Fault root cause positioning method, device, equipment, medium and product

Abstract

The embodiment of the invention provides a fault root cause positioning method and device, equipment, a medium and a product, and the method comprises the steps: receiving alarm data under a plurality of detection dimensions, the alarm data comprising alarm basic information, site association information associated with the alarm data and fault classification identifiers corresponding to the alarm data; according to the alarm basic information and the site association information, determining a frequency band site, and calling an alarm association model associated with the frequency band site; processing the alarm data based on an alarm association model, and determining a confidence attribute corresponding to the at least one root cause conclusion, the fault classification identifier being a classification identifier in classification identifiers to which the at least one root cause conclusion belongs; and determining a target root cause conclusion based on the confidence attribute, and determining and displaying a target repair scheme according to the target root cause conclusion and the alarm basic information. According to the technical scheme, the time for determining the alarm correlation root cause conclusion is shortened, and the recognition efficiency and accuracy are improved.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence, and in particular to a method, apparatus, device, medium, and product for locating the root cause of a fault. Background Technology

[0002] With the continuous expansion of mobile communication networks, the amount of base station equipment and transmission links has surged, leading to a higher frequency and more interconnected nature of wireless network failures. In the current operation and maintenance system, handling wireless network failures primarily relies on locating the root cause through alarm information.

[0003] Currently, existing methods for fault root cause localization mainly rely on manual judgment of alarm information by operations and maintenance personnel. However, manual judgment is inefficient, and fault root cause localization is time-consuming, making it difficult to meet the operational and maintenance needs of large-scale network development. Summary of the Invention

[0004] This invention provides a method, apparatus, device, medium, and product for locating the root cause of faults in wireless networks, thereby improving the efficiency of locating the root cause of faults, shortening the location time, and increasing the location accuracy.

[0005] In a first aspect, embodiments of the present invention provide a method for locating the root cause of a fault, comprising: The alarm data received includes basic alarm information, site association information associated with the alarm data, and fault classification identifier corresponding to the alarm data. Based on the alarm basic information and site association information, determine the frequency band sites and retrieve the alarm association model associated with the frequency band sites; The alarm data is processed based on the alarm association model to determine the confidence attribute corresponding to at least one root cause conclusion, wherein the fault classification identifier is the classification identifier among the classification identifiers to which the at least one root cause conclusion belongs; Based on the confidence attribute, the target root cause conclusion is determined, and based on the target root cause conclusion and alarm basic information, the target remediation plan is determined and displayed; The target repair scheme includes at least the implementation steps for eliminating the fault.

[0006] Furthermore, the basic alarm information includes at least one or more of the following: alarm code, alarm title, alarm time, site number, and frequency band type; the site association information includes at least the site equipment model, network topology, and historical fault records; and the fault classification identifier includes at least a pre-defined category label corresponding to the fault type.

[0007] Furthermore, the alarm correlation model is determined based on the following method: Obtain the first alarm data corresponding to different frequency bands and the sample root cause conclusions of the first alarm data; The alarm association model is trained based on the first alarm data and the corresponding sample root cause conclusions, so that the alarm association model is obtained when the loss function converges.

[0008] Furthermore, determining the target root cause conclusion based on the confidence attribute includes: The root cause conclusion with the highest confidence level is taken as the target root cause conclusion.

[0009] Furthermore, determining the target remediation plan based on the target root cause conclusion and alarm basic information includes: Based on the target root cause conclusion and the alarm basic information, the pre-created remediation suggestion strategy library is traversed to determine the target remediation plan; The repair suggestion strategy library includes at least a first historical repair scheme for different alarm base information under different root cause conclusions. The repair scheme is determined by aggregating second historical repair schemes corresponding to the same root cause conclusion and the same alarm base information. The first historical repair scheme includes at least one repair path, and the repair path includes implementation steps.

[0010] Furthermore, the method also includes: When the number of stations in the frequency band is multiple, the alarm basic data of different frequency band stations are processed based on the attention mechanism in the alarm association model to obtain at least one confidence attribute corresponding to the root cause conclusion.

