A fault processing method, device and equipment

Abstract

This invention discloses a fault handling method, apparatus, and device. The method includes: acquiring historical fault alarm data of network devices; determining high-frequency fault data combinations based on the alarm time and frequency of occurrence of the historical fault data; generating fault-related rules based on the high-frequency fault data combinations; using a pre-trained filtering model to filter target-related rules from the fault-related rules based on the historical fault data; the filtering model being constructed based on a preset iterative optimization algorithm to filter target-related rules that satisfy multiple preset optimization conditions from the fault-related rules; filtering multiple target fault alarm data that have a symbiotic relationship among the fault alarm data to be processed based on the target-related rules; and performing fault handling on the network devices corresponding to the multiple target fault alarm data.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a fault handling method, apparatus, and device. Background Technology

[0002] With the continuous development of information technology, the scale of network systems is constantly expanding and their complexity is increasing, which makes the traditional method of manually locating network faults no longer applicable.

[0003] To improve the processing efficiency of alarm data, root cause analysis can be performed on alarm data to handle related alarm data. For example, network routing information can be collected in real time, and root cause analysis can be performed on alarm data received from devices based on the routing information cached for a period of time. However, since this solution requires the collection of routing information from all devices in the network, it suffers from high resource consumption and low real-time performance, and cannot fully realize network-level alarm root cause analysis, resulting in low efficiency and accuracy of fault handling. Therefore, a technical solution is needed to improve the efficiency and accuracy of root cause analysis of network device fault alarm data, so as to improve the effect of network device fault handling. Summary of the Invention

[0004] The purpose of this invention is to provide a technical solution that can improve the efficiency and accuracy of root cause analysis of network device fault alarm data, thereby improving the effectiveness of network device fault handling.

[0005] To solve the above-mentioned technical problems, the embodiments of the present invention are implemented as follows: In a first aspect, an embodiment of the present invention provides a fault handling method, the method comprising: acquiring historical fault alarm data of network devices; determining high-frequency fault data combinations based on the alarm time and occurrence frequency of the historical fault data, and generating fault-related rules based on the high-frequency fault data combinations; using a pre-trained screening model, selecting target related rules from the fault-related rules based on the historical fault data, wherein the screening model is constructed based on a preset iterative optimization algorithm and is used to select target related rules that satisfy multiple preset optimization conditions from the fault-related rules, the optimization conditions including support, confidence, interest, and event complexity; and, based on the target related rules, selecting multiple target fault alarm data that have a related relationship among the fault alarm data to be processed, and performing fault handling on the network devices corresponding to the multiple target fault alarm data.

[0006] Secondly, embodiments of the present invention provide a fault handling device, the device comprising: a data acquisition module for acquiring historical fault alarm data of network devices; a first generation module for determining high-frequency fault data combinations based on the alarm time and occurrence frequency of the historical fault data, and generating fault-related rules based on the high-frequency fault data combinations; a second generation module for using a pre-trained screening model to filter target-related rules from the fault-related rules based on the historical fault data, the screening model being constructed based on a preset iterative optimization algorithm, used to filter out models of target-related rules that satisfy multiple preset optimization conditions from the fault-related rules, the optimization conditions including support, confidence, interest, and event complexity; and a fault handling module for filtering multiple target fault alarm data that have a symbiotic relationship from the fault alarm data to be processed based on the target-related rules, and performing fault handling on the network devices corresponding to the multiple target fault alarm data.

[0007] Thirdly, embodiments of the present invention provide a fault handling device, including a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the steps of the fault handling method provided in the above embodiments.

[0008] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of the fault handling method provided in the above embodiments.

[0009] Fifthly, embodiments of the present invention provide a computer program product, including a computer program that, when executed by a processor, implements the steps of the fault handling method provided in the above embodiments. Attached Figure Description

[0010] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a flowchart illustrating a fault handling method according to the present invention; Figure 2 This is a schematic diagram illustrating the generation process of a target-related rule according to the present invention; Figure 3 This is a flowchart illustrating the process of filtering target fault alarm data according to the present invention. Figure 4 This is a schematic diagram illustrating the semantic association of alarm titles according to the present invention; Figure 5 This is a schematic diagram of a multidimensional analysis process according to the present invention; Figure 6 This is a flowchart illustrating another method for filtering target fault alarm data according to the present invention. Figure 7 This is a flowchart illustrating the screening process of a target-associated rule according to the present invention. Figure 8 This is a schematic diagram of a root cause analysis process according to the present invention; Figure 9 This is a schematic diagram of a system front-end page according to the present invention; Figure 10 This is a schematic diagram of a longitudinal array according to the present invention; Figure 11 This is a schematic diagram of a visual modal analysis process for fault alarm data according to the present invention; Figure 12 This is a schematic diagram of a frequency analysis process for fault alarm data according to the present invention; Figure 13 This is a schematic diagram of target fault alarm data with a symbiotic relationship according to the present invention; Figure 14 This is a schematic diagram of the structure of a fault handling device according to the present invention; Figure 15 This is a schematic diagram of the structure of a fault handling device according to the present invention. Detailed Implementation

[0012] This invention provides a fault handling method, apparatus, and device.

[0013] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0014] like Figure 1 As shown, this embodiment of the invention provides a fault handling method. The executing entity of this method can be a server, which can be a standalone server or a server cluster composed of multiple servers. Specifically, the method may include the following steps: In step S102, historical fault alarm data of the network device is obtained.

[0015] Among them, network devices can be any devices that can be used for network communication, such as terminal devices, network element devices, base station devices, etc. Historical fault alarm data can be fault alarm data received within a preset detection period (such as the past month, the past six months, etc.). Historical fault alarm data can include alarm time, alarm title, alarm identifier (i.e. alarm ID), etc.

[0016] In step S104, based on the alarm time of historical fault data and the frequency of occurrence of historical fault data, high-frequency fault data combinations are determined, and fault-related rules are generated based on the high-frequency fault data combinations.

