Alarm relation mining method and device, equipment, storage medium and product

Abstract

The invention relates to an alarm relation mining method and device, equipment, a storage medium and a product, and the method comprises the steps: obtaining historical alarm data and master-slave hierarchical data, and the master-slave hierarchical data is used for indicating a master-slave relation between master equipment and slave equipment; performing alarm data deduplication on the historical alarm data based on the event occurrence time by taking the data group as a unit to obtain the historical alarm data after deduplication, the same data group including the historical alarm data from the same device and having the same alarm item; generating an alarm sequence corresponding to each piece of main alarm data based on the de-duplicated historical alarm data and the master-slave hierarchical data; the main alarm data is historical alarm data corresponding to the main equipment in the historical alarm data; the master-slave alarm relationship is determined based on the alarm sequence corresponding to each piece of master alarm data, so that the accuracy of data deduplication and the adaptability to a complex network environment are improved, and the interference of alarm redundancy on relationship mining is reduced.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of operation and maintenance, and particularly relate to an alarm relationship mining method, device, equipment, storage medium and product. BACKGROUND

[0002] In the field of telecommunications networks, with the increase in network complexity and the proposal of self-intelligent targets, the traditional network troubleshooting system faces the demand for intelligent upgrading. In particular, in operation and maintenance monitoring, due to the increasing complexity of the correlation between networks, problem positioning becomes time-consuming and labor-intensive. Therefore, it is necessary to analyze the correlation between alarms to alleviate alarm storms and help operation and maintenance personnel make intervention decisions quickly.

[0003] Before identifying the alarm relationship, it is necessary to de-duplicate the massive alarm data to reduce interference with alarm relationship mining. In related technologies, data de-duplication can be performed by using a frequent item set algorithm. However, the frequent item set algorithm only de-duplicates data by using the time factor, which makes the accuracy and adaptability of data de-duplication poor. SUMMARY

[0004] Embodiments of the present application provide an alarm relationship mining method, device, equipment, storage medium and product, which can improve the accuracy of data de-duplication and the adaptability to complex network environments, and reduce the interference of alarm redundancy with relationship mining. The technical solution is as follows.

[0005] On the one hand, an alarm relationship mining method is provided, and the method comprises: obtaining historical alarm data and master-slave hierarchical data, the master-slave hierarchical data being used to indicate the master-slave relationship between a master device and a slave device; de-duplicating the historical alarm data based on event occurrence time in units of data groups to obtain de-duplicated historical alarm data, the same data group containing historical alarm data from the same device and having the same alarm item; generating alarm sequences corresponding to each master alarm data based on the de-duplicated historical alarm data and the master-slave hierarchical data, the master alarm data being the historical alarm data corresponding to the master device in the historical alarm data; determining the master-slave alarm relationship based on the alarm sequences corresponding to each master alarm data.

[0006] On the other hand, an alarm relationship mining device is provided, and the device comprises: a data acquisition module configured to obtain historical alarm data and master-slave hierarchical data, the master-slave hierarchical data being used to indicate the master-slave relationship between a master device and a slave device; a data deduplication module, configured to perform alarm data deduplication on the historical alarm data based on event occurrence time in a data packet unit, to obtain deduplicated historical alarm data, wherein the same data packet contains historical alarm data from the same device and with the same alarm item; a sequence generation module, configured to generate alarm sequences corresponding to each master alarm data based on the deduplicated historical alarm data and the master-slave hierarchical data, wherein the master alarm data is the historical alarm data corresponding to a master device in the historical alarm data; a relationship determination module, configured to determine master-slave alarm relationships based on the alarm sequences corresponding to each master alarm data.

[0007] In a possible implementation, the data deduplication module comprises: a grouping submodule, configured to group the historical alarm data based on target attribute information of each historical alarm data, to obtain a data packet set containing a plurality of data packets, wherein the target attribute information comprises device name information and alarm title information; an ordering submodule, configured to order the historical alarm data in each data packet according to event occurrence time, to obtain ordered data packets; a difference calculation submodule, configured to calculate occurrence time differences between adjacent historical alarm data in the ordered data packets; a deduplication submodule, configured to perform data deduplication on the historical alarm data based on occurrence time differences between deduplication time windows with different time length values and the adjacent historical alarm data, to obtain the historical alarm data under different deduplication time windows.

[0008] In a possible implementation, the sequence generation module comprises: a data acquisition submodule, configured to acquire, for each master alarm data, slave alarm data corresponding to each master alarm data in a search time window, wherein the slave alarm data is the historical alarm data corresponding to a slave device in the historical alarm data; a sequence generation submodule, configured to generate the alarm sequences corresponding to each master alarm data based on each master alarm data in the search time window and the slave alarm data corresponding to each master alarm data.

[0009] In a possible implementation, the apparatus further comprises: The sequence deleting module is configured to, after the sequence generating module generates alarm sequences corresponding to each master alarm data based on the deduplicated historical alarm data and the master-slave hierarchy data, delete a target alarm sequence in response to a length of the target alarm sequence being less than a length threshold, the target alarm sequence being any one of the alarm sequences corresponding to each master alarm data.

[0010] In a possible implementation, the relationship determining module comprises: The mode counting sub-module is configured to extract and count, based on the alarm sequences corresponding to each master alarm data, an occurrence frequency of each alarm mode and a mode length of each alarm mode, each alarm mode comprising a sequence composed of a plurality of continuous alarm items, the mode length being used to indicate a number of alarm items included in an alarm mode. The mode screening sub-module is configured to delete a target alarm mode in response to an occurrence frequency of the target alarm mode being less than a frequency threshold, or a mode length of the target alarm mode being less than a minimum length threshold, the target alarm mode being any one of the alarm modes. The relationship determining sub-module is configured to determine alarm modes other than the target alarm mode as the master-slave alarm relationship.