[0011] Secondly, embodiments of the present invention provide a fault root cause localization device, comprising: The alarm data receiving module is used to receive alarm data from multiple detection dimensions. The alarm data includes basic alarm information, site association information associated with the alarm data, and fault classification identifier corresponding to the alarm data. The frequency band site determination module is used to determine the frequency band site based on the alarm basic information and site association information, and to retrieve the alarm association model associated with the frequency band site. The target remediation solution determination module is used to determine the target root cause conclusion based on the confidence attribute, and determine and display the target remediation solution based on the target root cause conclusion and alarm basic information; The target repair scheme includes at least the implementation steps for eliminating the fault.

[0012] Thirdly, embodiments of the present invention also provide an electronic device, comprising: At least one processor; and A memory that is communicatively connected to at least one processor; wherein, The memory stores a computer program that can be executed by at least one processor, such that the at least one processor can perform a fault root cause localization method as provided in any embodiment of the present invention.

[0013] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing computer instructions for causing a processor to execute a fault root cause localization method as provided in any embodiment of the present invention.

[0014] Fifthly, embodiments of this disclosure also provide a computer program product, including a computer program that, when executed by a processor, implements a fault root cause localization method as described in any of the embodiments of this disclosure.

[0015] The technical solution provided by this invention receives alarm data from multiple detection dimensions. Based on the basic alarm information and site association information in the alarm data, frequency band sites are determined. The operational scenario is determined using the information in the alarm data, providing key context for root cause localization. The alarm data is processed based on an alarm association model to determine the confidence attribute corresponding to at least one root cause conclusion. The accuracy of root cause localization is improved by inferring from the alarm data using an alarm association model that matches the scenario. Furthermore, based on the confidence attribute, a target root cause conclusion is determined, and based on the target root cause conclusion and the basic alarm information, a target remediation plan is determined and displayed. This technical solution shortens the time required to determine alarm-related root cause conclusions and improves identification efficiency and accuracy.

[0016] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A flowchart of a fault root cause localization method provided in an embodiment of the present invention; Figure 2 This is an overall framework diagram of a fault root cause localization method provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of a fault root cause localization device provided in an embodiment of the present invention; Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. Detailed Implementation

[0019] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0020] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0021] Figure 1 This is a flowchart illustrating a fault root cause localization method according to an embodiment of the present invention. This embodiment is applicable to situations involving the localization of fault root causes. The method can be executed by a fault root cause localization device, which can be implemented in hardware and / or software, and this device can be configured in a computing device. Figure 1 As shown, the method includes: S110: Receive alarm data from multiple detection dimensions.

[0022] The alarm data includes basic alarm information, site association information associated with the alarm data, and fault classification identifiers corresponding to the alarm data.

[0023] In this embodiment, alarm data can be data associated with abnormal system operation status, and alarm data is usually actively reported by network management systems, etc. Multiple detection dimensions can be understood as different levels of alarm data collection. For example, multiple detection dimensions may include, but are not limited to, basic alarm information, site association information, and fault classification identifiers.

[0024] Basic alarm information can be metadata related to alarm events. This includes, but is not limited to, alarm code, alarm title, occurrence time, site number, and frequency band type. Site association information, which links alarm data to specific site locations within the network, includes, but is not limited to, site device model, network topology, and historical fault records. Fault classification labels are preliminary classification tags set according to predefined rules during alarm generation or preprocessing. These labels include, but are not limited to, feature tags for power supply, transmission, equipment, user, and other types of faults.

[0025] Specifically, to pinpoint the root cause of a fault, the alarm acquisition module in the system collects alarm data across multiple detection dimensions at preset intervals via the network management system interface. By analyzing the alarm data from multiple dimensions, the final root cause of the fault is determined, enabling targeted handling suggestions to be proposed.

[0026] Optionally, while acquiring alarm data from multiple dimensions, the alarm data can be categorized and stored in the alarm database according to site number and alarm type, and historical data for a preset time period can be retained to optimize the model used for fault root cause localization.

[0027] It should be noted that alarm data can include alarm data from multiple dimensions. Furthermore, the content of alarm data will be described in detail. Optionally, the basic alarm information should include at least one or more of the following: alarm code, alarm title, alarm time, site number, and frequency band type; the site association information should include at least the site equipment model, network topology, and historical fault records; and the fault classification identifier should include at least a pre-defined category label corresponding to the fault type.