[0017] In implementation, time-series association rule mining can be used to determine high-frequency fault data combinations based on the alarm time and frequency of occurrence of historical fault data. That is, based on the alarm time and frequency of occurrence of historical fault data, fault combinations that frequently occur within a specified time window can be filtered out, and high-frequency fault data combinations can be determined based on the filtered fault combinations.

[0018] For example, the server can construct multiple candidate fault combinations corresponding to historical fault data based on the alarm time of historical fault data. Then, based on the frequency of occurrence of historical fault data included in each candidate fault combination, the server determines the support for each candidate fault combination. The support can be the ratio between the frequency of occurrence of historical fault data included in each candidate fault combination and the number of historical fault data points. Finally, the server can filter out high-frequency fault data combinations based on the support for each candidate fault combination and a preset support threshold.

[0019] Alternatively, the server can also use a pre-trained combination determination model to determine high-frequency fault data combinations based on the alarm time and frequency of occurrence of historical fault data. The combination determination model can be a model built based on deep learning algorithms, such as a large language model or a multimodal large language model.

[0020] High-frequency fault data combinations can be combinations such as (historical fault data 1, historical fault data 2), (historical fault data 3, historical fault data 4, and historical fault data 5).

[0021] After obtaining the high-frequency fault data combination, the server can generate fault companion rules based on the fault type, event type, device type, etc. corresponding to the historical fault data contained in the high-frequency fault data combination. The fault companion rules are used to characterize the fault relationships such as mutual relationship and causal relationship between faults.

[0022] In step S106, a pre-trained screening model is used to select target associated rules from fault-associated rules based on historical fault data.

[0023] The screening model can be a model built based on a preset iterative optimization algorithm, used to select target associated rules that meet multiple preset optimization conditions from the associated rules of faults. The optimization conditions can include support, confidence, interest, and event complexity. Support can be used to characterize the frequency of occurrence of associated rules of faults, and to reflect the universality or coverage of associated rules of faults. Confidence can be used to characterize the conditional probability of associated rules of faults, and to measure the reliability of associated rules of faults. Interest can be used to characterize the strength of the correlation between conditions and conclusions in associated rules of faults, and to exclude false associations caused by the high frequency of conclusions themselves. Event complexity includes time and / or space complexity, and is used to measure the complexity of associated rules of faults in terms of event latency and system topology span, and can be used to reflect the interpretability and operation and maintenance costs of associated rules of faults.

[0024] In practice, the fault-related problem can be viewed as a multi-objective optimal boundary front search problem. By utilizing the high-frequency itemset prior principle, the fault problem can be regarded as a multi-objective optimization problem involving support, confidence, interest, and time and space complexity.

[0025] The server can generate candidate fault-related rules by using an auto-incrementing rule header. These fault-related rules must, in time, satisfy the definition of rules based on the high-frequency itemset prior principle. Then, as... Figure 2 As shown, the server can treat the search for companion problems as a multi-objective optimization problem, perform optimization analysis on the rules, and through iterative optimization, find the optimal frontier of multi-objectives in terms of support, confidence, interest and time and space complexity according to user-defined support thresholds, confidence thresholds, etc., and generate the final time-based objective companion rules.

[0026] In step S108, based on the target symbiotic rules, multiple target fault alarm data that have a symbiotic relationship are selected from the fault alarm data to be processed, and fault processing is performed on the network devices corresponding to the multiple target fault alarm data.

[0027] In implementation, the server can utilize target companion rules to filter fault alarm data, identifying multiple target fault alarm data with companion relationships. For example, suppose the fault alarm data includes fault alarm data 1, fault alarm data 2, fault alarm data 3, fault alarm data 4, and fault alarm data 5. Based on target companion rule 1, the server can determine that there is a companion relationship between fault alarm data 1 and fault alarm data 2. If the companion relationship corresponding to target companion rule 1 can be a causal relationship, that is, the fault of the network device corresponding to fault alarm data 2 is caused by the fault of the network device corresponding to fault alarm data 1. Based on target companion rule 2, the server can also determine that there is a companion relationship between fault alarm data 3, fault alarm data 4, and fault alarm data 5. If the companion relationship corresponding to target companion rule 2 can be a mutually influential relationship, that is, the network devices corresponding to these three data points have a mutually influential fault relationship.

[0028] Then, the server can treat multiple co-related target fault alarm data as a single fault handling task and assign it to the corresponding personnel for processing, thereby improving the efficiency and accuracy of fault handling. For example, the server can generate a work order corresponding to multiple co-related target fault alarm data and dispatch the work order to the corresponding personnel for processing.

[0029] This invention provides a fault handling method. It acquires historical fault alarm data from network devices, determines high-frequency fault data combinations based on the alarm time and frequency of occurrence of the historical fault data, generates fault-related rules based on these combinations, and uses a pre-trained filtering model to select target associated rules from the fault-related rules based on the historical fault data. The filtering model can be constructed based on a preset iterative optimization algorithm to select target associated rules that satisfy multiple preset optimization conditions from the fault-related rules. These optimization conditions may include support, confidence, interest, and event complexity. Based on the target associated rules, multiple target fault alarm data with associated relationships are selected from the fault alarm data to be processed, and fault handling is performed on the network devices corresponding to these multiple target fault alarm data. In this way, by treating the search for data-related problems as a multi-objective optimization problem, and by optimizing and analyzing the fault-related rules generated based on combinations of high-frequency fault data, the target-related rules can be quickly and accurately screened out. Based on the target-related rules, multiple target fault alarm data with co-existing relationships can be screened out from the fault data to be processed. Then, the fault processing of multiple target fault alarm data with co-existing relationships can be carried out, which can improve the efficiency and accuracy of root cause analysis of network device fault alarm data, as well as the efficiency and accuracy of network device fault processing.

[0030] In practical applications, the specific processing methods for multiple target fault alarm data with co-existing relationships among the fault alarm data to be processed in step S108 above, based on the target co-existence rule, can vary. The following provides one optional processing method, such as... Figure 3 As shown, the specific process may include the following steps S1082 to S1088.

