis is used to determine the correlation between the initial network change event and the alarm message, allowing for the judgment of whether the alarm message was caused by the initial network change event. Furthermore, multiple correlation dimensions are used in the correlation analysis to further improve the accuracy of the obtained correlation degree. If the correlation degree meets a correlation degree threshold, a high correlation is determined between the alarm message and the initial network change event, indicating a high probability that the alarm message was caused by the initial network change event. In this case, the alarm message can be sent to the target device for processing. This achieves the filtering and noise reduction of alarm messages from the device under test, ensuring that the alarm messages sent to the target device are filtered and highly correlated with network changes. This enables targeted detection of alarm anomalies, further ensuring anomaly handling efficiency and guaranteeing the normal operation of the device under test. Attached Figure Description

[0019] Figure 1 This is a schematic diagram illustrating an application scenario of an information processing method provided in one embodiment of this specification;

[0020] Figure 2 This is a flowchart illustrating an information processing method provided in one embodiment of this specification;

[0021] Figure 3 This is a schematic diagram of spatial dimension division in an information processing method provided in one embodiment of this specification;

[0022] Figure 4 This is a flowchart of the time correlation analysis process in an information processing method provided in one embodiment of this specification;

[0023] Figure 5 This is a flowchart of the spatial correlation analysis process in an information processing method provided in one embodiment of this specification;

[0024] Figure 6 This is a flowchart of the feature correlation analysis process in an information processing method provided in one embodiment of this specification;

[0025] Figure 7 This is a schematic diagram of the structure of an information processing device provided in one embodiment of this specification;

[0026] Figure 8 This is a structural block diagram of a computing device provided in one embodiment of this specification. Detailed Implementation

[0027] Many specific details are set forth in the following description to provide a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar extensions without departing from the spirit of this specification. Therefore, this specification is not limited to the specific implementations disclosed below.

[0028] The terminology used in one or more embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to be limiting of the one or more embodiments of this specification. The singular forms “a,” “described,” and “the” as used in one or more embodiments of this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0029] It should be understood that although the terms first, second, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first may also be referred to as second without departing from the scope of one or more embodiments of this specification, and similarly, second may also be referred to as first. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0030] Furthermore, it should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties. Moreover, the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0031] First, the terms and concepts used in one or more embodiments of this specification will be explained.

[0032] Network changes: Adding, modifying, or deleting any actions that may have a direct or indirect impact on the network's operational status.

[0033] Alarm event: A notification generated when the network itself or a managed object detects an anomaly.

[0034] Alarm delay: The time elapsed from the actual occurrence of the alarm event to the appearance of the alarm notification.

[0035] IDC: Internet Data Center, refers to a facility with complete equipment (including high-speed Internet access bandwidth, high-performance local area network, secure and reliable computer room environment, etc.), professional management, and a complete application service platform.

[0036] Pod dimension: The smallest unit deployed in a cluster, containing multiple containers (a collection of containers).

[0037] This specification provides an information processing method, and also relates to an information processing apparatus, a computing device, and a computer-readable storage medium, which will be described in detail in the following embodiments.

[0038] See Figure 1 , Figure 1 A schematic diagram illustrating an application scenario of an information processing method provided according to an embodiment of this specification is shown.

[0039] Figure 1 It includes a device under test 102 and a network monitoring server 104, wherein the network monitoring server 104 is used to detect network changes and alarm information of the device under test.

[0040] In practice, when the network monitoring server 104 detects an alarm message from the device under test 102, it determines the occurrence time of the alarm message and, based on the occurrence time and preset event determination rules, identifies the initial network change event corresponding to that occurrence time. Based on multiple correlation dimensions, it determines the degree of correlation between the initial network change event and the alarm message. If the degree of correlation is greater than a correlation threshold, it indicates a high probability that the alarm message was caused by the initial network change event. The alarm message is then pushed to the target device of the maintenance personnel for processing. This process achieves noise reduction and filtering of alarm messages from the device under test 102.

[0041] See Figure 2 , Figure 2 A flowchart of an information processing method according to an embodiment of this specification is shown, which specifically includes the following steps.

[0042] Step 202: In response to the alarm information of the device under test, determine the initial network change event corresponding to the occurrence time according to the occurrence time of the alarm information and the preset event determination rules.

[0043] In this context, "device under test" can be understood as the network device or system that needs to be tested. For example, it could be an enterprise system within a company, or all network devices and systems within a company's server room. "Alarm information" can be understood as alarm events generated by the device under test due to changes. "Preset event determination rules" can be understood as rules for obtaining network change events from the time window corresponding to the occurrence time of the alarm information.

[0044] Based on this, in response to alarm information generated by the device under test due to changes, the occurrence time of the alarm information can be determined, and according to the preset event determination rules, the time window corresponding to the occurrence time of the alarm information can be determined. The network change event can be obtained from the time window, and the network change event obtained from the time window can be determined as the initial network change event corresponding to the occurrence time.

[0045] In practice, network changes, whether physical or protocol-based, are accompanied by the issuance of network change commands. Typically, most failures caused by historical physical network changes are related to the issuance of these commands. Based on this, network change commands existing within a time window can be identified, and the network change event corresponding to that command can be determined as the initial network change event for that time period. These network change commands can be understood as CLI configuration commands (Command-Line Interface).

[0046] Further, determining the initial network change event corresponding to the occurrence time based on the occurrence time of the alarm information and preset event determination rules includes:

[0047] Based on the occurrence time of the alarm information, determine the first time window corresponding to the occurrence time;

[0048] If it is determined that a network change instruction exists within the first time window, and the network change event corresponding to the network change instruction is determined, the network change event is determined as the initial network change event corresponding to the occurrence time.

[0049] If it is determined that there is no network change instruction within the first time window, the first time window is adjusted to obtain a second time window, wherein the second time window is larger than the first time window.