[0011] In a possible implementation, a length of the search time window corresponds to a length of the deduplication time window. The apparatus further comprises a weighting module configured to, after the relationship determining sub-module determines alarm modes other than the target alarm mode as the master-slave alarm relationship, perform confidence weighting on each master-slave alarm relationship based on an occurrence frequency of an alarm mode and a total occurrence frequency of master alarm items in the alarm mode. And / or, The confidence weighting is performed on each master-slave alarm relationship based on a length of a search time window corresponding to each master-slave alarm relationship, different search time windows corresponding to different confidence weights.

[0012] In another aspect, a computer device is provided, the computer device comprising a processor and a memory, the memory storing at least one computer program, the at least one computer program being loaded and executed by the processor to implement the alarm relationship mining method described above.

[0013] In another aspect, a computer readable storage medium is provided, the computer readable storage medium storing at least one computer program, the computer program being loaded and executed by a processor to implement the alarm relationship mining method described above.

[0014] In another aspect, a computer program product is provided, which includes a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions that, when executed by a computer, cause the computer to perform the alarm relationship mining method provided in the various optional implementations described above.

[0015] The alarm relationship mining method provided by the embodiments of the present application can improve the accuracy of data deduplication and the adaptability to complex network environments by combining devices, alarm items and time factors for fine deduplication, effectively reducing the interference of alarm redundancy on relationship mining. In addition, the alarm sequence is constructed by introducing the master-slave hierarchical data, which can more accurately reveal the cause-effect or correlation relationship between the master device alarm and the slave device alarm, thereby enhancing the pertinence and reliability of alarm relationship mining, providing strong support for operation and maintenance personnel to quickly locate problems and make intervention decisions.

[0016] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and are not limiting to the present application. BRIEF DESCRIPTION OF DRAWINGS

[0017] The accompanying drawings, which are incorporated into and form part of the specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the application.

[0018] Figure 1 A flowchart of an alarm relationship mining method provided by an exemplary embodiment of the present application is shown; Figure 2 A schematic diagram of an alarm relationship mining process provided by an exemplary embodiment of the present application is shown; Figure 3 A structural block diagram of an alarm relationship mining device provided by an exemplary embodiment of the present application is shown; Figure 4 A structural block diagram of a computer device according to an exemplary embodiment of the present application is shown; Figure 5 A structural block diagram of a computer device according to another exemplary embodiment of the present application is shown. DETAILED DESCRIPTION

[0019] The exemplary embodiments will be described in detail herein with reference to the attached drawings. The following description is only exemplary of the application and is not intended to limit the scope, applicability or configuration of the application in any way. Rather, the following description provides a description of the exemplary embodiments along with many specific details that can serve as examples. However, it should be understood by those skilled in the art that the following description is not intended to limit the application in any manner. Indeed, various modifications and equivalents can be substituted for elements of the application without departing from the scope of the application as described. Thus, many alternatives, modifications, and equivalents will become apparent to those skilled in the art upon reading this description. Accordingly, the exemplary embodiments are intended to cover all such alternatives, modifications and equivalents as can be included within the scope of the application.

[0020] The embodiments of the present application provide an alarm relationship mining method, which can adapt to the deduplication requirements of alarm data in different service scenarios, improve the deduplication effect of alarm data, and further improve the alarm relationship mining effect based on the deduplicated alarm data.

[0021] Figure 1 A flowchart of an alarm relationship mining method provided by an exemplary embodiment of the present application is shown. The method can be executed by a computer device, which can be implemented as a server or a terminal. As shown in Figure 1 The alarm relationship mining method can include the following steps.

[0022] In step 110, historical alarm data and master-slave hierarchical data are acquired, where the master-slave hierarchical data is used to indicate the master-slave relationship between master devices and slave devices.

[0023] In a possible implementation, the computer device can collect historical alarm data in a target period for alarm relationship mining. The target period can be set based on actual requirements, such as 3 months, 1 month, or half a year, etc. The present application does not limit this. In a cloud computing operation and maintenance scenario, the historical alarm data can be historical alarm data of various network element devices obtained by cloud core operation and maintenance monitoring, such as routers, switches, distributed storage, UPF (User Plane Function), servers, hosts, virtual machines, core network devices, etc.

[0024] In a possible implementation, after obtaining the original historical alarm data, the computer device can first perform data cleaning on the original historical alarm data to eliminate invalid historical alarm data. The invalid historical alarm data refers to historical alarm data caused by non-device factors, that is, alarm data irrelevant to device fault relationship mining, such as password type, login type, and prompt type historical alarm data. After data cleaning, valid historical alarm data is obtained, so as to perform alarm relationship mining based on the valid historical alarm data. Illustratively, the alarm data set is D = {alarm_1, alarm_2, …, alarm_n}, where alarm represents historical alarm data. In a possible implementation, each historical alarm data is used to indicate attribute information of an alarm item, such as device name information, alarm title information, event time, device type, device vendor, province code, network domain, alarm unique identifier, and vendor severity. Illustratively, the historical alarm data alarm_i = {'ne_name', 'alarm_title', 'event_time', 'eqp_class','vendor', 'province_code', 'domain', 'alarm_unique_id','vendor_severity'}.

[0025] The master-slave hierarchical data is used to indicate the master-slave relationship between the master device and the slave device. In a possible implementation, the computer device can obtain original master-slave hierarchical data from a network management system, a configuration management database, or a cloud management platform. After data processing on the original master-slave hierarchical data, the master-slave hierarchical data is obtained. The master-slave hierarchical data can also be referred to as a master-slave device hierarchical dictionary, where the key is the master device, and the value is the slave device. Illustratively, the master-slave hierarchical data can be represented as {main_eqp: [slave_eqp1, slave_eqp2, slave_eqp3, …, slave_eqpn]}, where main_eqp is the master device, slave_eqp is the slave device, indicating that the master device has a master-slave relationship with n slave devices, and n is a positive integer.

[0026] In step 120, the historical alarm data is de-duplicated based on the event occurrence time in a data packet, and de-duplicated historical alarm data is obtained. The same data packet contains historical alarm data from the same device and with the same alarm item.