[0031] In step S1082, the alarm titles in the historical fault alarm data are obtained.

[0032] In step S1084, based on the similarity between alarm titles, the first fault alarm data that has a semantic relationship is selected from the historical fault alarm data.

[0033] In implementation, the server can extend alarm data (i.e., fault alarm data) from the time dimension to the semantic dimension. This means that the Chinese titles (i.e., alarm titles) of fault alarm data that are related may have a literal similarity, for example... Figure 4 In the fault alarm data 1-3 shown, which exhibit a co-existing relationship, fault alarm data 2 and fault alarm data 3 share the same keyword "radio frequency unit" in their alarm titles. Therefore, the server can extract semantic co-existing rules from the semantic dimension of the alarm titles of historical fault alarm data.

[0034] Specifically, the server can use a Chinese vector language model to process alarm titles in historical alarm data by removing stop words and punctuation marks, and then use a pre-trained model to vectorize the processed alarm titles into text. Based on the obtained text vectors, the server can filter out the first fault alarm data that has semantic relationships.

[0035] In step S1086, the semantic rule generation model, which is pre-trained, generates semantic companion rules based on the alarm titles contained in the first fault alarm data.

[0036] The semantic rule generation model can be a model built based on a preset machine learning algorithm.

[0037] In implementation, such as Figure 5 As shown, the server can construct a candidate database based on the first alarm data, and perform data augmentation processing on the first fault alarm data when the amount of data in the candidate database is less than a preset data amount threshold, to obtain a training dataset.

[0038] Then, the server can train the semantic rule generation model using the training dataset. Based on the trained semantic rule generation model, and based on the alarm titles contained in the first fault alarm data, semantic companion rules can be generated. In this way, the server can start from the perspective of the similarity between long and short texts, and perform companion analysis on the alarm titles from the perspective of their Chinese titles, focusing on semantic companions. Then, using the semantic logic learning model (i.e., the semantic rule generation model), the alarm titles contained in the first fault alarm data are treated as continuous sentences, and the semantic logic-level companion relationships between different words in the sentences are found to obtain semantic companion rules.

[0039] In step S1088, based on the target symbiotic rules and semantic symbiotic rules, multiple target fault alarm data that have a symbiotic relationship are selected from the fault alarm data to be processed.

[0040] In practice, the server can identify multiple fault alarm data that simultaneously satisfy both the target symbiotic rule and the semantic symbiotic rule as multiple target fault alarm data with a symbiotic relationship.

[0041] In practical applications, the specific processing methods for filtering out multiple target fault alarm data with symbiotic relationships among the fault alarm data to be processed in step S1088 based on the target symbiotic rules and the semantic symbiotic rules can be varied. The following provides an optional processing method, which may specifically include the processing of the following steps A1 to A3.

[0042] In step A1, the network topology relationship between network devices corresponding to historical fault alarm data is obtained.

[0043] In step A2, based on the network topology and alarm times of historical fault alarm data, fault correlation is determined, and sequential companion rules are generated based on the fault correlation.

[0044] In implementation, such as Figure 5 As shown, the server can generate a topology map based on the network topology relationship, and determine the fault correlation relationship of historical fault alarm data in the spatial dimension based on the alarm time of historical fault alarm data (i.e. traffic data), so as to generate sequential companion rules based on the fault correlation relationship.

[0045] The server can also generate sequential companion rules based on the importance of each node in the network topology and the fault association relationship.

[0046] In step A3, based on the target co-occurrence rules, semantic co-occurrence rules, and sequential co-occurrence relationships, multiple target fault alarm data that have co-occurrence relationships are selected from the fault alarm data to be processed.

[0047] In practice, the server can use target-related rules, semantic-related rules, and sequential-related relationships to analyze the co-occurrence relationships of fault alarm data from three dimensions: time, space, and semantics, thereby finding the deep co-occurrence relationships of fault alarms.

[0048] In practical applications, the specific processing methods for multiple target fault alarm data with co-existing relationships among the fault alarm data to be processed in step S108 above, based on the target co-existence rule, can vary. The following provides one optional processing method, such as... Figure 6 As shown, the specific process may include the following steps S10810 to S10814.

[0049] In step S10810, based on historical fault data, the first fault data and the second fault data corresponding to the target associated rule are determined.

[0050] In implementation, for example, assuming the target symbiotic rule is that network device A and network device B have a fault symbiotic relationship, the server can use the fault data corresponding to network device A in the historical fault data as the first fault data, and the fault data corresponding to network device B in the historical fault data as the second fault data.

[0051] In step S10812, based on the number of times the first fault data and the second fault data appear simultaneously in the historical fault data, the number of alarms for the first fault data within the preset detection time, and the number of alarms for the second fault data within the preset detection time, the detection value corresponding to each target accompanying rule is determined.

[0052] In implementation, the server can use a custom intersection-union ratio to filter the target companion rules in order to achieve the output of strict companion rules in real-time scenarios.

[0053] Specifically, the server can use the ratio of the number of times two alarms occur simultaneously within the same time period to the sum of the number of times the two alarms occur within the total detection time as the detection value corresponding to the target symbiotic rule. In other words, the server can determine the detection value corresponding to the target symbiotic rule by the ratio of the number of times the first fault data and the second fault data occur simultaneously in the historical fault data to the sum of the number of alarms for the first fault data within the preset detection time and the number of alarms for the second fault data within the preset detection time. That is, only fault alarm data that occur simultaneously or approximately simultaneously within a certain time period are considered to have a symbiotic relationship.

[0054] In step S10814, based on the detection value and the preset detection threshold, the target accompaniment rules are filtered, and based on the filtered target accompaniment rules, multiple target fault alarm data that have accompaniment relationships are selected from the fault alarm data to be processed.

[0055] In practice, the server can filter out target companion rules whose detection values ​​are greater than a preset detection threshold, and then process the fault alarm data to be processed based on the selected target companion rules.