[0028] In this embodiment, the basic alarm information includes, but is not limited to, alarm code, alarm title, occurrence time, site number, and frequency band type. The alarm code is a unique code defined by the system to identify a specific fault type. The alarm title is natural language that provides a general description of the time represented by the alarm code, facilitating quick understanding of the alarm information by maintenance personnel. The occurrence time is the moment the alarm event was detected. The site number is a unique identifier assigned to each site in the network resource management system, associated with its specific physical location in the network, used for spatial positioning of the alarm. The frequency band type is a specific frequency range used in wireless communication. For example, the differences between different frequency bands determine the differences in fault modes. The low-frequency 700MHz band has a wide coverage and strong penetration capability, and its fault modes mainly revolve around weak coverage and access anomalies; the mid-frequency 2.6GHz band has large bandwidth and high capacity, but relatively small coverage, and its fault modes mainly manifest as service congestion and quality degradation; the 4.9GHz band focuses more on transmission and assurance faults related to latency reliability and service isolation.

[0029] Site-related information includes, but is not limited to, site equipment model, network topology, and historical fault records. Site equipment model refers to the specific model and software version of the hardware devices deployed at the site, such as core network elements, base station equipment, transmission equipment, or servers. Network topology is a collection of information describing the site's connections to the network, which may include the site's upstream nodes, downstream nodes, adjacent nodes, and the service link paths it carries. Historical fault records are complete logs of all recorded fault events and their handling processes at the site associated with the alarm data over a past period.

[0030] Fault classification identifiers include, but are not limited to, pre-defined category labels corresponding to fault types. The category labels corresponding to fault types are classification names set according to different fault types, and are predefined based on the root cause or scope of impact of the fault. Fault classification identifiers include at least power supply faults, transmission faults, equipment faults, user faults, or other types of faults. Power supply faults can be faults caused by abnormal power supply systems, resulting in the malfunction of network devices or components; transmission faults can be faults caused by interruptions, degradation, or configuration errors in the physical or logical links carrying data in the network, leading to data transmission failures; equipment faults are faults caused by abnormalities in the hardware or software of the network device itself, resulting in loss of function or severe performance degradation. User faults are faults caused by abnormal service capabilities on the user side or network for users, resulting in impaired service experience for individual or partial users. Other types of faults are faults that cannot be clearly classified into the above four categories.

[0031] For example, mains power outages, unstable voltage, and equipment power module failures can all be classified as power supply failures; transmission equipment port failures, severed cables, or excessively high link error rates can all be classified as transmission failures; damage to the main control board or baseband processing board can be classified as equipment failures. Terminal compatibility issues can be classified as user-related failures. External interference or data configuration errors can be classified as other types of failures.

[0032] Specifically, the acquired alarm data across multiple dimensions can include basic alarm information, site association information, and fault classification identifiers corresponding to the alarm data. Basic alarm information includes, but is not limited to, alarm code, alarm title, alarm time, site number, and frequency band type; site association information includes, but is not limited to, site device model, network topology, and historical fault records; fault classification identifiers include, but are not limited to, the category label corresponding to the fault type. By acquiring alarm data across multiple dimensions, including basic alarm information, site association information, and fault classification identifiers, data is provided for subsequent root cause localization, improving the accuracy and efficiency of root cause localization.

[0033] S120. Based on the alarm basic information and site association information, determine the frequency band site and retrieve the alarm association model associated with the frequency band site.

[0034] In this embodiment, a frequency band site can be a unique logical identifier jointly defined by the physical site location and the wireless frequency band technical parameters. The alarm correlation model is a data model used to analyze the causal relationship of faults and output the root cause of the fault. The alarm correlation model can be a model that embeds expert rules, historical patterns, or machine learning algorithms for a specific frequency band site scenario. It can be noted that a corresponding alarm correlation model is determined based on different frequency band types. This alarm correlation model can process alarm data from multiple dimensions and analyze the correlation relationships between alarm data, thereby deriving possible root causes and their corresponding probabilities.

[0035] Specifically, the system acquires basic alarm information and site association information from multiple dimensions of alarm data. Based on this information, it identifies the frequency bands and associated sites. Then, it determines the corresponding alarm association model for each frequency band and associated site. This enables scenario-based, precise localization, improves the targeting of localization efforts, and ultimately enhances the accuracy of inference.