[0050] If it is determined that a network change instruction exists within the second time window, and the network change event corresponding to the network change instruction is determined, the network change event is determined as the initial network change event corresponding to the occurrence time.

[0051] Specifically, the time window can include a first time window and a second time window, where the second time window can be longer than the first time window. When determining the initial network change event corresponding to the alarm's occurrence time based on the alarm's occurrence time and preset event determination rules, a first time window can be determined based on the alarm's occurrence time. If a network change command exists within this first time window, the network change event corresponding to that command is determined and designated as the initial network change event corresponding to the occurrence time. If no network change event exists within the first time window, the first time window is adjusted to obtain a second time window. If a network change command exists within this second time window, the network change event corresponding to that command is determined and designated as the initial network change event corresponding to the occurrence time. For example, if the alarm's occurrence time is 12:00, then the first time window determined based on this time could be from 11:59 to 12:01, and the second time window could be from 11:58 to 12:02.

[0052] For example, in the first time window there are network change commands 1, 2, 3 and 4, where network change commands 1, 2 and 3 correspond to initial network change event 1, and network change command 3 corresponds to initial network change event 2.

[0053] In one embodiment of this specification, since CLI read events do not involve configuration changes, and uncommitted command configuration transactions are not actually executed, in order to filter read events and uncommitted command events, a command sequence within a time window can be obtained, and a triplet for each network change instruction (and device command) can be obtained. This triplet may include the device command, the change described in the command, and the specific time of command execution.

[0054] In summary, by setting multiple time windows, the determination of the initial network change event is ensured, which facilitates the subsequent identification of which initial network change event caused the alarm information, and further achieves noise reduction of the alarm information.

[0055] Step 204: Determine the degree of correlation between the initial network change event and the alarm information based on multiple correlation dimensions.

[0056] In specific implementation, determining the degree of correlation between the initial network change event and the alarm information based on multiple correlation dimensions includes:

[0057] Based on the time correlation dimension, determine the probability of time correlation between the initial network change event and the alarm information; and / or

[0058] Based on the spatial correlation dimension, determine the spatial correlation probability between the initial network change event and the alarm information; and / or

[0059] Based on the feature correlation dimension, determine the feature correlation probability between the initial network change event and the alarm information;

[0060] The degree of correlation between the initial network change event and the alarm information is determined based on the time correlation probability and / or the spatial correlation probability and / or the feature correlation probability.

[0061] Among them, the time correlation dimension can be understood as the correlation dimension between the initial network change event and the alarm information in time; the spatial correlation dimension can be understood as the correlation dimension between the initial network change event and the alarm information in space; and the feature correlation dimension can be understood as the correlation dimension between the initial network change event and the alarm information in historical data features.

[0062] In one embodiment of this specification, the degree of correlation between an initial network change event and an alarm message can be determined based on one of the correlation dimensions. For example, the temporal correlation probability between the initial network change event and the alarm message can be determined solely based on the temporal correlation dimension, and the degree of correlation between the initial network change event and the alarm message can be determined based on the temporal correlation probability. Alternatively, the spatial correlation probability between the initial network change event and the alarm message can be determined solely based on the spatial correlation dimension, and the degree of correlation between the initial network change event and the alarm message can be determined based on the spatial correlation probability. Or, the feature correlation probability between the initial network change event and the alarm message can be determined solely based on the feature correlation dimension, and the degree of correlation between the initial network change event and the alarm message can be determined based on the feature correlation probability.

[0063] In another embodiment of this specification, the degree of correlation between the initial network change event and the alarm information can be determined based on two correlation dimensions. For example, the temporal correlation probability and spatial correlation probability between the initial network change event and the alarm information can be determined based on the temporal correlation probability and spatial correlation probability, and the degree of correlation between the initial network change event and the alarm information can be determined based on the temporal correlation probability and spatial correlation probability.

[0064] In another embodiment of this specification, the degree of correlation between the initial network change event and the alarm information can be determined based on three correlation dimensions. Specifically, the temporal correlation probability, spatial correlation probability, and feature correlation probability between the initial network change event and the alarm information can be determined based on the temporal correlation probability, spatial correlation probability, and feature correlation probability, and the degree of correlation between the initial network change event and the alarm information can be determined based on the temporal correlation probability, spatial correlation probability, and feature correlation probability.

[0065] In specific implementation, determining the time correlation probability between the initial network change event and the alarm information based on the time correlation dimension includes:

[0066] A time correlation algorithm is determined based on a preset time correlation rule, wherein the preset time correlation rule is the correlation rule between the occurrence time of the alarm information and the initial network change event;

[0067] The temporal correlation probability between the initial network change event and the alarm information is calculated based on the time correlation algorithm.

[0068] The preset time correlation rules include: 1. After excluding alarm delay, the closer the time of issuing the network change command is to the time of the alarm information occurrence, the higher the correlation between the initial network change event to which the network change command belongs and the alarm information; 2. The fewer initial network change events within the first time window, the higher the correlation between the alarm information and each initial network change event; 3. The size of the first time window is set according to actual needs. The larger the first time window, the higher the tolerance between the initial network change event and the alarm information. Based on this, the time correlation between the initial network change event and the alarm information can be determined to satisfy the following function curve: y = x k k = 2, where y is the alarm information and x is the initial network change event.

[0069] In summary, by performing the most granular matching along the time dimension and identifying each command sent to network devices or systems, a large number of change commands and time periods without change operations in the change window were filtered out.

[0070] Furthermore, the time correlation algorithm includes a first time correlation algorithm and a second time correlation algorithm;

[0071] The step of calculating the time correlation probability between the initial network change event and the alarm information according to the time correlation algorithm includes:

[0072] If it is determined that a network change instruction exists within the first time window, the first time correlation probability between the network change instruction and the alarm information is calculated according to the first time correlation algorithm.