[0056] In practical applications, the specific processing methods for selecting target associated rules from fault-related rules based on historical fault data using a pre-trained screening model in step S106 above can vary. One optional processing method is provided below, such as... Figure 7 As shown, the specific process may include the following steps S1062 to S1066.

[0057] In step S1062, based on a preset time period, multiple historical fault alarm data of the same network device are normalized to obtain normalized historical fault alarm data.

[0058] In implementation, such as Figure 8 As shown, the main process of intelligent analysis of network device fault root causes and correlations is as follows: 1) Multi-dimensional granular control interactive system The multi-dimensional granular control interaction system can achieve goal-oriented functions, that is, generate corresponding linkage analysis based on the user's real-time, cross-time, and cross-professional needs in different application scenarios. Among them, the profession can be used to characterize the type of communication network, such as core network, transmission network, base station, etc.

[0059] Firstly, for fault signals in the time, space, and frequency domains, different granularities can be used in different domains, and this granularity can be adjusted in real time through the platform front-end. For example, in the time dimension, data analysis can be performed at the second, grade, and hour levels. In the spatial dimension, different vector space metrics can be used, such as Euclidean distance, Manhattan distance, and sine / cosine distance, for further subdivision. In the frequency domain, input data can be converted from data to signals using wavelet transform and other methods, while cross-frequency linkage control interaction can be achieved for different frequencies. Furthermore, this granular control interaction system can be directly linked to the physical prior conditions of communication equipment. Therefore, different professions and different devices will have their own unique set of front-end parameters, such as alarm lifetime, alarm vector space distance, and alarm frequency range. Through the interaction of front-end parameters, specific faults can be analyzed specifically, and the system's human-computer interaction can be achieved from multiple dimensions and granularities. Ultimately, the results of its front-end program will vary depending on the user's immediate, cross-time, and cross-professional needs. A standard interface template can also be designed to facilitate a unified process for different devices. Different parameters will result in different output rules. These rules are directly linked to the interaction granularity and parameters. Therefore, the final rule metrics will generate different customized rules based on the front-end pre-values.

[0060] The server can utilize a multi-dimensional granular control interaction system to obtain historical fault alarm data. The front-end interface of this system can be as follows: Figure 9 As shown.

[0061] 2) Classification by different lengths First, due to inconsistent scales, sequential encoding can be used to encode different fields in historical fault alarm data for unified learning. However, since sequential encoding only distinguishes data of the same type and cannot differentiate between different types of data, the server can use categorical encoding of varying lengths. This allows for a more compact representation of different fields based on information theory principles, removing redundant information and extracting key features. Ultimately, this achieves the encoding of different types of fields in the historical fault alarm data.

[0062] In this way, classifying data by different lengths can reduce data dimensionality, decrease computational complexity, improve model training and prediction efficiency, and uncover hidden patterns and features within the data. Furthermore, classifying data by different lengths allows for computation on the same dimension across different classes and scales.

[0063] 3) Analysis of true concomitant fields under unsupervised learning While categorical encoding of varying lengths can achieve a compact representation of raw data, inconsistent data scales prevent direct analysis using algorithms. Furthermore, the sheer volume of data in historical fault alarm data, including fields such as alarm title, alarm ID, and alarm time, can lead to data explosion. Therefore, unsupervised learning models can be used to learn the co-occurring relationships between encoded historical fault data. Specifically, historical fault alarms can be input into an unsupervised compression and reconstruction model, which then learns the basis vectors of the original data. These basis vectors represent the truly important co-occurring fields. Through unsupervised learning, the truly co-occurring alarm fields at different scales can be identified, such as alarm standard ID (i.e., alarm identifier), alarm time, and alarm title.

[0064] 4) Data weighting under a unified time box The server can use Greenwich Mean Time as the base time to normalize multiple historical fault alarm data of the same network device within a preset time period (such as 5 minutes, 10 minutes, etc.) in the data source data after flexible length encoding (i.e., historical fault alarm data after different lengths of fixed-class encoding) according to the base time, so as to obtain normalized historical fault alarm data.

[0065] For example, a server can merge multiple identical historical fault alarm data of the same network device within a preset time period, that is, it can retain only the first historical fault alarm data within the preset time period.

[0066] In step S1064, based on the target indicator data in the normalized historical fault data, the historical fault data is clustered to obtain multiple fault categories.

[0067] The target metric data may include alarm identifier, alarm title, and alarm time.

[0068] In practice, the server can identify the true associated fields determined by the unsupervised learning as the target indicator data, and use a preset clustering algorithm to cluster the historical fault data based on the target indicator data in the normalized historical fault data to obtain multiple fault categories.

[0069] like Figure 8 As shown, the above-mentioned intelligent analysis process for the root causes and correlations of network device failures may also include: 5) Weight generation vertical array The normalized historical fault data is filtered and cleaned, and then a vertical array is used, combined with time bins and weights, to perform a secondary sorting and classification of the data. For example... Figure 10 As shown, the vertical array represents time along its axis, fault categories along its horizontal axis, and alarm results indicating whether a process occurred within the array. This approach makes the overall data more unified in the feature space. Transforming complex time-related information into a vertical array can accelerate algorithm execution.

[0070] 6) Deformation and recombination models improve information density Because the input data features have inconsistent scales, and the data volumes of alarm time, alarm ID, etc., are not on the same dimension, directly using clustering algorithms cannot find low-redundancy field data. Therefore, a deformation model can be used to deform the normalized historical fault data in terms of dimension, compressing the data dimension of the normalized historical fault data as much as possible. Then, a recombination model is used to restore the deformed normalized historical fault data as much as possible, thereby mapping high-dimensional data to a low-dimensional space, removing redundant information in the original array, improving information density, and the learned associated fields can be used for subsequent spatiotemporal and semantic fault associated analysis.

[0071] In step S1066, a preset array is constructed based on the fault category and the alarm time of the corresponding historical fault data, and a target associated rule is selected from the fault associated rules based on the preset array using a pre-trained screening model.