[0036] Furthermore, an alarm correlation model for root cause localization is trained based on historical alarm data and the corresponding root cause conclusions. The process of determining the alarm correlation model is then described in detail. Optionally, the alarm correlation model is determined in the following manner: Obtain the first alarm data and sample root cause conclusions corresponding to different frequency bands; train the alarm association model based on the first alarm data and the corresponding sample root cause conclusions, so as to obtain the alarm association model when the loss function converges.

[0037] In this embodiment, the first alarm data can be historical alarm data used for training the alarm association model. Each piece of data in the first alarm data can contain basic alarm information and site association information. Each piece of data in the first alarm data corresponds to a different sample root cause conclusion, which can be a fault root cause label that has been finally confirmed manually. This sample root cause conclusion is the true conclusion corresponding to each piece of data in the first alarm data. The sample root cause conclusion can be one of the following: power supply cause, transmission cause, equipment cause, user cause, or other cause. The loss function is a mathematical function that measures the difference between the model's predicted result and the true label. After each training iteration, the loss value is calculated based on the loss function to adjust the model parameters of the alarm association model. Loss function convergence occurs when the loss value decreases to a certain level and tends to stabilize as training iterations occur. When the loss function converges, the alarm association model can be directly used to determine the root cause conclusion.

[0038] It can be explained that after acquiring the first alarm data, the first alarm data is classified based on frequency band type to determine the first alarm data corresponding to different frequency bands. Based on the first alarm data corresponding to different frequency bands and the corresponding root cause conclusions, the model parameters of the alarm correlation model are adjusted. The number of frequency band types is consistent with the number of trained alarm correlation models.

[0039] Specifically, the first alarm data corresponding to different frequency bands are input into the alarm association model corresponding to different frequency bands, and the model parameters of the alarm association model are adjusted based on the corresponding sample root cause conclusions and loss functions, so as to finally obtain alarm association models corresponding to multiple frequency bands.

[0040] S130. Process the alarm data based on the alarm association model to determine the confidence attribute corresponding to at least one root cause conclusion.

[0041] Among them, the fault classification identifier is the classification identifier in the classification identifier of at least one root cause conclusion.

[0042] In this embodiment, the confidence attribute can be a quantitative credibility index, typically presented as a probability value or confidence score. After the alarm correlation model analyzes and processes the alarm data, it outputs the root cause conclusion and its corresponding confidence attribute. This confidence attribute represents the probability that the root cause conclusion corresponding to the alarm data is the root cause conclusion output by the alarm correlation model.

[0043] Specifically, the alarm data is acquired from multiple dimensions, input into the alarm association model for analysis and processing, and outputs at least one root cause conclusion, as well as the confidence attribute corresponding to each root cause conclusion.

[0044] S140. Based on the confidence attribute, determine the root cause conclusion of the target, and based on the root cause conclusion of the target and the basic alarm information, determine and display the target remediation plan; The target repair plan should include at least the implementation steps for eliminating the fault.

[0045] In this embodiment, the target root cause conclusion is the fundamental fault cause ultimately identified by the system after decision-making. After the alarm correlation model outputs the root cause conclusion and its corresponding confidence level, the root cause conclusion is judged based on the confidence attribute to finally determine the target root cause conclusion.

[0046] The target remediation plan can be a standardized operating procedure generated by the system based on the identified root cause conclusions, which is used to guide maintenance personnel to perform remediation operations.

[0047] Furthermore, after obtaining the target root cause conclusions, the system can perform batch root cause conclusion management. This function allows operations and maintenance personnel to pre-set the number of root cause conclusions to be included in an analysis batch, and the system automatically performs aggregate analysis on batches that reach that number.

[0048] It can be explained that the system can use statistical analysis algorithms to statistically calculate the type distribution of all root cause conclusions in the current batch, identify and output the dominant factor for the current time period. For example, according to the system analysis, out of a total of 100 root cause conclusions in the current batch, 60 conclusions are due to transmission issues, accounting for 60%. The system will consider transmission issues as the dominant factor.