[0027] In an actual production environment, in order to ensure the normal operation of each device, there will be a large number of detection and management mechanisms, and therefore a large amount of alarm data will be generated. In order to improve the deduplication effect of the alarm data, in the embodiment of the present application, the alarm data can be grouped before the alarm data deduplication of the historical alarm data. Specifically, the historical alarm data from the same device and with the same alarm item is grouped as a group. Then, in each data group, the alarm data deduplication is performed based on the event occurrence time of each historical alarm data, so as to realize the alarm data deduplication in two dimensions of device relationship and time relationship.

[0028] In a possible implementation, the alarm data deduplication of the historical alarm data is performed based on the event occurrence time in a data group, and the deduplicated historical alarm data is obtained, including: The historical alarm data is grouped based on the target attribute information of each historical alarm data, and a data group set is obtained, which includes a plurality of data groups. The target attribute information includes device name information and alarm title information. In each data group, the historical alarm data is sorted according to the event occurrence time, and the sorted data groups are obtained. In the sorted data groups, the occurrence time difference between adjacent historical alarm data is calculated. The historical alarm data is deduplicated based on the occurrence time difference between the adjacent historical alarm data and the deduplication time window with different time length values, and the historical alarm data under different deduplication time windows is obtained.

[0029] The same device name information and alarm title information indicate the same alarm item of the same device, which can be grouped into the same data group. Further, the computer device can further group the data according to other attribute information of the alarm item to improve the refinement degree of data grouping. For example, the data is grouped based on the device name information, the alarm title information and the network domain information, etc. Different data grouping bases can be selected according to actual needs, which is not limited in the present application. Taking the target attribute information including the device name information and the alarm title information as an example, the computer device groups each historical alarm data in the historical alarm data set D based on ['ne_name', 'alarm_title'], and obtains a data group set G={G_1, G_2,..., G_m}, m is a positive integer, and the data group set includes a plurality of data groups G.

[0030] After the data packet is completed, for each data packet, the data is sorted according to the event occurrence time of each historical alarm data contained in the data packet, such as ascending order or descending order, to obtain each sorted data packet. For example, for each historical alarm data contained in the data packet G_j, ascending order sorting is performed according to ['event_time'], and the sorted data packet G_j is obtained.

[0031] In the sorted data packet, for each historical alarm data, the time difference is calculated, that is, the occurrence time difference between adjacent historical alarm data, ΔT=|event_time_i-event_time_(i-1)|, where event_time_i is the event occurrence time of the current historical alarm data, and event_time_(i-1) is the data occurrence time of the previous historical alarm data. When i=1, ΔT=0.

[0032] The occurrence time difference is compared with the deduplication time window. If there are adjacent historical alarm data with an occurrence time difference less than or equal to the deduplication time window, that is, ΔT≤ΔT threshold , the historical alarm data with the later occurrence time in the adjacent historical alarm data is determined as repeated alarm data and is deleted. If the occurrence time difference between the adjacent historical alarm data is greater than the deduplication time window, it is determined that the two historical alarm data are non-repeated alarm data of the same alarm item of the same device occurring at different time points, and are retained.

[0033] Because the speed of alarm propagation is different in different business scenarios, some alarms propagate quickly, and some alarms have a long propagation delay. Therefore, in order to adapt to the needs of different business scenarios, multiple deduplication time windows can be set when data deduplication is performed. The lengths of different deduplication time windows are different. Illustratively, the deduplication time window can be represented as ΔT threshold ={1, 2, 5, 10}, where each element i∈ΔT threshold represents a time window in minutes. It should be noted that the length of the above deduplication time window is only illustrative, and the length of the deduplication time window can be customized based on actual needs. In one possible implementation, when setting the length of the deduplication time window, it can be customized based on actual needs corresponding to each business scenario, and the present application does not limit this.

[0034] In the data deduplication, the historical alarm data is sequentially deduplicated according to the deduplication time windows of different time lengths, and the historical alarm data under the corresponding deduplication time window is obtained. Illustratively, the deduplication process of one of the deduplication time windows is taken as an example. In response to the existence of adjacent historical alarm data with a time difference less than a target deduplication time window, the historical alarm data with a later occurrence time is determined as repeated alarm data and is deleted. The target deduplication time window is any one of the deduplication time windows.

[0035] After the data deduplication of each data group is completed based on each deduplication time window, the alarm data set under each deduplication time window can be obtained. Taking one of the alarm data sets as an example, the alarm data set D i after the data deduplication can be represented as D i ={alarm events within the i-minute window},for all i∈ΔT threshold .

[0036] In step 130, the alarm sequence corresponding to each master alarm data is generated based on the deduplicated historical alarm data and the master-slave hierarchical data. The master alarm data is the historical alarm data corresponding to the master device in the historical alarm data.

[0037] After the data deduplication is completed, the computer device performs sequence division on the deduplicated historical alarm data based on the master-slave hierarchy between each master device and each slave device indicated by the master-slave hierarchical data, to extract the alarm relationship between the master and slave devices, i.e., the master-slave alarm relationship. In the case of data deduplication through multiple deduplication time windows, the computer device can generate alarm sequences under each deduplication time window based on the deduplicated historical alarm data under each deduplication time window and the master-slave hierarchical data, and then perform alarm relationship analysis between the master and slave devices based on the alarm sequences under each deduplication time window.

[0038] In one possible implementation, the computer device can construct an alarm space based on the master-slave hierarchical data and the deduplicated alarm data set. The alarm space can include the historical alarm data of the master device and its corresponding multiple slave devices, and provides a sample space basis for subsequent alarm time domain division. Illustratively, the alarm space can be represented as space_alarm={D i :space_1_alram,space_2_alarm,......space_n_alarm}.