[0072] In implementation, such as Figure 8 As shown, the above-mentioned intelligent analysis process for the root causes and correlations of network device failures may also include: 7) Multi-objective optimal boundary front fault co-occurrence analysis The problem of fault co-occurrence can be viewed as a multi-objective optimal boundary front search problem. The server can use the principle of high-frequency itemset prior to view the fault problem as a multi-objective optimization problem of support, confidence, interest and time and space complexity.

[0073] Based on the recombined vertical array, candidate fault-related rules are generated by using the rule head self-growth method. These fault-related rules need to meet the strict definition of rules in terms of high-frequency itemset prior principles in time.

[0074] The problem of finding companions can then be viewed as a multi-objective optimization problem. The rules are optimized and analyzed. By combining biological iterative optimization methods such as genetics and ant colony optimization, the optimal frontiers of multi-objectives in terms of support, confidence, interest and time and space complexity are found respectively, and the final time-based alarm companion rules are generated.

[0075] 8) Rigorous co-occurrence analysis of longitudinal array crossover and union ratio Traditional time-related analysis algorithms are mostly horizontal arrays, which have unacceptable time complexity for large datasets. At the same time, classic time-related analysis algorithms are mostly designed for real-time scenarios and are difficult to apply to time-series derivation scenarios. Therefore, a vertical array approach can be used to compress and expand time data. The original data is re-encoded and compressed using a deformation and recombination model. The data at relative time is reasonably expanded according to its actual meaning. Combined with the intersection-union ratio (IUU) definition used in image processing, the improvement of the original time-related analysis algorithm is replaced to determine the temporal similarity of the data.

[0076] The detection value corresponding to each target companion rule can be determined by dividing the alarms vertically by time. The ratio of the number of times two alarms occur simultaneously within the same time period to the sum of the number of times the two alarms occur within the total detection time is used to determine the companion rule. The result obtained by filtering through the intersection-union ratio (i.e. the detection value) is the strict companion rule. That is, only alarms that occur simultaneously or approximately simultaneously within a certain time period are considered companions, thus realizing the output of strict companion rules in real-time scenarios.

[0077] In practical applications, the preset iterative optimization algorithm can include multi-objective genetic algorithm, multi-objective ant colony optimization algorithm, and hybrid algorithm. The hybrid algorithm can be a combination of association rule learning algorithm and multi-objective genetic algorithm.

[0078] This allows for integration with equipment parameter monitoring systems. By monitoring equipment parameters in real time and inputting them into an artificial intelligence model, the model can promptly detect anomalies and issue alerts using selected associated rules. Maintenance personnel can then quickly pinpoint the associated relationships between equipment faults based on the alert information, combined with the alert type and associated rules provided by the AI ​​model, and take appropriate maintenance measures. The AI ​​model suitable for communication equipment alarms, constructed using the above method, combined with data mining techniques, can discover potential associated relationships between alarms, thereby accelerating maintenance.

[0079] like Figure 8 As shown, the above-mentioned intelligent analysis process for the root causes and correlations of network device failures may also include: Multimodal linkage analysis primarily involves parsing the original data domain signals into different domains for multimodal analysis, especially for time-series data to achieve delay-based linkage analysis. Firstly, the alarm time-series data of network devices corresponding to multiple co-existing target fault alarm data can be converted into image signals. Utilizing data visualization principles, the data is then matrix-imaged based on indicators such as frequency and cross-multiplication ratio (CMR), resulting in black-and-white brightness maps or red-blue heatmaps (e.g.,...). Figure 11 As shown), converting the data modality into a visual modality, and transforming the data into pixels, is a layer of linked analysis targeting the visual modality of fault data information. In this context, as shown... Figure 11 In the red-blue heatmap shown, the color bars represent the range of correlation coefficients, from blue (lower values, approximately 0.80) to red (higher values, close to 1.00). Specifically, the red cell in the upper left corner indicates a correlation coefficient of 1 between "input broadcast data packets" and "input unicast data packets," meaning a perfect positive correlation. The blue cell in the upper right corner indicates a correlation coefficient of 0.76 between "input broadcast data packets" and "output unicast data packets," indicating a strong positive correlation. The blue cell in the lower left corner indicates a correlation coefficient of 0.76 between "output broadcast data packets" and "input unicast data packets," also indicating a strong positive correlation. The red cell in the lower right corner indicates a correlation coefficient of 1 between "output broadcast data packets" and "output unicast data packets," meaning a perfect positive correlation.

[0080] Then, from a frequency domain perspective, the time-series signal can be expanded. Based on the signal fluctuations, the fluctuations of the time-series signal in different frequency domains can be analyzed, and the data can be abstracted into frequency signals, which can also be regarded as audio signals. This allows for dual-linkage analysis of the fluctuations between alarms in the audio mode, yielding results such as... Figure 12 The time series graphs shown depict the trends of four KPIs (Key Performance Indicators) related to "flux" over time. Each curve represents the numerical change of a KPI, with the horizontal axis representing time and the vertical axis representing the numerical value of that KPI. These KPIs may characterize the operational status of network devices.

[0081] Ultimately, by combining the vector space perspective, time-series signals can be mapped to a high-dimensional space. Through the measurement of outliers and distance metrics, a triple analysis of alarms within the vector space modalities can be achieved. This triple analysis enables multi-dimensional, interconnected analysis of time-series alarm information from temporal, spatial, and frequency domain perspectives.

[0082] The association relationships between the fault alarm data detected based on the above-mentioned target association rules can be as follows: Figure 13 As shown, Figure 13 The color of the connecting lines indicates the order of alarm times; that is, the alarm time of the red connecting line is earlier than the alarm time of the blue connecting line. Figure 13 The fault alarm data displayed includes the fault standard ID and alarm title.