[0073] Based on the first temporal correlation probability between the network change instruction and the alarm information, determine the temporal correlation probability between the initial network change event and the alarm information; or

[0074] If it is determined that a network change instruction exists within the second time window, the second time correlation probability between the network change instruction and the alarm information is calculated according to the second time correlation algorithm.

[0075] The temporal correlation probability between the initial network change event and the alarm information is determined based on the second temporal correlation probability between the network change instruction and the alarm information.

[0076] In practical applications, when a network change instruction exists within the first time window, the first-time correlation algorithm is as follows:

[0077]

[0078]

[0079] p2 = p0 + (t - t0) / w * (1 - p0)

[0080] p2 = p0 + (t - t0) / w * (1 - p0)

[0081] p = max(p2, p2)

[0082] Where t is the occurrence time of the alarm message, ti is the issuance time of the i-th network change command, and p0 is a constant term of probability. P is the time correlation probability between each network change command and the alarm message. di is the time correlation of each network change command, and d represents each di.

[0083] Based on this, when a network change instruction exists within the first time window, the first time correlation probability between the network change instruction and the alarm information can be calculated according to the first time correlation algorithm, thereby calculating the time correlation probability between the initial network change event to which the network change instruction belongs and the alarm information.

[0084] Following the previous example, based on the aforementioned first-time correlation algorithm, the first-time correlation probabilities between network change commands 1, 2, 3, and 4 and the alarm information can be calculated respectively. The maximum value among the first-time correlation probabilities between network change commands 1, 2, and 3 and the alarm information can be used as the time correlation probability between the initial network change event 1 corresponding to network change command 1, 2, and 3 and the alarm information. Therefore, the first-time correlation probability between network change command 4 and the alarm information can be used as the correlation probability between the initial network change event 2 corresponding to network change command 4 and the alarm information.

[0085] When there is no network change instruction within the first time window but there is a network change instruction within the second time window, the second time correlation probability between the network change instruction and the alarm information can be calculated using the second time correlation algorithm. This allows us to calculate the time correlation probability between the initial network change event to which the network change instruction belongs and the alarm time. The second time correlation algorithm is as follows:

[0086] ω=(tt i ) / r

[0087]

[0088] Where k equals 2, w can be used to represent the second time window, and r can be used to represent the number of values ​​in the second time window.

[0089] Based on this, when there is no network change instruction in the first time window and there is a network change instruction in the second time window, the second time correlation probability between the network change instruction and the alarm information can be calculated according to the second time correlation algorithm, thereby calculating the time correlation probability between the initial network change event to which the network change instruction belongs and the alarm information. The specific process is similar to that described above.

[0090] In summary, by calculating the temporal correlation probability between the initial network change event and the alarm information, we can analyze the smallest granularity of the change execution action, discover the temporal correlation between alarms and changes, and facilitate the subsequent determination of the degree of correlation between the initial network change event and the alarm information.

[0091] In specific implementation, determining the spatial correlation probability between the initial network change event and the alarm information based on the spatial correlation dimension includes:

[0092] From multiple spatial dimensions, determine the event spatial dimension corresponding to the initial network change event, and determine the alarm spatial dimension corresponding to the alarm information;

[0093] Based on the event space dimension and the alarm space dimension, determine the spatial correlation probability between the initial network change event and the alarm information.

[0094] Spatial correlation can help uncover implicit relationships between network devices. By analyzing the spatial correlation of alarms, the dependencies and impact paths between network devices can be revealed. For example, when one network device fails or malfunctions, other related devices may also be affected. Understanding the spatial correlation between network devices allows for better identification and resolution of network problems, thereby improving network reliability and stability. See also Figure 3 , Figure 3 A schematic diagram illustrating the spatial dimension division in an information processing method according to an embodiment of this specification is shown. Figure 3 As shown, spatial dimensions can be divided in ascending order as device spatial dimension, device group spatial dimension, POD spatial dimension, cluster spatial dimension, logical data center spatial dimension, data center spatial dimension, city / region spatial dimension, domestic / international spatial dimension, and global spatial dimension. These multiple spatial dimensions can be understood as pre-defined spatial dimensions. The event spatial dimension corresponding to the initial network change event can be understood as the spatial dimension in which the initial network change event occurred, and the alarm spatial dimension corresponding to the alarm information can be understood as the spatial dimension in which the alarm information occurred. For example, if the event spatial dimension corresponding to the initial network change event is the device spatial dimension, it means that the initial network change event occurred in the device spatial dimension.

[0095] Based on this, the event space dimension where the initial network change event occurs and the alarm space dimension where the alarm information occurs can be determined from the pre-divided multiple spatial dimensions. Then, the spatial correlation probability between the initial network change event and the alarm information can be determined based on the event space dimension and the alarm space dimension.

[0096] In summary, by dividing the spatial dimensions and performing the smallest-granularity matching of the spatial dimensions, spatial matching is guaranteed, and the spatial correlation probability of initial network change events and alarm information can be determined.

[0097] In specific implementation, determining the spatial correlation probability between the initial network change event and the alarm information based on the event space dimension and the alarm space dimension includes:

[0098] If the initial network change event is determined to be a first event type, the spatial correlation algorithm is used to match the event spatial dimension and the alarm spatial dimension to obtain the spatial correlation probability between the initial network change event and the alarm information; or

[0099] If the initial network change event is determined to be a second event type, the associated device of the network change device corresponding to the initial network change event is determined, and the associated device and the alarm spatial dimension are matched to obtain the spatial correlation probability between the initial network change event and the alarm information.

[0100] The initial network change event is classified as the first event type, which can be understood as having an IDC (Internet Data Center) role. The initial network change event is also classified as the second time type, which can be understood as having a core network role. Associated devices can be understood as changing devices; these devices can be those to which the initial network change event occurred, and they can belong to a device group or cluster. The spatial correlation algorithm is as follows:

[0101]

[0102]

[0103] Where n is the ranking of the spatial dimensions of the match from smallest to largest, dw is the minimum dimension of the alarm, N can represent the total spatial dimension, and x represents the integral variable.