[0039] Afterwards, in each alarm space, the computer device can traverse each main alarm data (alarm_main) to search for slave alarm data associated with it within a specific time window from the alarm data, if there is an alarm item from the device within the specific time window, that is, the corresponding slave alarm data is searched, then the main alarm data and the corresponding slave alarm data are recorded in the alarm sequence corresponding to the main alarm data; that is, based on the deduplicated historical alarm data and the master-slave hierarchical data, an alarm sequence is generated, including: For each main alarm data, obtain the slave alarm data corresponding to each main alarm data within the search time window, which is the historical alarm data corresponding to the slave device in the historical alarm data; Based on each main alarm data within the search time window and the slave alarm data corresponding to each main alarm data, an alarm sequence corresponding to each main alarm data is generated.

[0040] The length of the search time window can correspond to the length of the deduplication time window, that is, when searching the alarm data set after data deduplication based on the target deduplication time window, the length of the corresponding search time window corresponds to the length of the target deduplication time window. The search time window is used to indicate the maximum search length of the slave device data search starting from the search starting point of the event generation time of the main alarm data, that is, when searching the slave device data, the condition event_time(alarm_slave)-event_time(alarm_main)≤time_window must be met.

[0041] The following describes the generation of an alarm sequence under a deduplication time window: when the main alarm data corresponding slave alarm data is checked, the computer device can integrate the main alarm data (alarm_main) and the related slave alarm data (alarm_slave_1, alarm_slave_2, …, alarm_slave_n) to obtain the alarm sequence corresponding to the main alarm data. The alarm sequence is an ordered set, wherein the first element of the alarm sequence is the main alarm data, and the subsequent elements are the slave alarm data associated within the corresponding search time window. Each alarm data corresponds to an alarm item triggered within a specific time range, and thus the alarm relationship between the master-slave devices can be extracted based on the alarm sequence corresponding to each main alarm data.

[0042] In a possible implementation, in order to facilitate the extraction and screening of the alarm relationship, after generating the alarm sequence corresponding to each main alarm data, the method can further include: In response to the length of the target alarm sequence being less than the length threshold, the target alarm sequence is deleted, the target alarm sequence being any one of the alarm sequences corresponding to the respective primary alarm data.

[0043] The length of the alarm sequence refers to the number of alarm data included in the alarm sequence. Since the primary alarm data is retained in each alarm sequence regardless of whether there is slave alarm data, there are many isolated alarm sequences that are less helpful for mining the primary-slave alarm relationship. Therefore, after generating the alarm sequence corresponding to each primary alarm data, the computer device can count the length of each alarm sequence. If there is an alarm sequence whose length is less than the length threshold, the alarm sequence is deleted. If the length of the alarm sequence is greater than the length threshold, the alarm sequence is retained. This reduces the calculation steps of invalid alarm sequences in the subsequent alarm relationship extraction process, reduces the waste of computing resources, improves the quality of the alarm sequence, and improves the efficiency and accuracy of the subsequent extraction of the alarm relationship between the primary and slave devices.

[0044] The length threshold can be set based on actual needs. For example, it can be set to 1 to filter out alarm sequences that only save primary alarm data, or it can be set to a larger value to extract alarm relationships with a larger spread range.

[0045] Step 140, determining the primary-slave alarm relationship based on the alarm sequence corresponding to each primary alarm data.

[0046] After generating the alarm sequence corresponding to each primary alarm data or filtering the alarm sequence, the computer device can extract the alarm relationship between the primary and slave devices based on the alarm sequence corresponding to each primary device. This process can be implemented as follows: Based on the alarm sequence corresponding to each primary alarm data, extract and count the occurrence frequency of each alarm pattern and the pattern length of each alarm pattern. Each alarm pattern includes a sequence composed of multiple consecutive alarm items, and the pattern length indicates the number of alarm items included in the alarm pattern. In response to the occurrence frequency of the target alarm pattern being less than the frequency threshold, or the pattern length of the target alarm pattern being less than the minimum length threshold, the target alarm pattern is deleted, the target alarm pattern being any one of the alarm patterns. The alarm patterns other than the target alarm pattern in each alarm pattern are determined as the primary-slave alarm relationship.

[0047] The computer device can count the occurrence frequency of each alarm pattern in each alarm sequence and the pattern length of each alarm pattern, the pattern length of the alarm pattern being used to indicate the number of alarm items included in the alarm pattern, the alarm pattern including the alarm item corresponding to the master device and the alarm item corresponding to the at least one slave device; for example, if an alarm sequence is [A, B, C], A is the master alarm data, B and C are the slave alarm data, each element in the alarm sequence corresponds to an alarm event, based on the alarm sequence, alarm patterns [A, B] and [A, C] can be obtained, the pattern lengths of the above two alarm patterns are 2 and 2 respectively, and after alarm pattern extraction is performed in combination with other alarm sequences, the occurrence frequencies of the above two alarm patterns can be counted, the alarm patterns with the occurrence frequencies less than the frequency threshold or the alarm patterns with the pattern lengths less than the minimum length threshold are deleted, and the alarm patterns obtained after the screening are determined as the master-slave alarm relationship.

[0048] Due to the same alarm item, the alarm item corresponding to the slave device in the current alarm sequence can also be the alarm item corresponding to the master device in other alarm sequences, therefore, when alarm pattern statistics are performed, cross-alarm sequence statistics analysis can be performed to mine longer alarm propagation patterns that cross multiple alarm sequences, for example, one alarm sequence is [A, B, C], the alarm patterns extracted therefrom are [A, B] and [A, C], another alarm sequence is [B, D, F], the alarm patterns extracted therefrom are [B, D] and [B, F], and the alarm pattern [A, B, D] can be obtained after integration.

[0049] In a possible implementation, in order to avoid continuous extension of the alarm pattern, in addition to the minimum length threshold, a maximum length threshold can also be set to limit the alarm pattern, in this case, when the alarm pattern is mined, if the number of alarm items in the current alarm pattern is greater than the minimum length threshold but does not reach the maximum length threshold, the recursive mining is continued until the maximum length threshold is reached or the alarm item cannot be mined, and finally the alarm pattern is obtained, thereby determining the master-slave alarm relationship.