[0083] Furthermore, by combining professional information and analyzing the flow of information within the link, root cause analysis can be performed based on the chronological order of fault alarm data. In traditional three-layer communication link analysis (transmission, environmental monitoring, and wireless), expert knowledge suggests that transmission faults occur first, while environmental and wireless faults are likely to arise due to issues at the transmission layer. In this case, prior experience can be incorporated to further filter the initial analysis of interconnected characteristics from multiple disciplines, enabling the identification of the "root cause" from a physical perspective.

[0084] In this way, by constructing AI-powered alarm models suitable for different communication devices, and using AI algorithms to find the co-existing relationships between potential device data and semantic information in alarms, co-existing relationship analysis of alarm information can be achieved. This also reduces the need for significant network and device resources, avoids impacting network performance, reduces the burden on the network management system, and ensures the real-time processing of information. Simultaneously, it can address the problem of new fault types caused by the complexity and variability of network systems, thereby accurately diagnosing faults. Furthermore, the fault handling method provided in the embodiments of this specification not only performs co-existing analysis of fault alarm data from a data co-existing perspective, but also performs co-existing analysis of alarm titles and device network elements from an information perspective from a logical space perspective. This improves the efficiency and accuracy of network device fault handling and possesses multiple advantages such as low-cost investment, excellent reliability, easy portability, easy scalability, and convenient maintenance.

[0085] This specification provides a fault handling method. It involves acquiring historical fault alarm data from network devices, determining high-frequency fault data combinations based on the alarm time and frequency of occurrence of the historical fault data, generating fault-related rules based on these combinations, and using a pre-trained filtering model to select target associated rules from the fault-related rules based on the historical fault data. The filtering model can be constructed based on a preset iterative optimization algorithm to select target associated rules that satisfy multiple preset optimization conditions from the fault-related rules. These optimization conditions may include support, confidence, interest, and event complexity. Based on the target associated rules, multiple target fault alarm data with associated relationships are selected from the fault alarm data to be processed, and fault handling is performed on the network devices corresponding to these multiple target fault alarm data. In this way, by treating the search for data-related problems as a multi-objective optimization problem, and by optimizing and analyzing the fault-related rules generated based on combinations of high-frequency fault data, the target-related rules can be quickly and accurately screened out. Based on the target-related rules, multiple target fault alarm data with co-existing relationships can be screened out from the fault data to be processed. Then, the fault processing of multiple target fault alarm data with co-existing relationships can be carried out, which can improve the efficiency and accuracy of root cause analysis of network device fault alarm data, as well as the efficiency and accuracy of network device fault processing.

[0086] The above are fault handling methods provided in the embodiments of this specification. Based on the same idea, the embodiments of this specification also provide a fault handling device, such as... Figure 14 As shown.

[0087] The fault handling device includes: a data acquisition module 1401, a first generation module 1402, a second generation module 1403, and a fault handling module 1404, wherein: Data acquisition module 1401 is used to acquire historical fault alarm data of network devices; The first generation module 1402 is used to determine a high-frequency fault data combination based on the alarm time of the historical fault data and the frequency of occurrence of the historical fault data, and to generate fault companion rules based on the high-frequency fault data combination. The second generation module 1403 is used to use a pre-trained screening model to select target associated rules from the fault associated rules based on the historical fault data. The screening model is constructed based on a preset iterative optimization algorithm and is used to select target associated rules that meet multiple preset optimization conditions from the fault associated rules. The optimization conditions include support, confidence, interest and event complexity. The fault handling module 1404 is used to filter out multiple target fault alarm data that have a symbiotic relationship from the fault alarm data to be processed based on the target symbiotic rules, and to perform fault handling on the network devices corresponding to the multiple target fault alarm data.

[0088] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the fault handling apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0089] This specification provides a fault handling device that acquires historical fault alarm data from network devices, determines high-frequency fault data combinations based on the alarm time and frequency of occurrence of the historical fault data, generates fault-related rules based on these combinations, and uses a pre-trained filtering model to select target associated rules from the fault-related rules based on the historical fault data. The filtering model can be constructed based on a preset iterative optimization algorithm to select target associated rules that satisfy multiple preset optimization conditions from the fault-related rules. These optimization conditions may include support, confidence, interest, and event complexity. Based on the target associated rules, multiple target fault alarm data with associated relationships are selected from the fault alarm data to be processed, and fault handling is performed on the network devices corresponding to these multiple target fault alarm data. In this way, by treating the search for data-related problems as a multi-objective optimization problem, and by optimizing and analyzing the fault-related rules generated based on combinations of high-frequency fault data, the target-related rules can be quickly and accurately screened out. Based on the target-related rules, multiple target fault alarm data with co-existing relationships can be screened out from the fault data to be processed. Then, the fault processing of multiple target fault alarm data with co-existing relationships can be carried out, which can improve the efficiency and accuracy of root cause analysis of network device fault alarm data, as well as the efficiency and accuracy of network device fault processing.

[0090] The above are the fault handling devices provided in the embodiments of this specification. Based on the same idea, the embodiments of this specification also provide a fault handling device, such as... Figure 15 As shown.

[0091] The fault handling device can provide terminal equipment or servers, etc., for the above embodiments.

[0092] Fault handling devices can vary considerably depending on configuration or performance, and may include one or more processors 1501 and memory 1502. Memory 1502 may store one or more application programs or data. Memory 1502 may be temporary or persistent storage. The application programs stored in memory 1502 may include one or more modules (not shown), each module including a series of computer-executable instructions for the fault handling device. Furthermore, processor 1501 may be configured to communicate with memory 1502 and execute the series of computer-executable instructions in memory 1502 on the fault handling device. The fault handling device may also include one or more power supplies 1503, one or more wired or wireless network interfaces 1504, one or more input / output interfaces 1505, and one or more keyboards 1506.