[0104] Specifically, the spatial correlation algorithm described above can be used to match the event spatial dimension and the alarm spatial dimension to obtain the spatial correlation probability between the initial network change event and the alarm information.

[0105] Alternatively, if the role type of the initial network change event is determined to be a core network role, the neighboring devices of the changing device are determined according to the extended topology, and each neighboring device is matched with the alarm spatial dimension to obtain the spatial correlation probability between the initial network change event and the alarm information.

[0106] In practical applications, for the IDC role, alarm spatial dimensions and event spatial dimensions can be matched. The spatial correlation algorithm described above maps probabilities from smallest to largest to different spatial dimensions. When the minimum alarm dimension matches, the alarm is considered valid, and the spatial probability under the current alarm dimension needs to be added. When the minimum alarm dimension does not match, matching is usually required to a higher dimension, at which point the probability value of the lower dimension will be lost. For the core network role, since it connects to different data centers or region exits, and alarm information does not probabilistically affect the information of this device dimension, but rather uses its transitivity to affect devices in surrounding data centers and cities, to ensure no alarms are missed, the cause of the network device's transitivity is triggered, and the correlation between changes and alarms is discovered through its physical topology and protocol topology. Specifically, adjacent physical topology neighbor devices and protocol topology neighbor devices of the changed device can be selected and added to the device set. Each device in the neighbor device is matched with the alarm information in terms of dimension, and the value with the highest confidence is used as the initial spatial correlation probability between the network change event and the alarm information.

[0107] In summary, by using correlation analysis methods and employing correlation algorithms to approximate the causal relationship between change operations and alarm categories, invalid alarms are significantly reduced, improving change efficiency. Furthermore, considering both alarm dimensions and the dimensions of the changing devices, roles are defined, and algorithms are designed based on the spatial characteristics and transmission properties of different roles. Both physical and protocol topologies are used to evaluate spatial relevance, ensuring no spatial omissions.

[0108] In practice, since highly correlated alarms are usually expected, these alarms should also be filtered and noise-reduced. Alarms that are unexpected (high outlier) should be prioritized for display to further improve alarm efficiency and enhance the change management experience. The specific implementation method is as follows:

[0109] Determining the feature correlation probability between the initial network change event and the alarm information based on the feature correlation dimension includes:

[0110] Determine the network change steps included in the initial network change event, and determine the alarm category of the alarm information;

[0111] Based on the change time of the network change step, determine the third time window corresponding to the network change step;

[0112] Based on the network change steps, the alarm categories, and the third time window, determine the initial feature correlation probability between the network change steps and the alarm information;

[0113] Based on the initial feature correlation probability, the feature correlation probability between the initial network change event and the alarm information is determined.

[0114] The third time window corresponding to the network change step can be understood as a time window with relevant characteristics. Within this event window, the network change command will be reflected in the alarm.

[0115] In specific implementation, determining the initial feature correlation probability between the network change step and the alarm information based on the network change step, the alarm category, and the third time window includes:

[0116] Calculate the support and elevation metrics for the network change steps and the alarm categories within the third time window;

[0117] Based on the support metric and the lift metric, the initial feature correlation probability between the network change step and the alarm information is determined.

[0118] The support metric can be understood as the proportion of alarms of a certain alarm category that occur after a network change procedure. The lift metric can be understood as the increase in the probability of an alarm occurring given a network change procedure compared to the prior probability of the alarm itself.

[0119] In practical applications, the support S(X,Y) and lift I(X,Y) can be calculated using the following formulas.

[0120]

[0121]

[0122] Where X represents the network change step, and Y represents the alarm category of the alarm information. P(X, Y) is the probability that X and Y occur simultaneously within the third time window. P(Y) is the probability that Y occurs alone within the third time window.

[0123] In practice, the following steps can be taken: First, calculate the proportion of alarm categories appearing in historical data within the third time window (support). Second, calculate the probability that a network change step and an alarm category occur simultaneously within the third time window, compared to the probability of the network change step occurring alone (confidence). Third, calculate the lift of the alarm category within the third time window, given the occurrence of a network change step, compared to the prior probability of the alarm category occurring alone (lift). Finally, determine the initial feature correlation probability between the network change step and the alarm information based on the initial feature correlation probability. Based on this initial feature correlation probability, calculate the initial feature correlation probability between the network change event and the alarm information.

[0124] In summary, by calculating the correlation between an alarm and a specific change, the correlation with that change is obtained. Alarms with a lift less than 1 and a support below a threshold are given priority attention. This is because after spatiotemporal correlation filtering, the alarm and the change are strongly correlated. Furthermore, by prioritizing alarms that appear less frequently in the feature dimensions based on feature correlation, more important and anomalous alarms can be identified.

[0125] Step 206: If the correlation degree is determined to meet the correlation degree threshold, the alarm information is sent to the target device so that the target device can process the alarm information.

[0126] In practice, there are multiple initial network change events;

[0127] Accordingly, determining the degree of correlation between the initial network change event and the alarm information based on multiple correlation dimensions includes:

[0128] The degree of correlation between each initial network change event and the alarm information is determined based on multiple correlation dimensions.

[0129] Specifically, when there are multiple initial network change events, the degree of correlation between each initial network change event and alarm information can be determined based on multiple correlation dimensions. The specific determination process is similar to that described above, and will not be repeated in the embodiments of this specification.

[0130] In specific implementation, after determining the degree of correlation between each initial network change event and the alarm information based on multiple correlation dimensions, the method further includes:

[0131] The target network change event is determined based on the comparison of the correlation between each initial network change event and the alarm information.

[0132] Specifically, based on the comparison of the correlation between each initial network change event and the alarm information, the initial network change event with the highest correlation can be identified as the target network change event, indicating that the target network change event is more likely to cause the alarm information.