[0049] Specifically, based on the confidence attributes, the final target root cause conclusion is determined. Further, based on the target root cause conclusion and basic alarm information, a target remediation plan is determined and displayed. Analysis is performed based on the alarm correlation model, and the target root cause conclusion is output to improve fault location efficiency and fault handling accuracy.

[0050] Furthermore, in the process of processing alarm data using the alarm correlation model, the process of determining the target root cause conclusion based on at least one root cause conclusion and its corresponding confidence attribute is further refined. Optionally, determining the target root cause conclusion based on the confidence attribute includes: The root cause conclusion with the highest confidence level is taken as the target root cause conclusion.

[0051] In this embodiment, the root cause conclusion with the highest confidence attribute can be understood as the root cause conclusion with the largest confidence attribute value among the confidence attributes corresponding to at least one root cause conclusion output by the alarm association model.

[0052] It can be explained that a pre-set confidence threshold is configured based on the confidence attribute. When the output confidence attribute is greater than or equal to the pre-set confidence threshold, the root cause conclusion with the highest confidence attribute value is directly output as the target root cause conclusion. If the output confidence attribute is less than the pre-set confidence threshold, a manual review prompt is triggered. The manual review prompt may take the form of, but is not limited to, on-screen prompts and / or push notifications, to inform operations and maintenance personnel to verify the root cause conclusions output by the alarm correlation model. If the operations and maintenance personnel verify that the root cause conclusion is correct, it is directly output as the target root cause conclusion; if the root cause conclusion output by the alarm correlation model is incorrect, the root cause conclusion calculated by the operations and maintenance personnel is output as the target root cause conclusion.

[0053] For example, when alarm data is input into the alarm association model for analysis, if the root cause conclusion with the highest confidence attribute value is power supply and the confidence attribute is 85%, then power supply will be output as the target root cause conclusion.

[0054] Specifically, based on confidence attributes, the root cause conclusion with the highest confidence attribute is output as the target root cause conclusion. By comparing the root cause conclusions analyzed in the alarm correlation model based on confidence attributes, the interpretability and reliability of the system are enhanced.

[0055] Furthermore, after determining the root cause, a target remediation plan is generated based on the root cause conclusion and the basic alarm information. The process of determining the target remediation plan is then described in detail. Optionally, the target remediation plan is determined based on the root cause conclusion and the basic alarm information, including: Based on the root cause analysis and alarm information, the pre-created remediation suggestion strategy library is traversed to determine the target remediation plan. The remediation suggestion strategy library includes at least the first historical remediation schemes for different alarm base information under different root cause conclusions. The remediation schemes are determined by aggregating the second historical remediation schemes corresponding to the same root cause conclusion and the same alarm base information. The first historical remediation scheme includes at least one remediation path, and the remediation path includes implementation steps.

[0056] In this embodiment, the repair suggestion strategy library is a pre-set structured operation and maintenance database that records the repair strategies used in various fault scenarios throughout history. For example, the storage unit in the repair suggestion strategy library is a pair of "alarm basic information - root cause conclusion - historical repair solutions".

[0057] The first historical repair plan is the repair plan corresponding to the basic alarm information and root cause conclusion. The repair plan is a template aggregated from second historical repair plans corresponding to the same root cause conclusion and the same basic alarm information. The second historical repair plan can be a second historical repair plan determined by a root cause conclusion and its corresponding basic alarm information; this plan is the repair operation actually performed for a specific fault event, recorded in the historical work order record.

[0058] The first historical remediation plan is derived from the second historical remediation plans corresponding to multiple identical root cause conclusions and the same alarm base information, encompassing different method selections for the same problem. The first historical remediation plan includes, but is not limited to, a remediation path. A remediation path can be a feasible sequence of fault-solving procedures; optionally, the first historical remediation plan may contain multiple remediation paths. A remediation path includes implementation steps for resolving the fault, and these implementation steps can be a sequence of the smallest executable operational units constituting the remediation path.

[0059] The target repair solution is a standardized and immediately executable fault elimination process. After obtaining the first historical repair solution, a similarity algorithm can be used to match the historical solution template that is closest to the current fault scenario, and the appropriate repair path and implementation steps can be extracted to determine the final target repair solution.