[0093] Specifically, in this embodiment, the fault handling device includes a memory and one or more programs, wherein one or more programs are stored in the memory, and one or more programs may include one or more modules, and each module may include a series of computer-executable instructions for the fault handling device, and is configured to be executed by one or more processors. The one or more programs include computer-executable instructions for performing the following: Obtain historical fault alarm data of network devices; Based on the alarm time and occurrence frequency of the historical fault data, high-frequency fault data combinations are determined, and fault-related rules are generated based on the high-frequency fault data combinations. Using a pre-trained screening model, target associated rules are selected from the fault-associated rules based on the historical fault data. The screening model is constructed based on a preset iterative optimization algorithm and is used to select target associated rules that meet multiple preset optimization conditions from the fault-associated rules. The optimization conditions include support, confidence, interest, and event complexity. Based on the target symbiotic rules, multiple target fault alarm data that have a symbiotic relationship are selected from the fault alarm data to be processed, and fault processing is performed on the network devices corresponding to the multiple target fault alarm data.

[0094] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the fault handling device embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0095] This specification provides a fault handling device that acquires historical fault alarm data from network devices, determines high-frequency fault data combinations based on the alarm time and frequency of occurrence of the historical fault data, generates fault-related rules based on these combinations, and uses a pre-trained filtering model to select target associated rules from the fault-related rules based on the historical fault data. The filtering model can be constructed based on a preset iterative optimization algorithm to select target associated rules that satisfy multiple preset optimization conditions from the fault-related rules. These optimization conditions may include support, confidence, interest, and event complexity. Based on the target associated rules, multiple target fault alarm data with associated relationships are selected from the fault alarm data to be processed, and fault handling is performed on the network devices corresponding to these multiple target fault alarm data. In this way, by treating the search for data-related problems as a multi-objective optimization problem, and by optimizing and analyzing the fault-related rules generated based on combinations of high-frequency fault data, the target-related rules can be quickly and accurately screened out. Based on the target-related rules, multiple target fault alarm data with co-existing relationships can be screened out from the fault data to be processed. Then, the fault processing of multiple target fault alarm data with co-existing relationships can be carried out, which can improve the efficiency and accuracy of root cause analysis of network device fault alarm data, as well as the efficiency and accuracy of network device fault processing.

[0096] Furthermore, based on the above Figures 1 to 13 The method shown in this specification, along with one or more embodiments, also provides a storage medium for storing computer-executable instruction information. In one specific embodiment, the storage medium can be a USB flash drive, optical disc, hard disk, etc. When the computer-executable instruction information stored in the storage medium is executed by a processor, it can achieve the following process: Obtain historical fault alarm data of network devices; Based on the alarm time and occurrence frequency of the historical fault data, high-frequency fault data combinations are determined, and fault-related rules are generated based on the high-frequency fault data combinations. Using a pre-trained screening model, target associated rules are selected from the fault-associated rules based on the historical fault data. The screening model is constructed based on a preset iterative optimization algorithm and is used to select target associated rules that meet multiple preset optimization conditions from the fault-associated rules. The optimization conditions include support, confidence, interest, and event complexity. Based on the target symbiotic rules, multiple target fault alarm data that have a symbiotic relationship are selected from the fault alarm data to be processed, and fault processing is performed on the network devices corresponding to the multiple target fault alarm data.

[0097] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the above-described storage medium embodiment is basically similar to the method embodiment, so the description is relatively simple; relevant parts can be referred to the description of the method embodiment.

[0098] This specification provides a storage medium that acquires historical fault alarm data from network devices, determines high-frequency fault data combinations based on the alarm time and frequency of occurrence of the historical fault data, generates fault-related rules based on these combinations, and uses a pre-trained filtering model to select target associated rules from the fault-related rules based on the historical fault data. The filtering model can be constructed based on a preset iterative optimization algorithm to select target associated rules that satisfy multiple preset optimization conditions from the fault-related rules. These optimization conditions may include support, confidence, interest, and event complexity. Based on the target associated rules, multiple target fault alarm data with associated relationships are selected from the fault alarm data to be processed, and fault processing is performed on the network devices corresponding to these multiple target fault alarm data. In this way, by treating the search for data-related problems as a multi-objective optimization problem, and by optimizing and analyzing the fault-related rules generated based on combinations of high-frequency fault data, the target-related rules can be quickly and accurately screened out. Based on the target-related rules, multiple target fault alarm data with co-existing relationships can be screened out from the fault data to be processed. Then, the fault processing of multiple target fault alarm data with co-existing relationships can be carried out, which can improve the efficiency and accuracy of root cause analysis of network device fault alarm data, as well as the efficiency and accuracy of network device fault processing.

[0099] Furthermore, based on the above Figures 1 to 13 The method shown in this specification, along with one or more embodiments, also provides a computer program product including a computer program that, when executed by a processor, performs the following process: Obtain historical fault alarm data of network devices; Based on the alarm time and occurrence frequency of the historical fault data, high-frequency fault data combinations are determined, and fault-related rules are generated based on the high-frequency fault data combinations. Using a pre-trained screening model, target associated rules are selected from the fault-associated rules based on the historical fault data. The screening model is constructed based on a preset iterative optimization algorithm and is used to select target associated rules that meet multiple preset optimization conditions from the fault-associated rules. The optimization conditions include support, confidence, interest, and event complexity. Based on the target symbiotic rules, multiple target fault alarm data that have a symbiotic relationship are selected from the fault alarm data to be processed, and fault processing is performed on the network devices corresponding to the multiple target fault alarm data.

[0100] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the above-described embodiment of a computer program product is relatively simple in description because it is fundamentally similar to the method embodiment; relevant parts can be referred to the description of the method embodiment.