[0133] Furthermore, the step of sending the alarm information to the target device when the correlation degree is determined to meet the correlation degree threshold includes:

[0134] If the correlation degree of the target network change event is determined to meet the correlation degree threshold, the alarm information is sent to the target device;

[0135] After sending the alarm information to the target device, the process further includes:

[0136] The event information of the target network change event is sent to the target device so that the target device can process the alarm information according to the event information.

[0137] Specifically, by sending alarm messages whose correlation level meets the correlation threshold to the target device for processing, noise reduction of multiple alarm messages from the device under test is achieved. Correlation-based noise reduction of network change alarms is of great significance in network operation and maintenance. It can reduce the workload of operation and maintenance personnel, speed up the recovery speed of change anomalies, and improve the automation rate of the network change system.

[0138] In summary, the above method, in response to an alarm message from the device under test, determines the initial network change event corresponding to the alarm message's occurrence time and preset event determination rules. It then determines the correlation between the initial network change event and the alarm message based on multiple correlation dimensions. Correlation analysis is used to determine the correlation between the initial network change event and the alarm message, allowing for the determination of whether the alarm message was caused by the initial network change event. Furthermore, the use of multiple correlation dimensions in the correlation analysis further improves the accuracy of the obtained correlation degree. When the correlation degree meets a threshold, a high correlation is considered between the alarm message and the initial network change event, indicating a high probability that the alarm message was caused by the initial network change event. In this case, the alarm message can be sent to the target device for processing. This achieves the filtering and noise reduction of alarm messages from the device under test, ensuring that the alarm messages sent to the target device are filtered and highly correlated with network changes. This enables targeted detection of alarm anomalies, further ensuring anomaly handling efficiency and guaranteeing the normal operation of the device under test.

[0139] The following is in conjunction with the appendix Figure 4 Appendix Figure 5 and attached Figure 6 Taking the application of the information processing method provided in this specification in network change alarm noise reduction as an example, the information processing method will be further explained. Among other things, Figure 4 This specification illustrates a flowchart of the time correlation analysis process in an information processing method provided by an embodiment of this specification, which specifically includes the following steps.

[0140] Step 402: Respond to the alarm information of the device under test.

[0141] Step 404: Determine the initial network change event corresponding to the occurrence time based on the occurrence time of the alarm information and the preset event determination rules.

[0142] Specifically, a first time window w can be determined based on the occurrence time of the alarm information. If a network change command exists within this first time window w, the network change event corresponding to that command is identified and designated as the initial network change event corresponding to its occurrence time. If no network change command exists within the first time window w, the window can be adjusted to obtain a second time window. If a network change command exists within this second time window, the network change event corresponding to that command is identified and designated as the initial network change event corresponding to its occurrence time.

[0143] Where w = [t0 - σ - l, t0 - σ + r], σ is the alarm delay, w is the first time window, t0 is the time when the alarm information occurs, and l and r are preset time windows. For example, l and r can be 1 minute, which means that the first time window is 1 minute forward and 1 minute backward from the time when the alarm information occurs. If the time when the alarm information occurs is 12 o'clock, then the first time window is [11:59, 12:01].

[0144] For example, in the first time window w, there are network change instructions 1, 2, 3, and 4, where network change instructions 1, 2, and 3 correspond to the initial network change event 1, and network change instruction 3 corresponds to the initial network change event 2.

[0145] Step 406: Parse the network change instructions included in the initial network change event.

[0146] Specifically, we can determine the network change instructions 1, 2, and 3 within the first time window for the initial network change event, and determine the network change instruction 4 within the first time window for the initial network change event 2.

[0147] Step 408: Determine the time correlation probability between the initial network change event and the alarm information based on the time correlation dimension.

[0148] Specifically, a time correlation algorithm for the initial network change event can be determined based on a preset time correlation rule, and the time correlation probability between the initial network change event and the alarm information can be calculated based on this time correlation algorithm.

[0149] Figure 5 This specification illustrates a flowchart of the spatial correlation analysis process in an information processing method provided by an embodiment of this specification, which specifically includes the following steps.

[0150] Step 502: Divide the device under test into multiple spatial dimensions, determine the event spatial dimension corresponding to the initial network change event, and determine the alarm spatial dimension corresponding to the alarm information.

[0151] Specifically, the devices to be monitored can be categorized into device space dimension, device group dimension, POD dimension, cluster dimension, logical data center dimension, data center dimension, city / region dimension, domestic / international dimension, and global dimension. The event space dimension corresponding to the initial network change event is determined; for example, if the event space dimension corresponding to the initial network change event is the cluster dimension, it means that the initial network change event is a network change performed on a cluster. Similarly, the alarm space dimension corresponding to the alarm information is determined; for example, if the alarm space dimension corresponding to the alarm information is the device dimension, it means that the alarm information is triggered for a specific hardware device (such as a specific host).

[0152] Step 504: If the role type of the initial network change event is determined to be IDC role, match the event spatial dimension and alarm spatial dimension according to the spatial correlation algorithm to obtain the spatial correlation probability between the initial network change event and alarm information.

[0153] Step 506: If the role type of the initial network change event is determined to be a core network role, the neighboring devices of the changed device are determined according to the extended topology. Each neighboring device is matched with the alarm spatial dimension to obtain the spatial correlation probability between the initial network change event and the alarm information.

[0154] Figure 6 The flowchart of the feature correlation analysis process in an information processing method provided in one embodiment of this specification is shown, which specifically includes the following steps.

[0155] Step 602: Determine the network change steps included in the initial network change event and determine the alarm category of the alarm information.

[0156] Step 604: Determine the third time window corresponding to the network change step.

[0157] Step 606: Calculate the proportion of alarm categories appearing in historical data within the third time window.

[0158] Specifically, the support S(X, Y) is the proportion of the above alarm categories appearing in the historical data within the third time window.

[0159] Step 608: Calculate the probability that network change steps and alarm categories occur simultaneously within the third time window, compared to the probability that network change steps occur alone.

