Network fault root cause positioning method, device, equipment, medium and product

Abstract

The invention relates to the technical field of wireless networks, in particular to a network fault root cause positioning method and device, equipment, a medium and a product, and the method comprises the steps: taking an alarm network element as a sub-alarm network element when the alarm network element which gives out a fault alarm is detected, and recognizing whether a parent alarm network element exists in adjacent network elements of the sub-alarm network element, recording a connection relationship between the sub-alarm network element and the parent alarm network element, and generating a tracking sub-chain based on the connection relationship; taking the parent alarm network element as a new child alarm network element, and identifying whether the parent alarm network element exists in the adjacent network elements; and based on the hierarchical relationship, connecting the tracking sub-chains layer by layer to generate a complete fault tracking chain, and positioning the root cause alarm network element of the fault. According to the method, each sub-alarm network element is traced downwards step by step, a complete fault tracking chain is generated, fault root cause positioning is achieved, and flexibility and high efficiency are achieved. Through distributed calculation, the calculation amount is reduced, and the fault root cause positioning efficiency of a large-scale complex communication network is improved.

Description

Technical Field

[0001] This disclosure relates to the field of wireless network technology, and in particular to a method, apparatus, device, medium and product for locating the root cause of network faults. Background Technology

[0002] With the development of communication technology networks, the number of network equipment such as base stations, optical cables, and ring network switches built by various operators has increased rapidly, and the increase in quantity inevitably leads to an increase in alarm events for equipment failure.

[0003] Currently, most related technologies are based on knowledge graph models or traditional machine learning algorithms for fault location. However, technologies based on knowledge graph models rely on past human experience and are prone to problems such as insufficient data volume and low data quality, which seriously affect the fault delimitation and location effect. On the other hand, technologies based on traditional machine learning algorithms require centralized calculation of all alarm events, which not only results in low fault location efficiency but also in a relatively divergent fault location result, which is not conducive to fault troubleshooting. Summary of the Invention

[0004] In view of the above problems, this disclosure is made to provide a method, apparatus, device, medium and product for locating the root cause of network failures.

[0005] According to one aspect of this disclosure, a method for locating the root cause of a network failure is provided, comprising: When an alarm network element that has issued a fault alarm is detected, the alarm network element is designated as a sub-alarm network element. Based on the network element link topology diagram, it is identified whether a parent alarm network element exists among the neighboring network elements of the sub-alarm network element. The network element link topology diagram represents the connection and hierarchical relationship between network elements in the communication network. The neighboring network elements include peer network elements and lower-level network elements that are directly connected to the sub-alarm network element. The parent alarm network element is the neighboring network element that caused the sub-alarm network element to issue a fault alarm. If the parent alarm network element exists among the adjacent network elements, the connection relationship between the child alarm network element and the parent alarm network element is recorded, and a tracking sub-chain is generated based on the connection relationship; The parent alarm network element is treated as a new child alarm network element, and the step of identifying whether the parent alarm network element exists in the neighboring network elements of the child alarm network element is repeated until the parent alarm network element does not exist in the neighboring network elements. Based on the hierarchical relationship represented by the network element link topology diagram, each of the tracing sub-chains is connected layer by layer to generate a complete fault tracing chain; Based on the complete fault tracing chain, the root cause alarm network element that caused the network fault is located.

[0006] By searching the neighboring network elements of each sub-alarm network element and identifying its corresponding parent alarm network element, hierarchical tracing is achieved. By connecting each tracing sub-chain layer by layer, a complete fault tracing chain is generated, enabling root cause localization of network faults. This approach is flexible, efficient, and accurate, and is also suitable for root cause tracing of long service chains spanning multiple layers and domains. Compared to global correlation algorithms, distributed hierarchical tracing reduces computational load, improves the efficiency of root cause localization in large and complex communication networks, lowers the algorithm deployment cost of existing network management systems, meets the real-time requirements of fault diagnosis, and is also conducive to application in edge computing and distributed computing devices of future next-generation communication networks to achieve network fault delimitation and localization.

[0007] Furthermore, according to one aspect of the network fault root cause localization method of this disclosure, based on the network element link topology map, identifying whether there is a parent alarm network element among the neighboring network elements of the sub-alarm network element includes: Based on the network element link topology diagram, identify whether there is a target network element among the neighboring network elements of the sub-alarm network element; wherein, the target network element is the neighboring network element that issued the fault alarm; If the target network element is not present among the adjacent network elements, then it is confirmed that the parent alarm network element is not present among the adjacent network elements. If the target network element exists among the adjacent network elements, based on the preset alarm causality rule, the presence of a parent alarm network element among the adjacent network elements is identified by determining whether there is a causal relationship between the fault alarm issued by the target network element and the sub-alarm network element; wherein, the alarm causality rule is generated based on network operation protocol and historical experience.

[0008] By performing causal judgment on the target network element and its sub-alarm network elements, the true parent alarm network element can be identified. Not every fault alarm is necessarily a parent alarm network element, which helps to avoid generating incorrect tracing sub-chains that could affect the final root cause localization result.