[0060] Specifically, after determining the root cause of the current fault, the system integrates the root cause conclusion with the corresponding alarm information to form structured query features, and then searches the repair suggestion strategy library to determine the first historical repair solution. Further, based on the first historical repair solution, the system finally determines the target repair solution. This ensures the reliable and efficient use of the repair solution, improving generation efficiency while maintaining operational standardization.

[0061] Optionally, the method also includes: When there are multiple frequency band sites, the alarm basic data of different frequency band sites are processed based on the attention mechanism in the alarm association model to obtain at least one confidence attribute corresponding to the root cause conclusion.

[0062] In this embodiment, the number of frequency band sites can be understood as the alarm data associated with a single fault event originating from multiple different frequency band sites. The attention mechanism in the alarm association model can be achieved by setting an attention mechanism module within the model. After the alarm association model receives the basic alarm data from all relevant frequency band sites, the attention mechanism automatically calculates the importance weight of the alarm data from each frequency band site for inferring the root cause conclusion. For example, the 700MHz site increases the weight associated with power supply causes, and the 2.6GHz site increases the weight associated with device causes.

[0063] Specifically, after inputting alarm data corresponding to multiple frequency band sites into the alarm association model, a dynamic adjustment strategy for frequency band type feature weights is introduced to output at least one root cause conclusion and its corresponding confidence attribute. By dynamically adjusting the weights of features of different frequency band types, feature differentiation and focusing are achieved, and the accuracy of cross-frequency band root cause analysis is improved, thereby enhancing the model's ability to adapt to different scenarios.

[0064] Furthermore, after determining the target remediation plan, the system will automatically integrate key information from the entire process. This key information includes, but is not limited to, alarm data, root cause conclusions, their corresponding confidence attributes, and the target remediation plan. The system will then generate a standardized root cause analysis report in a unified format. This report is automatically pushed to northbound systems such as upper-layer network management systems, operations and maintenance platforms, or big data platforms via a standard API interface, achieving cross-system synchronization of fault loop information.

[0065] Furthermore, after maintenance personnel complete on-site handling according to the target remediation plan, the system receives feedback from the personnel regarding the handling results. These results may include, but are not limited to, execution status, remediation effects, and plan adjustment information. The handling results are then sent to the remediation suggestion strategy library. Based on feedback data validated in practice, the alarm correlation model is optimized to improve location accuracy.

[0066] The technical solution provided by this invention receives alarm data from multiple detection dimensions. Based on the basic alarm information and site association information in the alarm data, frequency band sites are determined. The operational scenario is determined using the information in the alarm data, providing key context for root cause localization. The alarm data is processed based on an alarm association model to determine the confidence attribute corresponding to at least one root cause conclusion. The accuracy of root cause localization is improved by inferring from the alarm data using an alarm association model that matches the scenario. Furthermore, based on the confidence attribute, a target root cause conclusion is determined, and based on the target root cause conclusion and the basic alarm information, a target remediation plan is determined and displayed. This technical solution shortens the time required to determine alarm-related root cause conclusions and improves identification efficiency and accuracy.

[0067] Figure 2 This is an overall framework diagram of a fault root cause localization method provided in an embodiment of the present invention, which is used in conjunction with the above embodiments. Figure 2 Understand the technical solutions of the embodiments of the present invention.

[0068] like Figure 2 As shown, this embodiment explains the overall implementation of the solution based on the above optional implementation methods. Specifically, it includes: First, the alarm acquisition module collects alarm data (multi-band site alarm data) in real time across multiple detection dimensions through the network management system interface. This alarm data includes basic alarm information, site association information, and fault classification identifiers. After collection, the alarm data is categorized and stored in the alarm database according to site number and fault classification identifier for optimization of the alarm association model.

[0069] Within one minute of alarm data collection, the intelligent analysis module in the cloud processing center initiates the alarm correlation process. This process begins by cleaning the collected alarm data, removing alarms with duplicate titles and times, and extracting key alarm features, including alarm codes, frequency of occurrence, and site device models. Further, based on the basic alarm information and site correlation information in the alarm data, the system identifies the specific frequency band site from which the alarm data originates and calls the corresponding pre-trained alarm correlation model. The alarm correlation model infers from the cleaned alarm data, outputting at least one root cause conclusion and its corresponding confidence attribute, thereby confirming the final target root cause conclusion and its corresponding confidence attribute. If the confidence attribute is greater than a preset confidence threshold, it is output directly; if the confidence attribute is less than the preset confidence threshold, a manual review prompt is triggered.