[0160] Specifically, the probability of the above-mentioned network change steps and alarm categories occurring simultaneously, compared to the probability of the network change steps occurring alone, is called the confidence level M(X, Y). The formula for calculating the confidence level is as follows.

[0161]

[0162] Where P(Y, X) is the probability of Y occurring within the third time window, assuming X occurs. P(X) is the probability of X occurring alone within the third time window.

[0163] Step 610: Based on the confidence level, calculate the increase in the probability of an alarm category occurring within the third time window when a network change step occurs, compared to the prior probability of an alarm category occurring alone.

[0164] Specifically, the increase in the probability of the above alarm categories occurring under the premise of network change steps compared to the prior probability of alarm categories occurring alone is called the increase in probability, i.e., I(X, Y).

[0165] Step 612: Determine the initial feature correlation probability between network change steps and alarm information based on support and lift.

[0166] Furthermore, the importance of alarm information can be determined based on support and boosting levels. For example, fulfilling certain criteria can be considered. The alarm information should be given special attention.

[0167] Step 614: Calculate the feature correlation probability between the initial network change event and the alarm information based on the initial feature correlation probability between the network change steps and the alarm information.

[0168]

[0169] Where P(X|Y) is the probability of X appearing within the third time window, assuming Y appears.

[0170] Furthermore, after calculating the temporal correlation probability, spatial correlation probability, and feature correlation probability between the initial network change event and the alarm information according to the above process, a weighted sum of these probabilities can be performed to obtain the degree of correlation between the initial network change event and the alarm information. When there are multiple initial network change events, the event with the highest correlation can be identified as the target network change event. If the correlation between this target network change event and the alarm information is greater than a correlation threshold, the alarm information is determined to be an alarm caused by a network change, and the alarm information is pushed to the operations and maintenance personnel for processing.

[0171] Corresponding to the above method embodiments, this specification also provides embodiments of an information processing apparatus. Figure 7 A schematic diagram of the structure of an information processing apparatus according to one embodiment of this specification is shown. Figure 7 As shown, the device includes:

[0172] The first determining module 702 is configured to respond to the alarm information of the device under test and determine the initial network change event corresponding to the occurrence time based on the occurrence time of the alarm information and the preset event determining rules.

[0173] The second determining module 704 is configured to determine the degree of correlation between the initial network change event and the alarm information based on multiple correlation dimensions.

[0174] The sending module 706 is configured to send the alarm information to the target device when it is determined that the correlation degree meets the correlation degree threshold, so that the target device can process the alarm information.

[0175] Optionally, the second determining module 704 is further configured to:

[0176] Based on the time correlation dimension, determine the probability of time correlation between the initial network change event and the alarm information; and / or

[0177] Based on the spatial correlation dimension, determine the spatial correlation probability between the initial network change event and the alarm information; and / or

[0178] Based on the feature correlation dimension, determine the feature correlation probability between the initial network change event and the alarm information;

[0179] The degree of correlation between the initial network change event and the alarm information is determined based on the time correlation probability and / or the spatial correlation probability and / or the feature correlation probability.

[0180] Optionally, the second determining module 704 is further configured to:

[0181] A time correlation algorithm is determined based on a preset time correlation rule, wherein the preset time correlation rule is the correlation rule between the occurrence time of the alarm information and the initial network change event;

[0182] The temporal correlation probability between the initial network change event and the alarm information is calculated based on the time correlation algorithm.

[0183] Optionally, the first determining module 702 is further configured to:

[0184] Based on the occurrence time of the alarm information, determine the first time window corresponding to the occurrence time;

[0185] If it is determined that a network change instruction exists within the first time window, and the network change event corresponding to the network change instruction is determined, the network change event is determined as the initial network change event corresponding to the occurrence time.

[0186] If it is determined that there is no network change instruction within the first time window, the first time window is adjusted to obtain a second time window, wherein the second time window is larger than the first time window.

[0187] If it is determined that a network change instruction exists within the second time window, and the network change event corresponding to the network change instruction is determined, the network change event is determined as the initial network change event corresponding to the occurrence time.

[0188] Optionally, the time correlation algorithm includes a first time correlation algorithm and a second time correlation algorithm;

[0189] The second determining module 704 is further configured to:

[0190] If it is determined that a network change instruction exists within the first time window, the first time correlation probability between the network change instruction and the alarm information is calculated according to the first time correlation algorithm.

[0191] Based on the first temporal correlation probability between the network change instruction and the alarm information, determine the temporal correlation probability between the initial network change event and the alarm information; or

[0192] If it is determined that a network change instruction exists within the second time window, the second time correlation probability between the network change instruction and the alarm information is calculated according to the second time correlation algorithm.

[0193] The temporal correlation probability between the initial network change event and the alarm information is determined based on the second temporal correlation probability between the network change instruction and the alarm information.

[0194] Optionally, the second determining module 704 is further configured to:

[0195] From multiple spatial dimensions, determine the event spatial dimension corresponding to the initial network change event, and determine the alarm spatial dimension corresponding to the alarm information;

[0196] Based on the event space dimension and the alarm space dimension, determine the spatial correlation probability between the initial network change event and the alarm information.

[0197] Optionally, the second determining module 704 is further configured to:

[0198] If the initial network change event is determined to be a first event type, the spatial correlation algorithm is used to match the event spatial dimension and the alarm spatial dimension to obtain the spatial correlation probability between the initial network change event and the alarm information; or

[0199] If the initial network change event is determined to be a second event type, the associated device of the network change device corresponding to the initial network change event is determined, and the associated device and the alarm spatial dimension are matched to obtain the spatial correlation probability between the initial network change event and the alarm information.