[0050] In a possible implementation, the computer device mines the master-slave alarm relationship by using the alarm relationship mining algorithm of the hierarchical priority binomial set, which can use the master hierarchical alarm projection to reduce the search space, in the alarm relationship mining process, a master alarm item is first determined as the prefix of the sequence, and then the database is projected based on the prefix to find the master-slave pattern, and finally the master-slave alarm list is output, which can be expressed as: Results=[(count1,Pattern1),(count2,Pattern2),…,(count k, Pattern k )] where k is the total number of different alarm patterns in the mining result, count i is the occurrence number of the i-th alarm pattern, Pattern i is the alarm pattern.

[0051] In this case, the computer device can first generate a hierarchical alarm sequence database D t _list based on alarm sequences corresponding to each main alarm data. t The hierarchical alarm sequence database D t _list is a two-dimensional data structure, which is formalized as D n _list={e1, e2, …, en}, where n is the total number of alarm sequences in the sequence alarm sequence database. Each alarm sequence e j (j=1, 2, …, n) itself is a list, denoted as e j =[i j1 , i j2 , …, i jm ], where m is the number of alarm data in the alarm sequence e j . Each alarm data i jk (k=1, 2, …, m) is an element in the alarm sequence e j , which can represent its corresponding single alarm item.

[0052] In the data structure definition stage, the alarm sequence database is defined as DB=Hierarchical Alarm Sequence Database D t _list, where each row represents an alarm sequence, and each integer represents an alarm item.

[0053] Define the matching list MatchesList=List[Tuple[int, int]], where each tuple ([i, j]) represents the position coordinate identifier of the projection database. The length of Matches represents the number of occurrences of the alarm pattern in the record, which is used for comparison with the frequency threshold minsup. If the length of Matches is less than minsup, the alarm pattern is deleted.

[0054] Define the pattern list Pattern=List[int] for storing the currently mined alarm pattern.

[0055] Define the result list Results=List[Tuple[int, Pattern]] for storing the mining result.

[0056] In the initial parameter setting stage, the sequence database DB is initialized as a list containing a plurality of alarm sequences, each alarm sequence containing a plurality of alarm items and alarm attribute information. Illustratively, it can be expressed as: [['alarm_i:eqp:vendor:domain:priority','alarm_j:eqp:vendor:domain:priority'], ['alarm_k:eqp:vendor:domain:priority',''alarm_l:eqp:vendor:domain:priority'], ['alarm_m:eqp:vendor:domain:priority',''alarm_n:eqp:vendor:domain:priority'], ['alarm_i:eqp:vendor:domain:priority',''alarm_k:eqp:vendor:domain:priority]].

[0057] The pattern list Pattern is initialized as an empty list; The match list Matches is initialized as a list containing the starting position of each alarm sequence.

[0058] The minimum length minlen of the sequence pattern is set as a; The maximum length maxlen of the sequence pattern is set as b.

[0059] In the scanning projection database stage, the function Def freq_rec(patt, matches) is defined for recursively mining master-slave alarm relationships.

[0060] The computer device checks the alarm pattern length |L|, i.e., the length of |Patt|: if |Patt|>minlen, then Patt is recorded to the result list Result, and if |Patt|<=maxlen, then it is returned.

[0061] Each alarm item item is traversed, and the match information {Matches} of item in each row is recorded; If the length of the match information {Matches} of the alarm item does not satisfy the minimum support {minsup}, then the item is deleted; The item {item} is attached to {patt} to form a new pattern {newpatt}, and Newmatches is set as the match information Matches of each row where the single item (item) is located. For each {newpatt}, construct the projection database of t{newpatt} and recursively call {freq_rec}({newpatt}, {Newmatches}).

[0062] In the mining phase, the initial call freq_rec([], Matches) starts the mining process.

[0063] In each recursive call, the alert pattern is determined based on the current pattern patt and the matching information Matches.

[0064] If the length of the current alert pattern meets the minimum length requirement, it is added to the result list.

[0065] If the length of the alert pattern does not exceed the maximum length limit, continue recursive mining; otherwise, terminate the mining process.

[0066] In the result output phase, the final output is stored in a data structure named "Results", which is defined as a list of tuples List[Tuple[int, Pattern]], where each tuple contains two key information: Integer type (Int): This field represents the frequency of the specific alert pattern mined. This frequency is used to quantify the statistical significance of the sequence pattern in the data set, providing a basis for further analysis and decision-making.

[0067] Alert pattern (Pattern): This field is an instance of an alert pattern, specifically represented as an ordered set of alert items. Each alert pattern represents the master-slave alert relationship within a specific time window, following the established rules and priority sorting.

[0068] Illustratively, the output result can be ["MAC address migration between ports: switch: vendor A: 110000: virtualization: 1", "interface DOWN: switch: vendor A: 110000: virtualization: 2"].

[0069] After the alarm mode extraction of each alarm data set under different deduplication time windows through the above process, the alarm mode set under each deduplication time window can be obtained. If the alarm mode set under different deduplication time windows exists the same alarm mode, the alarm mode in the alarm mode set with smaller length of deduplication time window is reserved. Illustratively, if the alarm mode 1 is contained in the alarm mode set 1 under the deduplication time window 1 and the alarm mode set 2 under the deduplication time window 2, and the length of the deduplication time window 1 is smaller than the length of the deduplication time window 2, the alarm mode 1 in the alarm mode set 1 is reserved, and the alarm mode 1 in the alarm mode set 2 is deleted, so as to improve the causality of the alarm relationship between the master device and the slave device, and avoid information redundancy.