[0009] Furthermore, according to one aspect of the network fault root cause localization method of this disclosure, based on the network element link topology map, identifying whether there is a parent alarm network element among the neighboring network elements of the sub-alarm network element includes: Based on the network element link topology diagram, obtain the sibling network element and the subordinate network element of the sub-alarm network element; Within the first preset time window, by identifying whether the lower-level network element issues a fault alarm, it is confirmed whether the parent alarm network element exists in the lower-level network element; After the second preset time window, by identifying whether the peer network element has issued a fault alarm, it is confirmed whether the parent alarm network element exists among the peer network elements.

[0010] By setting the alarm sequence time window, namely the first preset time window and the second preset time window, based on the time when the sub-alarm network element issues a fault alarm, sufficient time can be reserved for adjacent network elements. This avoids the situation where a fault alarm is issued after the adjacent network element has been identified, which helps to shorten the calculation time and improve the positioning efficiency.

[0011] Furthermore, according to a network fault root cause localization method of one aspect of this disclosure, based on the network element link topology diagram, the method obtains the peer network element and the lower-level network element of the sub-alarm network element, including: Based on the network element link topology diagram, the network layer in which the sub-alarm network element is located is determined: wherein, the network layer is divided based on the network structure of the communication network, and the network layer includes the service layer, bearer layer and transport layer from top to bottom; Based on the network layer in which the sub-alarm network element is located, the peer network element and the lower-level network element are identified from the network elements directly connected to the sub-alarm network element; wherein, the peer network element is the network element at the same network layer as the sub-alarm network element, and the lower-level network element is the network element at the next lower level of the network layer.

[0012] By tracing down the network hierarchy level, only sibling and lower-level network elements of the sub-alarm network element are identified, without tracing to higher-level network elements. This aligns with fault alarm logic, avoids wasting redundant computing power, and improves the efficiency of root cause identification and location of network faults. If the fault alarm occurs at the service layer, tracing only extends to the directly connected service layer and bearer layer; if the fault occurs at the bearer layer, tracing only extends to the directly connected bearer layer and transport layer, without tracing to the upper-level service layer.

[0013] Furthermore, the network fault root cause localization method according to one aspect of this disclosure also includes: If the parent alarm network element does not exist among the adjacent network elements, then the alarm network element is an independent alarm network element, and the alarm network element is confirmed as the root cause alarm network element of the network failure.

[0014] By identifying alarm network elements as independent alarm network elements, the root cause of the network failure can be directly confirmed, which is beneficial for troubleshooting.

[0015] Furthermore, according to a network fault root cause localization method of one aspect of this disclosure, before treating the alarm network element as a sub-alarm network element, the method further includes: Identify whether the alarm network element is associated with a historical fault alarm that has already occurred; It was confirmed that the alarm network element was not associated with the historical fault alarm.

[0016] By identifying whether the alarming network element is associated with a historical fault alarm that has already occurred, if so, it means that the current fault alarm and the historical fault alarm are of the same root cause. In this case, the root cause can be located directly, which helps to avoid wasting computing resources and improve the efficiency of fault root cause location.

[0017] According to another aspect of this disclosure, a network fault root cause localization device is provided, comprising: The network element search module is used to, when an alarm network element that has issued a fault alarm is detected, identify the alarm network element as a sub-alarm network element, and, based on the network element link topology map, identify whether there is a parent alarm network element among the neighboring network elements of the sub-alarm network element; wherein, the network element link topology map represents the connection relationship and hierarchical relationship between network elements in the communication network, the neighboring network elements include peer network elements and lower-level network elements directly connected to the sub-alarm network element, and the parent alarm network element is the neighboring network element that caused the sub-alarm network element to issue a fault alarm; The tracking sub-chain generation module is used to record the connection relationship between the sub-alarm network element and the parent alarm network element when the parent alarm network element exists in the adjacent network elements, and to generate a tracking sub-chain based on the connection relationship; The loop module is used to repeatedly execute the step of identifying whether there is a parent alarm network element among the neighboring network elements of the child alarm network element, using the parent alarm network element as a new child alarm network element, until there is no parent alarm network element among the neighboring network elements. The sub-chain concatenation module is used to connect each of the tracking sub-chains layer by layer based on the hierarchical relationship represented by the network element link topology diagram to generate a complete fault tracing chain. The fault location module is used to locate the root cause alarm network element that causes the network fault based on the complete fault tracing chain.

[0018] According to another aspect of this disclosure, a computer device is provided, including a memory, a processor, and a computer program stored in the memory, the processor executing the computer program to implement the method of one aspect above.

[0019] According to another aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the method of one aspect above.

[0020] According to another aspect of this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the method of the above-described aspect.

[0021] It should be understood that both the foregoing general description and the following detailed description are exemplary and intended to provide further illustration of the claimed technology. Attached Figure Description

[0022] The above and other objects, features, and advantages of this disclosure will become more apparent from the more detailed description of the embodiments thereof in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this disclosure and form part of the specification. They are used together with the embodiments of this disclosure to explain the disclosure and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0023] Figure 1 This is a flowchart illustrating a network fault root cause localization method according to an embodiment of the present disclosure.

[0024] Figure 2 This is a schematic diagram of partial network element connection relationships in a network element link topology diagram according to an embodiment of the present disclosure.

[0025] Figure 3 This is a flowchart illustrating a single-level adjacent tracing method according to an embodiment of the present disclosure.

[0026] Figure 4 The diagram illustrates a multi-network element parallel computing application according to an embodiment of this disclosure.