[0200] Optionally, the second determining module 704 is further configured to:

[0201] Determine the network change steps included in the initial network change event, and determine the alarm category of the alarm information;

[0202] Based on the change time of the network change step, determine the third time window corresponding to the network change step;

[0203] Based on the network change steps, the alarm categories, and the third time window, determine the initial feature correlation probability between the network change steps and the alarm information;

[0204] Based on the initial feature correlation probability, the feature correlation probability between the initial network change event and the alarm information is determined.

[0205] Optionally, the second determining module 704 is further configured to:

[0206] Calculate the support and elevation metrics for the network change steps and the alarm categories within the third time window;

[0207] Based on the support metric and the lift metric, the initial feature correlation probability between the network change step and the alarm information is determined.

[0208] Optionally, there may be multiple initial network change events;

[0209] Accordingly, the second determining module 704 is further configured to:

[0210] The degree of correlation between each initial network change event and the alarm information is determined based on multiple correlation dimensions.

[0211] Optionally, the second determining module 704 is further configured to:

[0212] The target network change event is determined based on the comparison of the correlation between each initial network change event and the alarm information.

[0213] Optionally, the second determining module 704 is further configured to:

[0214] If the correlation degree of the target network change event is determined to meet the correlation degree threshold, the alarm information is sent to the target device;

[0215] After sending the alarm information to the target device, the process further includes:

[0216] The event information of the target network change event is sent to the target device so that the target device can process the alarm information according to the event information.

[0217] In the aforementioned device, in response to an alarm message from the device under test, the initial network change event corresponding to the alarm message's occurrence time is determined based on the alarm message's occurrence time and preset event determination rules. Furthermore, the correlation between the initial network change event and the alarm message is determined based on multiple correlation dimensions. Correlation analysis is used to determine the correlation between the initial network change event and the alarm message, thus allowing the determination of whether the alarm message was caused by the initial network change event. Moreover, multiple correlation dimensions are used in the correlation analysis to further improve the accuracy of the obtained correlation degree. If the correlation degree meets a correlation degree threshold, a high correlation is determined between the alarm message and the initial network change event, indicating a high probability that the alarm message was caused by the initial network change event. In this case, the alarm message can be sent to the target device for processing. This achieves the filtering and noise reduction of alarm messages from the device under test, ensuring that the alarm messages sent to the target device are filtered and highly correlated with network changes. This enables targeted detection of alarm anomalies, further ensuring anomaly handling efficiency and guaranteeing the normal operation of the device under test.

[0218] The above is an illustrative scheme of an information processing device according to this embodiment. It should be noted that the technical solution of this information processing device and the technical solution of the information processing method described above belong to the same concept. For details not described in detail in the technical solution of the information processing device, please refer to the description of the technical solution of the information processing method described above.

[0219] Figure 8 A structural block diagram of a computing device 800 according to one embodiment of this specification is shown. The components of the computing device 800 include, but are not limited to, a memory 810 and a processor 820. The processor 820 is connected to the memory 810 via a bus 830, and a database 850 is used to store data.

[0220] The computing device 800 also includes an access device 840, which enables the computing device 800 to communicate via one or more networks 860. Examples of these networks include Public Switched Telephone Network (PSTN), Local Area Network (LAN), Wide Area Network (WAN), Personal Area Network (PAN), or combinations of communication networks such as the Internet. The access device 840 may include one or more of any type of wired or wireless network interface (e.g., a network interface card (NIC)), such as an IEEE 802.11 Wireless Local Area Network (WLAN) wireless interface, a Wi-MAX (Worldwide Interoperability for Microwave Access) interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth interface, a Near Field Communication (NFC) interface, and so on.

[0221] In one embodiment of this application, the aforementioned components of the computing device 800 and Figure 8 Other components, not shown, can also be connected to each other, for example, via a bus. It should be understood that... Figure 8 The block diagram of the computing device shown is for illustrative purposes only and is not intended to limit the scope of this application. Those skilled in the art can add or replace other components as needed.

[0222] The computing device 800 can be any type of stationary or mobile computing device, including mobile computers or mobile computing devices (e.g., tablet computers, personal digital assistants, laptop computers, notebook computers, netbooks, etc.), mobile phones (e.g., smartphones), wearable computing devices (e.g., smartwatches, smart glasses, etc.) or other types of mobile devices, or stationary computing devices such as desktop computers or personal computers (PCs). The computing device 800 can also be a mobile or stationary server.

[0223] The processor 820 is used to execute the following computer program / instructions, which, when executed by the processor, implement the steps of the above-described information processing method.

[0224] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on its differences from other embodiments. In particular, the computing device embodiments are basically similar to the information processing method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the information processing method embodiments.

[0225] An embodiment of this specification also provides a computer-readable storage medium storing a computer program / instructions that, when executed by a processor, implement the steps of the information processing method described above.

[0226] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on its differences from other embodiments. In particular, the computer-readable storage medium embodiments are basically similar to the information processing method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the information processing method embodiments.

[0227] An embodiment of this specification also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the information processing method described above.

[0228] The above is an illustrative scheme of a computer program product according to this embodiment. It should be noted that the technical solution of this computer program product and the technical solution of the information processing method described above belong to the same concept. For details not described in detail in the technical solution of the computer program product, please refer to the description of the technical solution of the information processing method described above.

[0229] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0230] The computer instructions include computer program code, which may be in the form of source code, object code, executable file, or certain intermediate forms. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium may be appropriately added or removed according to the requirements of patent practice. For example, in some regions, according to patent practice, computer-readable media may not include electrical carrier signals and telecommunication signals.

[0231] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments in this specification are not limited to the described order of actions, because according to the embodiments in this specification, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to the embodiments in this specification.

[0232] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0233] The preferred embodiments disclosed above are merely illustrative of this specification. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the embodiments described herein. These embodiments are selected and specifically described in this specification to better explain the principles and practical applications of the embodiments, thereby enabling those skilled in the art to better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

1. An information processing method, comprising: In response to an alarm message from the device under test, the initial network change event corresponding to the alarm message occurrence time is determined based on the occurrence time of the alarm message and a preset event determination rule. The degree of correlation between the initial network change event and the alarm information is determined based on multiple correlation dimensions; If the correlation degree is determined to meet the correlation degree threshold, the alarm information is sent to the target device so that the target device can process the alarm information.