[0070] In a possible implementation, after obtaining the alarm patterns, the computer device can further classify the alarm patterns based on attribute information corresponding to the master-slave alarm items. For example, the alarm patterns can be classified based on device types corresponding to the master-slave alarm items and layers to which the devices belong. Table 1 shows classification results of the alarm patterns based on the device types. As shown in Table 1, when the device types of the master-slave alarm items are the same, the alarm pattern is determined as a same-network-element alarm pattern. When the device types of the master-slave alarm items are different, and the master-slave alarm items are both in a VNF (Virtualized Network Function) layer, the alarm pattern is determined as a cross-network-element alarm pattern. When the device types of the master-slave alarm items are different, and the master-slave alarm items are both in a PIM (Physical Infrastructure Management) layer or both in a VIM (Virtualized Infrastructure Management) layer, the alarm pattern is determined as a cross-system alarm pattern. When the device types of the master-slave alarm items are different, and the master-slave alarm items are not in the same layer, the alarm pattern is determined as a cross-layer alarm pattern. When none of the above conditions is met, the alarm pattern is determined as another alarm pattern. The PIM layer includes rack-mounted servers, switches, routers, distributed storage, and firewalls. The VIM layer includes hosts and virtual machines. The VNF layer includes an AMF (Access and Mobility Management Function) layer, an SMF (Session Management Function) layer, an NSSF (Network Slice Selection Function) layer, a PCF (Policy Control Function) layer, an NRF (Network Repository Function) layer, a UPF (User Plane Function) layer, a UDM (Unified Data Management) layer, a UDR (Unified Data Repository), an AUSF (Authentication Server Function) layer, and a CHF (Charging Function) layer.

[0071] Table 1

[0072] It should be noted that different classification results can be obtained based on different classification criteria of the alarm mode, and the present application does not limit and enumerate this.

[0073] In a possible implementation, after obtaining the alarm modes, the computer device can further perform confidence weighting on the alarm modes, and the process can be implemented as follows: confidence weighting is performed on the master-slave alarm relationship based on the occurrence frequency of the alarm mode and the total occurrence frequency of the main alarm item in the alarm mode; and / or, confidence weighting is performed on the master-slave alarm relationship based on the length of the search time window corresponding to the master-slave alarm relationship, and the confidence weights corresponding to different search time windows are different.

[0074] In the confidence weighting performed on the master-slave alarm relationship based on the occurrence frequency of the alarm mode and the total occurrence frequency of the main alarm item in the alarm mode, the confidence weight is the ratio of the occurrence frequency of the alarm mode to the total occurrence frequency of the main alarm item in the alarm mode.

[0075] In the confidence weighting performed on the master-slave alarm relationship based on the length of the search time window corresponding to the master-slave alarm relationship, the computer device can assign the confidence weight corresponding to the different search time windows to the corresponding alarm mode.

[0076] In the confidence weighting performed based on the two manners, the confidence weight is the product of the weights in the two manners. Illustratively, the confidence weight 1 is calculated based on the ratio of the occurrence frequency of the alarm mode to the total occurrence frequency of the main alarm item in the alarm mode, the confidence weight 2 is determined based on the search time window, and the confidence weight corresponding to the alarm mode = confidence weight 1 * confidence weight 2. Illustratively, Table 2 shows the master-slave alarm relationship after confidence weighting.

[0077] Table 2

[0078] bi In summary, the alarm relationship mining method provided in this application obtains historical alarm data and master-slave hierarchical data. First, it groups the alarm data by device and alarm item, and then deduplicates the alarm data based on the event occurrence time. Next, it uses the deduplicated data and master-slave relationships to generate an alarm sequence for the master alarm data. Finally, it determines the master-slave alarm relationship based on the alarm sequence. This method, by combining device, alarm item, and time factors for refined deduplication, significantly improves the accuracy of data deduplication and adaptability to complex network environments, effectively reducing the interference of alarm redundancy on relationship mining. Furthermore, by introducing master-slave hierarchical data to construct alarm sequences, it can more accurately reveal the causal or correlational relationships between master device alarms and slave device alarms, thereby enhancing the targeting and reliability of alarm relationship mining and providing strong support for maintenance personnel to quickly locate problems and make intervention decisions.

[0079] With Figure 1 The alarm relationship mining method shown corresponds to the following: Figure 2 The diagram illustrates an alarm relationship mining process provided in an exemplary embodiment of this application, such as... Figure 2 As shown, in the first stage, historical alarm data is grouped based on time and relationships to perform multi-dimensional data deduplication, resulting in optimized alarm data. This reduces noisy alarms, accurately filters out duplicate alarms, improves data processing efficiency and alarm accuracy, reduces resource consumption, and increases scalability. In the second stage, alarm sequences are generated based on master-slave hierarchical data and optimized alarm data. By introducing the master-slave hierarchical concept, redundant records are reduced, computing resources are saved, and targeted alarm sequences are created, making the alarm sequences more meaningful and providing more valuable information for subsequent alarm relationship mining. In the third stage, alarm relationship mining is performed based on the alarm sequences. Through the priority construction of master alarms and the optimization mining of master-slave alarm relationships, alarm sequences are effectively classified and prioritized, which reduces noise interference in data processing and reduces data volume, making the alarm relationship discovery process more accurate and efficient, thereby improving the accuracy of alarm analysis. In the fourth stage, alarm relationship types are determined, and alarm relationship confidence weighting is applied to improve the accuracy and business relevance of alarm relationships.

[0080] Figure 3 This illustration shows a block diagram of an alarm relationship mining apparatus provided in an exemplary embodiment of this application. This apparatus can be applied in a computer device to perform tasks such as... Figure 1 All or part of the steps in the illustrated embodiments, such as Figure 3 As shown, the alarm relationship mining device may include the following modules.

[0081] The data acquisition module 310 is configured to acquire historical alarm data and master-slave hierarchical data, the master-slave hierarchical data being used to indicate a master-slave relationship between a master device and a slave device. The data deduplication module 320 is configured to, in a data grouping unit, perform alarm data deduplication on the historical alarm data based on an event occurrence time, to obtain deduplicated historical alarm data, the same data grouping containing historical alarm data from the same device and with the same alarm item. The sequence generation module 330 is configured to generate an alarm sequence corresponding to each master alarm data based on the deduplicated historical alarm data and the master-slave hierarchical data, the master alarm data being the historical alarm data corresponding to the master device in the historical alarm data. The relationship determination module 340 is configured to determine a master-slave alarm relationship based on the alarm sequence corresponding to each master alarm data.