[0027] Figure 5 This is a schematic diagram illustrating the calculation logic of the parent alarm network element according to an embodiment of this disclosure.

[0028] Figure 6 This is a schematic diagram illustrating the adjacent tracing results applied according to an embodiment of this disclosure.

[0029] Figure 7 This is a diagram illustrating a network element failure topology where a base station goes out of service due to an interruption of the transmission optical cable, according to an embodiment of this disclosure.

[0030] Figure 8 This is a flowchart illustrating another application of the network fault root cause localization method according to an embodiment of the present disclosure.

[0031] Figure 9 This is a schematic diagram of the structure of a network fault root cause localization device according to an embodiment of the present disclosure.

[0032] Figure 10 This is a schematic diagram illustrating the structure of a computer device according to an embodiment of the present disclosure.

[0033] Figure 11 This is a schematic diagram illustrating a computer program product according to an embodiment of the present disclosure. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of this disclosure more apparent, exemplary embodiments according to this disclosure will now be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this disclosure, and not all embodiments of this disclosure. It should be understood that this disclosure is not limited to the exemplary embodiments described herein.

[0035] With the deployment of 5G networks, the number of network infrastructure devices such as base stations, fiber optic cables, and ring network switches built by various operators has increased rapidly. This increase in equipment inevitably leads to a rise in equipment fault alarms. However, traditional network management and maintenance work by operators heavily relies on the experience of their own engineers and equipment manufacturers' engineers, requiring technical backgrounds and a deep understanding of network structure for accurate fault location. Because engineers from operators and equipment manufacturers possess different information and resources, many faults require cross-disciplinary and cross-departmental solutions. Each fault ticket may involve multiple technologies and equipment, requiring multiple processes and analysis and judgment by engineers from different specialties regarding their respective areas of expertise. Therefore, operators urgently need a digital, intelligent, and adaptive fault location and diagnosis method.

[0036] Currently, most related technologies are based on knowledge graph models or traditional machine learning algorithms for fault location, but they have the following drawbacks: (1) Knowledge graph-based model: It relies on knowledge question-and-answer pairs formed by extracting past fault operation and maintenance experience. Since it relies on human experience and the equipment troubleshooting standard process provided by the manufacturer, the dataset that makes up the knowledge graph is prone to problems such as insufficient data volume and low data quality, which affects the fault delimitation and localization effect. At the same time, as operators upgrade infrastructure equipment, the model knowledge base needs to be updated manually in real time, which increases the complexity and workload of system maintenance and reduces the performance of the model; (2) Based on traditional machine learning algorithms: This requires inputting all alarm information and performing real-time calculations using one or more deep learning algorithms to establish the sequence relationship of each faulty network element and the network topology. However, the existing network structures of various operators are complex, so this algorithm is highly complex, making fault delimitation and location in large-scale networks difficult. On the other hand, this algorithm often requires high-level centralized computing resources, resulting in high deployment costs and difficulty in meeting the actual production needs of extremely high real-time fault diagnosis requirements.

[0037] The above description, with reference to the accompanying drawings, illustrates a network fault root cause localization method, apparatus, device, medium, and product according to embodiments of the present disclosure. By searching the neighboring network elements of each sub-alarm network element and identifying its corresponding parent alarm network element, hierarchical downward tracing is achieved. By connecting each tracing sub-chain layer by layer, a complete fault tracing chain is generated, enabling root cause localization of network faults. Compared to the global correlation algorithm, distributed hierarchical tracing reduces computational load, improves the efficiency of fault root cause localization in large and complex communication networks, reduces the algorithm deployment cost of existing network management systems, meets the real-time requirements of fault diagnosis, and is also beneficial for application on edge computing and distributed computing devices in future next-generation communication networks to achieve network fault delimitation and localization.

[0038] To facilitate understanding of this embodiment, a detailed description of the network fault root cause localization method disclosed in this disclosure is provided first. The execution entity of the network fault root cause localization method provided in this disclosure is generally a computer device with certain computing capabilities. This computer device may include, for example, a terminal device, a server, or other processing devices. The terminal device may be a user equipment (UE), mobile device, user terminal, terminal, cellular phone, cordless phone, personal digital assistant (PDA), handheld device, computing device, vehicle-mounted device, wearable device, etc. In some possible implementations, this network fault root cause localization method can be implemented by a processor calling computer-readable instructions stored in memory.

[0039] like Figure 1 The diagram shows a flowchart of a network fault root cause localization method provided in this embodiment of the present disclosure. The method includes steps S101-S105: S101: Establish a network element link topology diagram based on the physical and logical connections of each network element in the communication network.

[0040] In one or more embodiments, the network element link topology diagram established in S101 includes multiple network layers. Specifically, according to the network structure of the communication network, the network layers can be divided into service layer, bearer layer, and transport layer from top to bottom. Among them, the devices (network elements) in the service layer are mostly used to process user signaling protocols and data, such as AMF, MMEA, etc. The devices (network elements) in the bearer layer are mostly used to connect to the devices in the service layer and provide them with data transmission networks, such as TOR, EOR, switches, routers, etc. The devices (network elements) in the transport layer are mostly used to connect to the devices in the bearer layer and provide them with the lowest-level transmission channel, such as PTN, SPN, OTN, etc. In addition, there is a dynamic environment layer below the transport layer. The devices (network elements) in the dynamic environment layer are mostly used to provide the basic physical environment for all other network devices, such as air conditioners, power equipment, etc.