[0070] Within 30 seconds of outputting the target root cause conclusion, the cloud processing center performs root cause conclusion classification and statistics, and outputs processing suggestions based on the root cause output module. For the output target root cause conclusion, a target remediation plan is determined based on a pre-created remediation suggestion strategy library. Furthermore, the alarm basic information, target root cause conclusion, confidence attributes, and target remediation plan are integrated into a standardized report. Simultaneously, after processing a preset number of alarm data, a preset number of target root cause conclusions are statistically analyzed, and the dominant factors are output.

[0071] After outputting the standardized report, closed-loop management and northbound push are performed in real time. Based on the closed-loop management module, the standardized report is pushed to the northbound system via API interface, and the handling results are received from the operation and maintenance personnel. The handling results are then uploaded to the alarm database for optimization of the alarm correlation model.

[0072] The technical solution provided by this invention receives alarm data from multiple detection dimensions. Based on the basic alarm information and site association information in the alarm data, frequency band sites are determined. The operational scenario is determined using the information in the alarm data, providing key context for root cause localization. The alarm data is processed based on an alarm association model to determine the confidence attribute corresponding to at least one root cause conclusion. The accuracy of root cause localization is improved by inferring from the alarm data using an alarm association model that matches the scenario. Furthermore, based on the confidence attribute, a target root cause conclusion is determined, and based on the target root cause conclusion and the basic alarm information, a target remediation plan is determined and displayed. This technical solution shortens the time required to determine alarm-related root cause conclusions and improves identification efficiency and accuracy.

[0073] Figure 3 This is a schematic diagram of a fault root cause localization device provided in an embodiment of the present invention, as shown below. Figure 3 As shown, the device includes: an alarm data receiving module 210, a frequency band site determination module 220, and a target repair scheme determination module 230.

[0074] The alarm data receiving module 210 is used to receive alarm data from multiple detection dimensions. The alarm data includes basic alarm information, site association information associated with the alarm data, and fault classification identifiers corresponding to the alarm data. The frequency band site determination module 220 is used to determine the frequency band site based on the basic alarm information and site association information, and retrieve the alarm association model associated with the frequency band site. The target repair scheme determination module 230 is used to determine the target root cause conclusion based on the confidence attribute, and determine and display the target repair scheme based on the target root cause conclusion and the basic alarm information. The target repair scheme includes at least the implementation steps adopted to eliminate the fault.

[0075] The technical solution provided by this invention receives alarm data from multiple detection dimensions. Based on the basic alarm information and site association information in the alarm data, frequency band sites are determined. The operational scenario is determined using the information in the alarm data, providing key context for root cause localization. The alarm data is processed based on an alarm association model to determine the confidence attribute corresponding to at least one root cause conclusion. The accuracy of root cause localization is improved by inferring from the alarm data using an alarm association model that matches the scenario. Furthermore, based on the confidence attribute, a target root cause conclusion is determined, and based on the target root cause conclusion and the basic alarm information, a target remediation plan is determined and displayed. This technical solution shortens the time required to determine alarm-related root cause conclusions and improves identification efficiency and accuracy.

[0076] Based on the above technical solutions, the basic alarm information includes at least one or more of the following: alarm code, alarm title, alarm time, site number, and frequency band type; the site association information includes at least the site equipment model, network topology, and historical fault records; and the fault classification identifier includes at least a pre-defined category label corresponding to the fault type.

[0077] Based on the above technical solutions, the alarm association model is determined in the following manner: The first alarm data acquisition module is used to acquire the first alarm data corresponding to different frequency bands and the sample root cause conclusions of the first alarm data; The alarm association model acquisition module is used to train the alarm association model based on the first alarm data and the corresponding sample root cause conclusions, so as to obtain the alarm association model when the loss function converges.

[0078] Based on the above technical solutions, the target repair solution determination module includes: The target root cause conclusion determination unit is used to select the root cause conclusion with the highest confidence attribute as the target root cause conclusion.