[0082] In a possible implementation, the data deduplication module 320 includes: The grouping submodule is configured to perform data grouping on the historical alarm data based on target attribute information of each historical alarm data, to obtain a data grouping set, the data grouping set containing a plurality of data groupings; the target attribute information including device name information and alarm title information. The sorting submodule is configured to sort historical alarm data in each data grouping according to an event occurrence time, to obtain each sorted data grouping. The difference calculation submodule is configured to calculate an occurrence time difference between adjacent historical alarm data in each sorted data grouping. The deduplication submodule is configured to perform data deduplication on the historical alarm data based on an occurrence time difference between the deduplication time window with different time length values and the adjacent historical alarm data, to obtain the historical alarm data under different deduplication time windows.

[0083] In a possible implementation, the sequence generation module 330 includes: The data acquisition submodule is configured to, for each master alarm data, acquire slave alarm data corresponding to each master alarm data in a search time window, the slave alarm data being the historical alarm data corresponding to the slave device in the historical alarm data. The sequence generation submodule is configured to generate the alarm sequence corresponding to each master alarm data based on each master alarm data in the search time window and the slave alarm data corresponding to each master alarm data.

[0084] In a possible implementation, the apparatus further includes: The sequence deleting module is configured to, after the sequence generating module 330 generates alarm sequences corresponding to each master alarm data based on the deduplicated historical alarm data and the master-slave hierarchy data, and in response to a length of a target alarm sequence being less than a length threshold, delete the target alarm sequence, the target alarm sequence being any one of the alarm sequences corresponding to each master alarm data.

[0085] In a possible implementation, the relationship determining module 340 includes: The mode counting sub-module is configured to, based on the alarm sequences corresponding to each master alarm data, extract and count occurrence frequencies of each alarm mode and mode lengths of each alarm mode, each alarm mode including a sequence composed of a plurality of continuous alarm items, the mode length being used to indicate a number of alarm items included in an alarm mode. The mode screening sub-module is configured to, in response to an occurrence frequency of a target alarm mode being less than a frequency threshold, or a mode length of the target alarm mode being less than a minimum length threshold, delete the target alarm mode, the target alarm mode being any one of the alarm modes. The relationship determining sub-module is configured to determine alarm modes other than the target alarm mode in each alarm mode as the master-slave alarm relationships.

[0086] In a possible implementation, a length of the search time window corresponds to a length of the deduplication time window. The apparatus further includes a weighting module configured to, after the relationship determining sub-module determines alarm modes other than the target alarm mode in each alarm mode as the master-slave alarm relationships, perform confidence weighting on each master-slave alarm relationship based on an occurrence frequency of an alarm mode and a total occurrence frequency of master alarm items in the alarm mode. And / or, Each master-slave alarm relationship is confidence-weighted based on a length of a search time window corresponding to the master-slave alarm relationship, different search time windows corresponding to different confidence weights.

[0087] In summary, the alarm relationship mining device provided by the embodiments of the present application, by acquiring historical alarm data and master-slave hierarchical data, first groups devices and alarm items as units and removes alarm data based on event occurrence time, then generates alarm sequences of master alarm data by using the de-duplicated data and master-slave relationship, and finally determines the master-slave alarm relationship based on the alarm sequences. Through the above device, fine de-duplication can be performed by combining devices, alarm items and time factors, which significantly improves the accuracy of data de-duplication and the adaptability to complex network environments, effectively reduces the interference of alarm redundancy on relationship mining; in addition, by introducing master-slave hierarchical data to construct alarm sequences, the causal or correlation relationship between master device alarms and slave device alarms can be more accurately revealed, thereby enhancing the pertinence and reliability of alarm relationship mining, and providing strong support for operation and maintenance personnel to quickly locate problems and make intervention decisions.

[0088] Figure 4 A structural block diagram of a computer device 400 is shown, which is an example embodiment of the present application and can be implemented as a server in the above-mentioned schemes of the present application. The computer device 400 includes a central processing unit (CPU) 401, a system memory 404 including a random access memory (RAM) 402 and a read-only memory (ROM) 403, and a system bus 405 connecting the system memory 404 and the central processing unit 401. The computer device 400 also includes a mass storage device 406 for storing an operating system 409, application programs 410 and other program modules 411. The system memory 404 and the mass storage device 406 mentioned above can be collectively referred to as a memory.

[0089] According to various embodiments of the present application, the computer device 400 can also run on a remote computer connected to a network such as the Internet. That is, the computer device 400 can be connected to a network 408 through a network interface unit 407 connected to the system bus 405, or can be connected to other types of networks or remote computer systems (not shown) using the network interface unit 407.

[0090] The memory also includes at least one instruction, at least one program, a code set or an instruction set, which is stored in the memory, and the central processing unit 401 implements all or part of the steps of the alarm relationship mining method shown in the above-mentioned various embodiments by executing the at least one instruction, at least one program, code set or instruction set.

[0091] Figure 5A structural block diagram of a computer device 500 is shown according to another example embodiment of the present application. The computer device 500 can be implemented as the terminal described above. For example, the computer device can be an Android terminal device. Generally, the computer device 500 includes a processor 501 and a memory 502. The memory 502 can include one or more computer-readable storage media for storing at least one instruction for being executed by the processor 501 to implement all or part of the steps of the alert relationship mining method according to the method embodiments of the present application.