[0041] S102: A monitoring system based on a communication network, which monitors whether network elements issue fault alarms.

[0042] S103: When an alarm network element that has issued a fault alarm is detected, single-level adjacent tracing is performed starting from the alarm network element to generate one or more tracing sub-chains.

[0043] Specifically, such as Figure 2 The diagram shows a partial network element connection relationship in the network element link topology. When network element A issues a fault alarm starting at time t, based on the network element link topology, it first checks whether network element A is associated with any earlier alarm events. If there is no association, it searches for fault alarms in directly connected network elements (network elements B and D) of network element A within a time window of length m minutes. If no alarm is detected, network element A is marked as an independent alarm network element and recorded in the database. If network element B issues an alarm, the connection relationship between network element A and alarm network element B is recorded, and a corresponding tracing sub-chain is generated. Then, after a time window of length n minutes, it checks whether directly connected network elements C1 and C2 of network element B and directly connected network elements D1 and D2 of network element A have issued fault alarms. The connection relationships of the network elements that issued fault alarms are recorded in the database, and corresponding tracing sub-chains are generated.

[0044] In this embodiment, this step only performs single-level tracing on adjacent network elements. The tracing process does not depend on the tracing results of other network elements. Therefore, when facing multiple fault alarm concurrent scenarios, distributed concurrent tracing can be performed to form multiple tracing sub-chains. The algorithm is simple and easy to implement, and has flexibility, efficiency and accuracy.

[0045] S104: Based on the network element link topology diagram, all tracing sub-chains are connected layer by layer to form a complete fault tracing chain, thereby locating the root cause alarm network element.

[0046] S105: Analyze the fault alarms of the root cause alarm network elements, and deduce the root cause of the network fault based on the alarm type and the network parameter index query results.

[0047] The fault location method in this embodiment, based on existing fault alarm monitoring, performs automated analysis and source tracing of fault alarms, compressing a large number of alarm correlations into a single root cause alarm. This improves the efficiency of fault monitoring during network operation and maintenance, reduces fault troubleshooting time, and enhances the overall efficiency of fault recovery. Compared to existing fault location methods for Internet distributed systems, it eliminates the need for modeling and analyzing historical data and fault occurrence characteristics, significantly reducing application costs. It also addresses issues such as low direct correlation rates in subjective fault delimitation results and low interpretability of traditional fault delimitation models.

[0048] In one or more embodiments, such as Figure 3The diagram shows a flowchart of a single-level adjacent tracing method, combined with... Figure 2 The diagram showing the partial network element connection relationships includes the following S301-S310: S301: Continuously monitor network elements in the communication network and detect that network element A issues a fault alarm starting from time t.

[0049] S302: Based on the network element link topology diagram, first check whether network element A is associated with other alarm events that occurred earlier.

[0050] S303: If network element A is not associated with other earlier alarm events, proceed to S304; otherwise, end the tracing process for network element A.

[0051] S304: Search for neighboring network elements of network element A to determine whether there are any alarms in the network elements directly connected to network element A.

[0052] S305: If no adjacent network element has an alarm within a time window of m minutes, mark network element A as an independent alarm network element and record it in the database. This indicates that network element A is the root cause alarm network element, and the tracing process for network element A ends.

[0053] S306: If an alarm is detected in network element B within m minutes, then A will be... The connection relationship of B is recorded in the database, and a tracking subchain A is generated. B.

[0054] S307: After a time window of n minutes, search for whether network elements C1, C2 and network elements D1, D2 have alarms.

[0055] S308: If there are no alarms in network elements C1 and C2, then network element B is an independent alarm network element, i.e., the root cause alarm network element; if there are alarms in network elements C1 and C2, then the corresponding alarm-containing network element B will be... C1, B C2 is recorded in the database, and a tracking subchain B is generated. C1, B C2.

[0056] Specifically, starting from network elements C1 and C2 respectively, the system searches for whether there are alarms in the network elements directly connected to them and generates corresponding tracing sub-chains until the independent alarm network element is found.

[0057] S309: If alarms exist in network elements D1 and D2, then the corresponding alarm A will be... D1、A D2 is recorded in the database, and a tracking subchain A is generated. D1、A D2.

[0058] S310: Then, using network elements D1 and D2 as the starting points for tracing, search for whether there are alarms in the network elements directly connected to them, and generate corresponding tracing sub-chains until an independent alarm network element is found.

[0059] It should be noted in this implementation that, depending on the actual environment or application, there may be one or more network elements causing the root cause alarm of network element A, and there may also be one or more root causes of network failure. In addition, network element A is directly connected to network element D at the same level and network element B at the lower level. Since network element D and A are at the same network level, there is a certain probability that the fault alarm of network element D is caused by network element A. However, as a lower-level network element, the probability that the fault alarm of network element B is caused by network element A is very small. Therefore, in order to improve the calculation efficiency, this embodiment prioritizes the calculation of lower-level network element B.