[0101] This specification provides a computer program product that acquires historical fault alarm data from network devices, determines high-frequency fault data combinations based on the alarm time and frequency of occurrence of the historical fault data, generates fault-related rules based on these combinations, and uses a pre-trained filtering model to select target associated rules from the fault-related rules based on the historical fault data. The filtering model can be constructed based on a preset iterative optimization algorithm to select target associated rules that satisfy multiple preset optimization conditions from the fault-related rules. These optimization conditions may include support, confidence, interest, and event complexity. Based on the target associated rules, multiple target fault alarm data with associated relationships are selected from the fault alarm data to be processed, and fault handling is performed on the network devices corresponding to these multiple target fault alarm data. In this way, by treating the search for data-related problems as a multi-objective optimization problem, and by optimizing and analyzing the fault-related rules generated based on combinations of high-frequency fault data, the target-related rules can be quickly and accurately screened out. Based on the target-related rules, multiple target fault alarm data with co-existing relationships can be screened out from the fault data to be processed. Then, the fault processing of multiple target fault alarm data with co-existing relationships can be carried out, which can improve the efficiency and accuracy of root cause analysis of network device fault alarm data, as well as the efficiency and accuracy of network device fault processing.

[0102] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0103] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must also be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0104] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) that can be executed by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers.

[0105] For ease of description, the above apparatus is described by dividing it into various functional units. Of course, when implementing one or more embodiments of this specification, the functions of each unit can be implemented in one or more software and / or hardware.

[0106] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0107] Embodiments in this specification are described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable parallel device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable parallel device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0108] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable fraud device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0109] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0110] Computer-readable media includes both permanent and non-permanent, removable and non-removable media, and information storage can be achieved by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. As defined herein, computer-readable media does not include transient media, such as modulated data signals and carrier waves.

[0111] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0112] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0113] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0114] The above description is merely an embodiment of this specification and is not intended to limit this document. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. A failure handling method characterized by, The method includes: Obtain historical fault alarm data of network devices; Based on the alarm time and occurrence frequency of the historical fault data, high-frequency fault data combinations are determined, and fault-related rules are generated based on the high-frequency fault data combinations. Using a pre-trained screening model, target associated rules are selected from the fault-associated rules based on the historical fault data. The screening model is constructed based on a preset iterative optimization algorithm and is used to select target associated rules that meet multiple preset optimization conditions from the fault-associated rules. The optimization conditions include support, confidence, interest, and event complexity. Based on the target symbiotic rules, multiple target fault alarm data that have a symbiotic relationship are selected from the fault alarm data to be processed, and fault processing is performed on the network devices corresponding to the multiple target fault alarm data.

2. The method of claim 1, wherein, The step of filtering out multiple target fault alarm data that have a co-existing relationship from the fault alarm data to be processed based on the target co-existing rule includes: Obtain the alarm titles from the historical fault alarm data; Based on the similarity between the alarm titles, the first fault alarm data that has a semantic relationship is selected from the historical fault alarm data; The semantic rule generation model, which is based on the alarm title contained in the first fault alarm data, generates semantic companion rules using a pre-trained semantic rule generation model. The semantic rule generation model is a model built based on a preset machine learning algorithm. Based on the target symbiotic rules and the semantic symbiotic rules, multiple target fault alarm data that have a symbiotic relationship are selected from the fault alarm data to be processed.

3. The method of claim 2, wherein, The step of filtering out multiple target fault alarm data that have a co-existing relationship from the fault alarm data to be processed based on the target co-existing rules and the semantic co-existing rules includes: Obtain the network topology relationships between network devices corresponding to the historical fault alarm data; Based on the network topology and the alarm times of the historical fault alarm data, fault correlation is determined, and based on the fault correlation, sequential companion rules are generated. Based on the target co-occurrence rules, the semantic co-occurrence rules, and the sequential co-occurrence relationships, the multiple target fault alarm data that have co-occurrence relationships in the fault alarm data to be processed are selected.

4. The method according to claim 1, characterized in that, The step of filtering out multiple target fault alarm data that have a co-existing relationship from the fault alarm data to be processed based on the target co-existing rule includes: Based on the historical fault data, determine the first fault data and the second fault data corresponding to the target associated rule; Based on the number of times the first fault data and the second fault data appear simultaneously in the historical fault data, the number of alarms for the first fault data within the preset detection time, and the number of alarms for the second fault data within the preset detection time, the detection value corresponding to each target accompaniment rule is determined. Based on the detected value and the preset detection threshold, the target associated rules are filtered, and based on the filtered target associated rules, the multiple target fault alarm data that have an associated relationship in the fault alarm data to be processed are selected.

5. The method according to claim 1, characterized in that, The step of using a pre-trained screening model to select target associated rules from the fault-associated rules based on the historical fault data includes: Based on a preset time period, multiple historical fault alarm data of the same network device are normalized to obtain normalized historical fault alarm data. Based on the target indicator data in the normalized historical fault data, the historical fault data is clustered to obtain multiple fault categories. The target indicator data includes alarm identifier, alarm title, and alarm time. Based on the fault category and the alarm time of the corresponding historical fault data, a preset array is constructed, and the target associated rule is selected from the fault associated rules using the pre-trained filtering model based on the preset array.

6. The method according to claim 1, characterized in that, The preset iterative optimization algorithm includes a multi-objective genetic algorithm, a multi-objective ant colony optimization algorithm, and a hybrid algorithm, wherein the hybrid algorithm is a combination of an association rule learning algorithm and a multi-objective genetic algorithm.

7. A fault handling device, characterized in that, The device includes: The data acquisition module is used to acquire historical fault alarm data of network devices; The first generation module is used to determine high-frequency fault data combinations based on the alarm time of the historical fault data and the frequency of occurrence of the historical fault data, and to generate fault companion rules based on the high-frequency fault data combinations. The second generation module is used to use a pre-trained screening model to select target associated rules from the fault associated rules based on the historical fault data. The screening model is constructed based on a preset iterative optimization algorithm and is used to select target associated rules that meet multiple preset optimization conditions from the fault associated rules. The optimization conditions include support, confidence, interest and event complexity. The fault handling module is used to filter out multiple target fault alarm data that have a symbiotic relationship from the fault alarm data to be processed based on the target symbiotic rules, and to perform fault handling on the network devices corresponding to the multiple target fault alarm data.

8. A fault handling device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the fault handling method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, which, when executed by a processor, implements the steps of the fault handling method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, It includes a computer program that, when executed by a processor, implements the steps of the fault handling method according to any one of claims 1 to 6.

Images