[0092] In some embodiments, the computer device 500 can also optionally include a peripheral device interface 503 and at least one peripheral device. The processor 501, the memory 502 and the peripheral device interface 503 can be connected through a bus or a signal line. Each peripheral device can be connected to the peripheral device interface 503 through a bus, a signal line or a circuit board. Specifically, the peripheral device includes at least one of a radio frequency circuit 504, a display screen 505, a camera assembly 506, an audio circuit 507 and a power supply 508. In some embodiments, the computer device 500 further includes one or more sensors 509. The one or more sensors 509 include, but are not limited to, an acceleration sensor 510, a gyroscope sensor 511, a pressure sensor 512, an optical sensor 513 and a proximity sensor 514. Those skilled in the art can understand that the structure shown in the above Figure 5 The structure shown in the above does not constitute a limitation to the computer device 500, and can include more or less components than the diagram, or combine certain components, or adopt a different component arrangement.

[0093] In an example embodiment, a computer readable storage medium is also provided, which stores at least one computer program. The computer program is loaded and executed by a processor to implement all or part of the steps of the alert relationship mining method described above. For example, the computer readable storage medium can be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), a magnetic tape, a floppy disk and an optical data storage device, etc.

[0094] In an example embodiment, a computer program product is also provided, which includes a computer program stored on a non-transitory computer readable storage medium. The computer program includes program instructions, which, when executed by a computer, cause the computer to perform all or part of the steps of the embodiments shown in the above Figure 1 embodiments of the present application.

[0095] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the specification and examples be considered as exemplary only, with the true scope and spirit of the application being indicated by the following claims.

[0096] It is to be understood that the application is not limited to the precise construction herein disclosed and shown in the drawings, and that various modifications and changes can be made by those skilled in the art without departing from the scope of the application. The scope of the application is limited only by the claims that follow.

Claims

1. An alarm relationship mining method characterized by comprising: The method comprises: obtaining historical alarm data and master-slave hierarchical data, the master-slave hierarchical data being used to indicate a master-slave relationship between a master device and a slave device; in units of data groups, performing alarm data deduplication on the historical alarm data based on event occurrence time, to obtain deduplicated historical alarm data, the same data group containing historical alarm data from the same device and with the same alarm item; based on the deduplicated historical alarm data and the master-slave hierarchical data, generating alarm sequences corresponding to each master alarm data, the master alarm data being the historical alarm data corresponding to the master device in the historical alarm data; determining a master-slave alarm relationship based on the alarm sequences corresponding to each master alarm data.

2. The method of claim 1, wherein, The method comprises: grouping the historical alarm data based on target attribute information of each historical alarm data, to obtain a data grouping set, the data grouping set containing a plurality of data groups; the target attribute information includes device name information and alarm title information; in each data group, sorting the historical alarm data according to event occurrence time, to obtain each sorted data group; in each sorted data group, calculating the occurrence time difference between adjacent historical alarm data; based on the occurrence time difference between adjacent historical alarm data and deduplication time windows with different time length values, performing data deduplication on the historical alarm data, to obtain the historical alarm data under different deduplication time windows.

3. The method according to claim 1 or 2, characterized in that, The method comprises: for each master alarm data, obtaining slave alarm data corresponding to each master alarm data within a search time window, the slave alarm data being the historical alarm data corresponding to the slave device in the historical alarm data; based on each master alarm data within the search time window and the slave alarm data corresponding to each master alarm data, generating the alarm sequences corresponding to each master alarm data.

4. The method of claim 1, wherein, After generating the alarm sequences corresponding to each master alarm data based on the deduplicated historical alarm data and the master-slave hierarchical data, the method further comprises: in response to the length of a target alarm sequence being less than a length threshold, deleting the target alarm sequence, the target alarm sequence being any one of the alarm sequences corresponding to each master alarm data.

5. The method of claim 3, wherein, The method comprises: based on the alarm sequences corresponding to each master alarm data, extracting and counting the occurrence frequency of each alarm pattern and the pattern length of each alarm pattern, each alarm pattern containing a sequence composed of a plurality of consecutive alarm items, the pattern length being used to indicate the number of alarm items contained in the alarm pattern; In response to the occurrence frequency of the target alarm pattern being less than a frequency threshold, or the pattern length of the target alarm pattern being less than a minimum length threshold, the target alarm pattern is deleted, the target alarm pattern being any one of the alarm patterns; Alarm patterns other than the target alarm pattern in the alarm patterns are determined as the master-slave alarm relationship.

6. The method of claim 5, wherein, The length of the search time window corresponds to the length of the deduplication time window; After the alarm patterns other than the target alarm pattern in the alarm patterns are determined as the master-slave alarm relationship, the method further comprises: Based on the occurrence frequency of the alarm pattern and the total occurrence frequency of the master alarm item in the alarm pattern, the confidence of each master-slave alarm relationship is weighted. And / or, Based on the length of the search time window corresponding to each master-slave alarm relationship, the confidence of each master-slave alarm relationship is weighted, and different search time windows correspond to different confidence weights.

7. An alarm relation mining apparatus characterized by comprising: The device comprises: A data acquisition module configured to acquire historical alarm data and master-slave hierarchical data, the master-slave hierarchical data being used to indicate the master-slave relationship between master devices and slave devices; A data deduplication module configured to perform alarm data deduplication on the historical alarm data based on event occurrence time in data groups, to obtain deduplicated historical alarm data, and the same data group containing historical alarm data from the same device and with the same alarm item; A sequence generation module configured to generate alarm sequences corresponding to each master alarm data based on the deduplicated historical alarm data and the master-slave hierarchical data, the master alarm data being the historical alarm data corresponding to the master device in the historical alarm data; A relationship determination module configured to determine the master-slave alarm relationship based on the alarm sequences corresponding to each master alarm data.

8. A computer device, comprising: The computer device comprises a processor and a memory, and the memory stores at least one computer program, the at least one computer program is loaded and executed by the processor to implement the alarm relationship mining method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores at least one computer program, and the computer program is loaded and executed by the processor to implement the alarm relationship mining method according to any one of claims 1 to 6.

10. A computer program product, characterised in that, The computer program product comprises a computer program stored on a non-transitory computer readable storage medium, and the computer program comprises program instructions, when the program instructions are executed by a computer, the computer executes to implement the alarm relationship mining method according to any one of claims 1 to 6.

Images