[0060] This embodiment employs a root cause localization method using parallel computation across multiple network elements, such as... Figure 4 The diagram illustrates parallel computing across multiple network elements, including processes 1, 2, and 3. Starting from each alarm network element, it traces downwards to identify faults in its peer and lower-level network elements. Multiple processes operate independently, offering flexibility, efficiency, and accuracy. It is also suitable for root cause tracing of faults in long service chains spanning multiple layers and domains. Based on the distributed alarm computing results, the results are sequentially linked to the end of the associated alarm chain, resulting in a complete fault tracing chain, ultimately pinpointing the root cause alarm network element.

[0061] Specifically, the downward single-level tracing described in this embodiment refers to tracing down the network layer. For example, if the network element that issued the fault alarm is in the service layer, then the calculation will only trace back to the directly connected service layer and bearer layer. If the network element that issued the fault alarm is in the bearer layer, then the distributed calculation will only trace back to the directly connected bearer layer and transport layer, and will not trace back to the upper service layer.

[0062] according to Figure 3As shown in the single-level adjacent tracing process, this embodiment treats each alarm network element as a sub-alarm network element. Starting from each sub-alarm network element, and combining the alarm time t and a preset time window, tracing is performed to the adjacent network elements (lower-level network elements and peer network elements) of the alarm network element to form a tracing sub-chain. Then, a complete fault tracing chain is generated by connecting them level by level to obtain all alarm network elements belonging to the same relationship. This involves alarms issued simultaneously by adjacent network elements within a time window before and after the sub-alarm network element alarms. Here, "adjacent" refers to a direct connection relationship with the alarm network element, including physical direct connection and logical direct connection. Physical direct connection refers to the direct connection between two network elements through a physical medium (such as optical fiber, copper cable, wireless signal, etc.). This connection method ensures that data can be directly transmitted between the two network elements without going through other intermediate devices. Logical direct connection refers to the use of various technologies such as virtual networks, tunnels, routing protocols, software-defined networks, network address translation, cloud services, network bridging, network interface card virtualization, and network function virtualization to achieve logical connections and create flexible and dynamic direct connections between different physical networks.

[0063] like Figure 5 The diagram shows the calculation logic of the parent alarm network element. When both neighboring network elements B and D of the child alarm network element A have alarms, it is necessary to infer which of B and D is the true parent alarm network element of the child alarm network element A based on the alarm causality rule. The alarm causality rule can be derived from the meaning represented by the alarm itself, the equipment knowledge base, or expert experience. The true parent alarm network element of the child alarm network element A may be one or more.

[0064] according to Figure 3 The single-level adjacent traceability process, combined with Figure 4 The results of adjacent tracing are obtained, such as Figure 6 The diagram illustrates the adjacent tracing results. Specifically, network element A is considered a child alarm network element, and after tracing calculation, its parent alarm network element is network element B; network element B is considered a child alarm network element, and after tracing calculation, its parent alarm network element is network element E; network element E is considered a child alarm network element, and after tracing calculation, its parent alarm network element is network element F. Connecting the alarm network elements sequentially yields a complete fault tracing chain: A B E Therefore, we can conclude that network element F is the root alarm network element of network element A.

[0065] Based on the above embodiments, this embodiment provides an application example.

[0066] like Figure 7 The diagram shows a network element fault topology diagram for a base station outage caused by a transmission optical cable interruption. This embodiment takes the delineation and location process of this actual fault as an example to explain in detail the root cause location process of single-level adjacent tracing and step-by-step serial connection of faults.

[0067] (1) By using a single-level adjacent tracing method, a tracing sub-chain is generated according to the preset time window length.

[0068] The time window length can be determined based on actual needs or the actual connection relationships of network elements in the network link topology diagram, such as 5 minutes, 10 minutes, etc. Specifically, the tracking sub-chains are: base station... PTN1, PTN1 PTN2, PTN1 PTN9, PTN2 PTN3, PTN9 PTN8, PTN3 PTN4, PTN8 PTN7.

[0069] (2) Tracing sub-chains step by step and root cause tracing.

[0070] Based on the aforementioned network element-level alarm association records, including base station outage alarms, PTN (Transmission Network Node) disconnection alarms, and PTN LOS (Lost in Service) alarms, these alarms are matched against pre-set alarm association rules. Based on alarm causality rules, a possible causal relationship can be derived between these three types of alarms: Transmission LOS (parent alarm). Transmission disconnected (child alarm), transmission disconnected (parent alarm) Base station out of service (sub-alarm).

[0071] The complete fault tracing chain obtained by cascading the subchains together is as follows: base station PTN1 PTN2 PTN3 PTN4; base station PTN1 PTN9 PTN8 PTN7.

[0072] This embodiment yields two complete fault tracing chains, indicating that there are two root cause alarm network elements that caused this base station outage: PTN4 and PTN7. However, since PTN4 and PTN7 are two network elements, both of them are LOS alarms, the root cause of the base station outage can be located to transmission LOS.

[0073] Based on the above embodiments, this embodiment also provides a method for locating the root cause of network faults, such as... Figure 8 The diagram shown is another flowchart for network fault root cause localization methods, including S801-S805: S801: When an alarm network element that has issued a fault alarm is detected, the alarm network element is treated as a sub-alarm network element. Based on the network element link topology, it is determined whether a parent alarm network element exists among the neighboring network elements of the sub-alarm network element.