2. The information processing method according to claim 1, wherein determining the degree of correlation between the initial network change event and the alarm information based on multiple correlation dimensions includes: Based on the time correlation dimension, determine the time correlation probability between the initial network change event and the alarm information; and / or Based on the spatial correlation dimension, determine the spatial correlation probability between the initial network change event and the alarm information; and / or Based on the feature correlation dimension, determine the feature correlation probability between the initial network change event and the alarm information; The degree of correlation between the initial network change event and the alarm information is determined based on the time correlation probability and / or the spatial correlation probability and / or the feature correlation probability.

3. The information processing method according to claim 2, wherein determining the temporal correlation probability between the initial network change event and the alarm information based on the temporal correlation dimension includes: A time correlation algorithm is determined based on a preset time correlation rule, wherein the preset time correlation rule is the correlation rule between the occurrence time of the alarm information and the initial network change event; The temporal correlation probability between the initial network change event and the alarm information is calculated based on the time correlation algorithm.

4. The information processing method according to claim 3, wherein determining the initial network change event corresponding to the occurrence time based on the occurrence time of the alarm information and a preset event determination rule includes: Based on the occurrence time of the alarm information, determine the first time window corresponding to the occurrence time; If it is determined that a network change instruction exists within the first time window, and the network change event corresponding to the network change instruction is determined, the network change event is determined as the initial network change event corresponding to the occurrence time. If it is determined that there is no network change instruction within the first time window, the first time window is adjusted to obtain a second time window, wherein the second time window is larger than the first time window. If it is determined that a network change instruction exists within the second time window, and the network change event corresponding to the network change instruction is determined, the network change event is determined as the initial network change event corresponding to the occurrence time.

5. The information processing method according to claim 4, wherein the time correlation algorithm includes a first time correlation algorithm and a second time correlation algorithm; The step of calculating the time correlation probability between the initial network change event and the alarm information according to the time correlation algorithm includes: If it is determined that a network change instruction exists within the first time window, the first time correlation probability between the network change instruction and the alarm information is calculated according to the first time correlation algorithm. Based on the first temporal correlation probability between the network change instruction and the alarm information, determine the temporal correlation probability between the initial network change event and the alarm information; or If it is determined that a network change instruction exists within the second time window, the second time correlation probability between the network change instruction and the alarm information is calculated according to the second time correlation algorithm. The temporal correlation probability between the initial network change event and the alarm information is determined based on the second temporal correlation probability between the network change instruction and the alarm information.

6. The information processing method according to claim 2, wherein determining the spatial correlation probability between the initial network change event and the alarm information based on the spatial correlation dimension includes: From multiple spatial dimensions, determine the event spatial dimension corresponding to the initial network change event, and determine the alarm spatial dimension corresponding to the alarm information; Based on the event space dimension and the alarm space dimension, determine the spatial correlation probability between the initial network change event and the alarm information.

7. The information processing method according to claim 6, wherein determining the spatial correlation probability between the initial network change event and the alarm information based on the event spatial dimension and the alarm spatial dimension includes: If the initial network change event is determined to be a first event type, the spatial correlation algorithm is used to match the event spatial dimension and the alarm spatial dimension to obtain the spatial correlation probability between the initial network change event and the alarm information. or If the initial network change event is determined to be a second event type, the associated device of the network change device corresponding to the initial network change event is determined, and the associated device and the alarm spatial dimension are matched to obtain the spatial correlation probability between the initial network change event and the alarm information.

8. The information processing method according to claim 2, wherein determining the feature correlation probability between the initial network change event and the alarm information based on the feature correlation dimension includes: Determine the network change steps included in the initial network change event, and determine the alarm category of the alarm information; Based on the change time of the network change step, determine the third time window corresponding to the network change step; Based on the network change steps, the alarm categories, and the third time window, determine the initial feature correlation probability between the network change steps and the alarm information; Based on the initial feature correlation probability, the feature correlation probability between the initial network change event and the alarm information is determined.

9. The information processing method according to claim 8, wherein determining the initial feature correlation probability between the network change step and the alarm information based on the network change step, the alarm category, and the third time window includes: Calculate the support and elevation metrics for the network change steps and the alarm categories within the third time window; Based on the support metric and the lift metric, the initial feature correlation probability between the network change step and the alarm information is determined.

10. The information processing method according to claim 1, wherein the initial network change event is multiple; Accordingly, determining the degree of correlation between the initial network change event and the alarm information based on multiple correlation dimensions includes: The degree of correlation between each initial network change event and the alarm information is determined based on multiple correlation dimensions.

11. The information processing method according to claim 10, after determining the degree of correlation between each initial network change event and the alarm information based on multiple correlation dimensions, further comprising: The target network change event is determined based on the comparison of the correlation between each initial network change event and the alarm information.

12. The information processing method according to claim 10, wherein sending the alarm information to the target device when determining that the correlation degree meets the correlation degree threshold includes: If the correlation degree of the target network change event is determined to meet the correlation degree threshold, the alarm information is sent to the target device; After sending the alarm information to the target device, the process further includes: The event information of the target network change event is sent to the target device so that the target device can process the alarm information according to the event information.

13. A computing device, comprising: Memory and processor; The memory is used to store computer programs / instructions, and the processor is used to execute the computer programs / instructions, which, when executed by the processor, implement the steps of the method according to any one of claims 1 to 12.

14. A computer-readable storage medium storing a computer program / instructions that, when executed by a processor, implement the steps of the method according to any one of claims 1 to 12.

15. A computer program product comprising a computer program / instructions that, when executed by a processor, implement the steps of the method according to any one of claims 1 to 12.

Images