[0079] Based on the above technical solutions, the target repair solution determination module includes: The target remediation plan determination module is used to determine the target remediation plan by traversing a pre-created remediation suggestion strategy library based on the target root cause conclusion and the alarm basic information. The repair suggestion strategy library includes at least a first historical repair scheme for different alarm base information under different root cause conclusions. The repair scheme is determined by aggregating second historical repair schemes corresponding to the same root cause conclusion and the same alarm base information. The first historical repair scheme includes at least one repair path, and the repair path includes implementation steps.

[0080] Based on the above technical solutions, the device also includes: The confidence attribute determination module is used to process the basic alarm data of different frequency band sites based on the attention mechanism in the alarm association model when the number of sites in the frequency band includes multiple sites, so as to obtain the confidence attribute corresponding to at least one root cause conclusion.

[0081] The fault root cause localization device provided in this embodiment of the invention can execute a fault root cause localization method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method.

[0082] Figure 4A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0083] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0084] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0085] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as a root cause localization method.

[0086] In some embodiments, a root cause localization method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the root cause localization method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform a root cause localization method by any other suitable means (e.g., by means of firmware).

[0087] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0088] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0089] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0090] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0091] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0092] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0093] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and no limitation is imposed herein.

[0094] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for locating the root cause of a fault, characterized in that, include: The alarm data received includes basic alarm information, site association information associated with the alarm data, and fault classification identifier corresponding to the alarm data. Based on the alarm basic information and site association information, determine the frequency band sites and retrieve the alarm association model associated with the frequency band sites; The alarm data is processed based on the alarm association model to determine the confidence attribute corresponding to at least one root cause conclusion, wherein the fault classification identifier is the classification identifier among the classification identifiers to which the at least one root cause conclusion belongs; Based on the confidence attribute, the target root cause conclusion is determined, and based on the target root cause conclusion and alarm basic information, the target remediation plan is determined and displayed; The target repair scheme includes at least the implementation steps for eliminating the fault.

2. The method according to claim 1, characterized in that, The basic alarm information includes at least one or more of the following: alarm code, alarm title, alarm time, site number, and frequency band type; the site association information includes at least the site equipment model, network topology, and historical fault records; and the fault classification identifier includes at least a pre-defined category label corresponding to the fault type.

3. The method according to claim 1, characterized in that, The alarm correlation model is determined based on the following method: Obtain the first alarm data corresponding to different frequency bands and the sample root cause conclusions of the first alarm data; The alarm association model is trained based on the first alarm data and the corresponding sample root cause conclusions, so that the alarm association model is obtained when the loss function converges.

4. The method according to claim 1, characterized in that, The determination of the target root cause conclusion based on the confidence attribute includes: The root cause conclusion with the highest confidence level is taken as the target root cause conclusion.

5. The method according to claim 1, characterized in that, The step of determining a target remediation plan based on the target root cause conclusions and alarm basic information includes: Based on the target root cause conclusion and the alarm basic information, the pre-created remediation suggestion strategy library is traversed to determine the target remediation plan; The repair suggestion strategy library includes at least a first historical repair scheme for different alarm base information under different root cause conclusions. The repair scheme is determined by aggregating second historical repair schemes corresponding to the same root cause conclusion and the same alarm base information. The first historical repair scheme includes at least one repair path, and the repair path includes implementation steps.

6. The method according to claim 1, characterized in that, The method further includes: When the number of stations in the frequency band is multiple, the alarm basic data of different frequency band stations are processed based on the attention mechanism in the alarm association model to obtain at least one confidence attribute corresponding to the root cause conclusion.

7. A fault root cause location device, characterized in that, include: The alarm data receiving module is used to receive alarm data from multiple detection dimensions. The alarm data includes basic alarm information, site association information associated with the alarm data, and fault classification identifier corresponding to the alarm data. The frequency band site determination module is used to determine the frequency band site based on the alarm basic information and site association information, and to retrieve the alarm association model associated with the frequency band site. The target remediation solution determination module is used to determine the target root cause conclusion based on the confidence attribute, and determine and display the target remediation solution based on the target root cause conclusion and alarm basic information; The target repair scheme includes at least the implementation steps for eliminating the fault.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform a fault root cause localization method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute and implement a fault root cause localization method according to any one of claims 1-6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements a fault root cause localization method as described in any one of claims 1-6.

Images