[0074] The network element link topology diagram represents the connection and hierarchical relationship between network elements in the communication network. Adjacent network elements include peer network elements and lower-level network elements that are directly connected to the child alarm network element. The parent alarm network element is the adjacent network element that caused the child alarm network element to issue a fault alarm.

[0075] S802: When there is a parent alarm network element among the adjacent network elements, record the connection relationship between the child alarm network element and the parent alarm network element, and generate a tracking sub-chain based on the connection relationship.

[0076] S803: Treat the parent alarm network element as a new child alarm network element, and repeat S801-S802 until there is no parent alarm network element among the adjacent network elements.

[0077] S804: Based on the hierarchical relationship represented by the network element link topology diagram, each tracing sub-chain is connected layer by layer to generate a complete fault tracing chain.

[0078] S805: Based on a complete fault tracing chain, locate the root cause alarm network element that causes network faults.

[0079] By searching the neighboring network elements of each sub-alarm network element and identifying its corresponding parent alarm network element, hierarchical tracing is achieved. By connecting each tracing sub-chain layer by layer, a complete fault tracing chain is generated, enabling root cause localization of network faults. This approach is flexible, efficient, and accurate, and is also suitable for root cause tracing of long service chains spanning multiple layers and domains. Compared to global correlation algorithms, distributed hierarchical tracing reduces computational load, improves the efficiency of root cause localization in large and complex communication networks, lowers the algorithm deployment cost of existing network management systems, meets the real-time requirements of fault diagnosis, and is also conducive to application in edge computing and distributed computing devices of future next-generation communication networks to achieve network fault delimitation and localization.

[0080] In one or more embodiments, S801 identifies whether a parent alarm network element exists among the neighboring network elements of a sub-alarm network element based on the network element link topology map, including: Based on the network element link topology diagram, identify whether there is a target network element among the neighboring network elements of the sub-alarm network element; where the target network element is the neighboring network element that issued the fault alarm. If the target network element does not exist in the adjacent network elements, then it is confirmed that there is no parent alarm network element in the adjacent network elements. If a target network element exists among the adjacent network elements, based on the preset alarm causality rules, the presence of a parent alarm network element among the adjacent network elements is identified by judging whether there is a causal relationship between the fault alarms issued by the target network element and the sub-alarm network element; wherein, the alarm causality rules are generated based on network operation protocols and historical experience.

[0081] In one or more embodiments, S801 identifies whether a parent alarm network element exists among the neighboring network elements of a sub-alarm network element based on the network element link topology map, including: Based on the network element link topology diagram, obtain the sibling network elements and subordinate network elements of the sub-alarm network element; Within the first preset time window, by identifying whether the lower-level network element issues a fault alarm, it is confirmed whether the parent alarm network element exists in the lower-level network element; After the second preset time window, the presence of a parent alarm network element is confirmed by identifying whether a fault alarm is issued by a peer network element.

[0082] In one or more embodiments, based on the network element link topology diagram, the sibling and subordinate network elements of the sub-alarm network element are obtained, including: Based on the network element link topology diagram, the network layer of the sub-alarm network element is determined: the network layer is divided based on the network structure of the communication network, and the network layer includes the service layer, bearer layer and transport layer from top to bottom. Based on the network hierarchy of the sub-alarm network element, peer network elements and lower-level network elements are identified from the network elements directly connected to the sub-alarm network element; among them, peer network elements are network elements at the same network hierarchy as the sub-alarm network element, and lower-level network elements are network elements at the next lower level of the network hierarchy.

[0083] In one or more embodiments, it further includes: If there is no parent alarm network element among the adjacent network elements, then the alarm network element is an independent alarm network element, and the alarm network element is confirmed as the root cause alarm network element of the network failure.

[0084] In one or more embodiments, before using the alarm network element as a sub-alarm network element, the method further includes: Identify whether the alarming network element is associated with a historical fault alarm that has already occurred; It was confirmed that the alarming network element was not associated with historical fault alarms.

[0085] According to another aspect of the embodiments of this disclosure, a network fault root cause localization device is provided, such as... Figure 9 As shown, the device includes: The network element search module 901 is used to identify whether a parent alarm network element exists among the neighboring network elements of the child alarm network element when an alarm network element that has issued a fault alarm is detected. The network element link topology map represents the connection relationship and hierarchical relationship between network elements in the communication network. The neighboring network elements include the same-level network elements and lower-level network elements that are directly connected to the child alarm network element. The parent alarm network element is the neighboring network element that caused the child alarm network element to issue a fault alarm. The tracking sub-chain generation module 902 is used to record the connection relationship between the child alarm network element and the parent alarm network element when there is a parent alarm network element in the adjacent network elements, and generate a tracking sub-chain based on the connection relationship. The loop module 903 is used to repeatedly execute the step of identifying whether there is a parent alarm network element in the neighboring network elements of the child alarm network element, using the parent alarm network element as a new child alarm network element, until there is no parent alarm network element in the neighboring network elements. The sub-chain concatenation module 904 is used to connect each tracing sub-chain layer by layer based on the hierarchical relationship represented by the network element link topology diagram to generate a complete fault tracing chain. The fault location module 905 is used to locate the root cause alarm network element that causes the network fault based on the complete fault tracing chain.

[0086] In one or more embodiments, the network element search module 901 is used for: Based on the network element link topology diagram, identify whether there is a target network element among the neighboring network elements of the sub-alarm network element; where the target network element is the neighboring network element that issued the fault alarm. If the target network element does not exist in the adjacent network elements, then it is confirmed that there is no parent alarm network element in the adjacent network elements. If a target network element exists among the adjacent network elements, based on the preset alarm causality rules, the presence of a parent alarm network element among the adjacent network elements is identified by judging whether there is a causal relationship between the fault alarms issued by the target network element and the sub-alarm network element; wherein, the alarm causality rules are generated based on network operation protocols and historical experience.

[0087] In one or more embodiments, the network element search module 901 is used for: Based on the network element link topology diagram, obtain the sibling network elements and subordinate network elements of the sub-alarm network element; Within the first preset time window, by identifying whether the lower-level network element issues a fault alarm, it is confirmed whether there is a parent alarm network element among the lower-level network elements; After the second preset time window, the presence of a parent alarm network element is confirmed by identifying whether a fault alarm is issued by a peer network element.

[0088] In one or more embodiments, the network element search module 901 is further configured to: Based on the network element link topology diagram, the network layer of the sub-alarm network element is determined: the network layer is divided based on the network structure of the communication network, and the network layer includes the service layer, bearer layer and transport layer from top to bottom. Based on the network hierarchy of the sub-alarm network element, peer network elements and lower-level network elements are identified from the network elements directly connected to the sub-alarm network element; among them, peer network elements are network elements at the same network hierarchy as the sub-alarm network element, and lower-level network elements are network elements at the next lower level of the network hierarchy.

[0089] The network fault root cause location device is also used to: if there is no parent alarm network element among the adjacent network elements, the alarm network element is an independent alarm network element, and the alarm network element is confirmed as the root cause alarm network element of the network fault.

[0090] The network fault root cause location device is also used to: before treating the alarm network element as a sub-alarm network element, it further includes: Identify whether the alarming network element is associated with a historical fault alarm that has already occurred; It was confirmed that the alarm element was not associated with the aforementioned historical fault alarm.

[0091] The network fault root cause localization device and the network fault root cause localization method provided in this disclosure are based on the same inventive concept and have the same beneficial effects as the methods they adopt, operate or implement.

[0092] This disclosure also provides a computer device for performing the above-described network fault root cause localization method. Please refer to... Figure 10 It illustrates a schematic diagram of a computer device provided by some embodiments of this disclosure. For example... Figure 10 As shown, the computer device 10 includes: a processor 1000, a memory 1001, a bus 1002, and a communication interface 1003. The processor 1000, the communication interface 1003, and the memory 1001 are connected via the bus 1002. The memory 1001 stores a computer program that can run on the processor 1000. When the processor 1000 runs the computer program, it executes the network fault root cause localization method provided in any of the foregoing embodiments of this disclosure.

[0093] The memory 1001 may include high-speed random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Communication between the device network element and at least one other network element is achieved through at least one communication interface 1003 (which can be wired or wireless), such as the Internet, wide area network, local area network, metropolitan area network, etc.

[0094] Bus 1002 can be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. The memory 1001 is used to store programs. After receiving an execution instruction, the processor 1000 executes the program. The network fault root cause localization method disclosed in any of the foregoing embodiments of this disclosure can be applied to the processor 1000, or implemented by the processor 1000.

[0095] The processor 1000 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 1000 or by instructions in software form. The processor 1000 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPTA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this disclosure. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this disclosure can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules may reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory 1001. Processor 1000 reads the information in memory 1001 and, in conjunction with its hardware, completes the steps of the above method.

[0096] The computer equipment and network fault root cause localization method provided in this disclosure are based on the same inventive concept and have the same beneficial effects as the methods they employ, operate, or implement.

[0097] This disclosure also provides a computer-readable storage medium corresponding to the network fault root cause localization method provided in the foregoing embodiments. The computer-readable storage medium is an optical disc, on which a computer program (i.e., a computer program product) is stored. When the computer program is run by a processor, it executes the network fault root cause localization method provided in any of the foregoing embodiments.

[0098] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical and magnetic storage media, which will not be elaborated here.

[0099] The computer-readable storage medium provided in the above embodiments of this disclosure and the network fault root cause localization method provided in the embodiments of this disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the applications stored therein.

[0100] This disclosure also provides a computer program product; please refer to [reference needed]. Figure 11 The computer program product 1100 carries program code, namely computer program 1101. The instructions included in the computer program 1101 can be used to execute the steps of the network fault root cause localization method described in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0101] The aforementioned computer program product can be implemented through hardware, software, or a combination thereof. In one optional embodiment, the computer program product is specifically embodied in a computer storage medium; in another optional embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0102] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0103] The block diagrams of devices, apparatuses, devices, and systems disclosed herein are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0104] Additionally, as used herein, the "or" used in a list of items beginning with "at least one" indicates a separate list, such that a list of, for example, "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not imply that the described example is preferred or better than other examples.

[0105] It should also be noted that in the systems and methods of this disclosure, the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions to this disclosure.

[0106] Various changes, substitutions, and modifications can be made to the technology described herein without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, events, means, methods, and actions described above. Currently existing or later-developed processes, machines, manufactures, events, means, methods, or actions that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Therefore, the appended claims include such processes, machines, manufactures, events, means, methods, or actions within their scope.

[0107] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0108] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A method for locating the root cause of network faults, characterized in that, include: When an alarm network element that has issued a fault alarm is detected, the alarm network element is designated as a sub-alarm network element. Based on the network element link topology diagram, it is determined whether a parent alarm network element exists among the neighboring network elements of the sub-alarm network element. The network element link topology diagram represents the connection and hierarchical relationship between network elements in the communication network. The neighboring network elements include peer network elements and lower-level network elements that are directly connected to the sub-alarm network element. The parent alarm network element is the neighboring network element that caused the sub-alarm network element to issue a fault alarm. If the parent alarm network element exists among the adjacent network elements, the connection relationship between the child alarm network element and the parent alarm network element is recorded, and a tracking sub-chain is generated based on the connection relationship; The parent alarm network element is treated as a new child alarm network element, and the step of identifying whether the parent alarm network element exists in the neighboring network elements of the child alarm network element is repeated until the parent alarm network element does not exist in the neighboring network elements. Based on the hierarchical relationship represented by the network element link topology diagram, each of the tracing sub-chains is connected layer by layer to generate a complete fault tracing chain; Based on the complete fault tracing chain, the root cause alarm network element that caused the network fault is located.

2. The network fault root cause localization method as described in claim 1, characterized in that, Based on the network element link topology diagram, identify whether there is a parent alarm network element among the neighboring network elements of the sub-alarm network element, including: Based on the network element link topology diagram, identify whether there is a target network element among the neighboring network elements of the sub-alarm network element; wherein, the target network element is the neighboring network element that issued the fault alarm; If the target network element is not present among the adjacent network elements, then it is confirmed that the parent alarm network element is not present among the adjacent network elements. If the target network element exists among the adjacent network elements, based on the preset alarm causality rule, the presence of a parent alarm network element among the adjacent network elements is identified by determining whether there is a causal relationship between the fault alarm issued by the target network element and the sub-alarm network element; wherein, the alarm causality rule is generated based on network operation protocol and historical experience.

3. The network fault root cause localization method as described in claim 1, characterized in that, Based on the network element link topology diagram, identify whether there is a parent alarm network element among the neighboring network elements of the sub-alarm network element, including: Based on the network element link topology diagram, obtain the sibling network element and the subordinate network element of the sub-alarm network element; Within the first preset time window, by identifying whether the lower-level network element issues a fault alarm, it is confirmed whether the parent alarm network element exists in the lower-level network element; After the second preset time window, by identifying whether the peer network element has issued a fault alarm, it is confirmed whether the parent alarm network element exists among the peer network elements.

4. The network fault root cause localization method as described in claim 3, characterized in that, Based on the network element link topology diagram, the sibling network elements and the subordinate network elements of the sub-alarm network element are obtained, including: Based on the network element link topology diagram, the network layer in which the sub-alarm network element is located is determined: wherein, the network layer is divided based on the network structure of the communication network, and the network layer includes the service layer, bearer layer and transport layer from top to bottom; Based on the network layer in which the sub-alarm network element is located, the peer network element and the lower-level network element are identified from the network elements directly connected to the sub-alarm network element; wherein, the peer network element is the network element at the same network layer as the sub-alarm network element, and the lower-level network element is the network element at the next lower level of the network layer.

5. The network fault root cause localization method as described in claim 1, characterized in that, Also includes: If the parent alarm network element does not exist among the adjacent network elements, then the alarm network element is an independent alarm network element, and the alarm network element is confirmed as the root cause alarm network element of the network failure.

6. The network fault root cause localization method as described in claim 1, characterized in that, Before using the alarm network element as a sub-alarm network element, the following is also included: Identify whether the alarm network element is associated with a historical fault alarm that has already occurred; It was confirmed that the alarm network element was not associated with the historical fault alarm.

7. A network fault root cause localization device, characterized in that, include: The network element search module is used to, when an alarm network element that has issued a fault alarm is detected, identify the alarm network element as a sub-alarm network element, and, based on the network element link topology map, identify whether there is a parent alarm network element among the neighboring network elements of the sub-alarm network element; wherein, the network element link topology map represents the connection relationship and hierarchical relationship between network elements in the communication network, the neighboring network elements include peer network elements and lower-level network elements directly connected to the sub-alarm network element, and the parent alarm network element is the neighboring network element that caused the sub-alarm network element to issue a fault alarm; The tracking sub-chain generation module is used to record the connection relationship between the sub-alarm network element and the parent alarm network element when the parent alarm network element exists in the adjacent network elements, and to generate a tracking sub-chain based on the connection relationship; The loop module is used to repeatedly execute the step of identifying whether there is a parent alarm network element among the neighboring network elements of the child alarm network element, using the parent alarm network element as a new child alarm network element, until there is no parent alarm network element among the neighboring network elements. The sub-chain concatenation module is used to connect each of the tracking sub-chains layer by layer based on the hierarchical relationship represented by the network element link topology diagram to generate a complete fault tracing chain. The fault location module is used to locate the root cause alarm network element that causes the network fault based on the complete fault tracing chain.

8. A computer embedded device, comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1 to 6.

Images