Power optical network fault root cause positioning method and system based on business correlation analysis

Abstract

The application discloses a power optical network fault root cause positioning method and system based on service correlation analysis, and comprises the following steps: collecting alarm information, service bearing information, link connection relationship and network topology information in a network, performing standardization processing, forming alarm event sequence and service bearing correlation data; based on service bearing relationship and network topology, constructing the correlation structure among services, links and devices, determining the service path, link path and device position corresponding to the alarm event, and generating a candidate correlation set; performing multivariate Hawkes process modeling on the time trigger relationship between alarm events, obtaining an initial alarm correlation structure; combining the service path and the link path, performing conditional dependence testing on the alarm correlation relationship, and generating a sparse causal relationship structure; according to the alarm trigger direction and the occurrence time, identifying a cascading propagation starting node, forming a fault root cause candidate set, and outputting a fault positioning result. The application relates to the technical field of communication network management.

Description

Technical Field

[0001] This invention relates to the field of communication network management technology, and in particular to a method and system for locating the root cause of faults in power optical networks based on service correlation analysis. Background Technology

[0002] As a crucial information transmission infrastructure in power systems, power optical communication networks bear the responsibility for carrying various critical services, including dispatch control, relay protection, video surveillance, and data acquisition. With the expansion of network scale and the increasing variety of services, the network structure is gradually becoming characterized by complex links, a large number of devices, and high service interleaving. In actual operation, once a device failure or link anomaly occurs, it often triggers a large number of alarm events to cascade and propagate across different network layers and service paths, forming a multi-source, multi-type, and temporally densely distributed alarm set.

[0003] In existing technologies, fault location in power optical communication networks typically employs methods based on alarm compression, rule matching, or statistical correlation analysis. For example, alarms are merged by pre-constructing an alarm rule base, or fault location is based on alarm co-occurrence relationships and correlation analysis. However, these methods usually rely on human experience or static rules, making it difficult to characterize the temporal sequence and dynamic propagation process of alarms. In complex network environments, different alarms often share a common upstream fault or indirect propagation relationship; relying solely on correlation analysis makes it difficult to distinguish between true causal relationships and accidental co-occurrence relationships, easily leading to misjudgments. When handling service carrying relationships, most existing methods only use network topology as auxiliary information, failing to effectively incorporate service paths, link connections, and device dependencies into the alarm correlation analysis process, resulting in inconsistencies between alarm correlation results and actual network operating mechanisms. In multi-service interleaved scenarios, different services share link or equipment resources, leading to complex alarm propagation paths, making it difficult for existing methods to accurately locate the fault source.

[0004] Existing technologies typically analyze all historical alarm events directly when constructing alarm correlations, lacking upstream and downstream constraint filtering mechanisms for specific alarm events. This results in redundant correlations containing a large number of invalid edges. Furthermore, there is a lack of effective mechanisms to further correct and prune pseudo-correlation relationships within the constructed alarm correlation structure, making it difficult to form a clear and well-defined causal relationship in the final result.

[0005] Therefore, how to provide a method and system for locating the root cause of power optical network faults based on business correlation analysis is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0006] One objective of this invention is to propose a method and system for root cause localization of power optical network faults based on service correlation analysis. This invention comprehensively utilizes multivariate Hawkes process modeling, service bearer relationship constraints, and condition dependency verification mechanisms to model the time triggering relationship between multi-source alarms and filter alarm correlation relationships. It describes in detail the processing process of constructing alarm causal relationships and root cause localization in complex service intertwining scenarios, and has the advantages of accurate correlation, high localization accuracy, and strong adaptability to complex network environments.

[0007] The power optical network fault root cause localization method and system based on service correlation analysis according to embodiments of the present invention includes the following steps:

[0008] Collect operational monitoring data in the power optical communication network, including alarm information generated by network devices, service carrying information, link connection relationships, and network topology information;

[0009] Standardize the operation monitoring data to generate a standardized alarm event sequence containing the alarm occurrence time and service carrying related data;

[0010] Based on the service bearer association data and network topology information, a bearer association structure between services, links and network devices is constructed. Based on the bearer association structure, the service path, link path and device location corresponding to each alarm event are determined, forming a mapping relationship from alarm events to bearer structure nodes, and generating a candidate association set.

[0011] Using a standardized alarm event sequence as input, a multivariate Hawkes process model is performed on the time triggering relationship between alarm events to generate an initial alarm association structure that includes alarm nodes and triggering directions;

[0012] Based on the initial alarm association structure and combined with the business path and link path in the bearer association structure, condition dependency checks are performed on the association relationship between alarm events to generate a sparse alarm causal relationship structure.

[0013] Based on the mapping relationship between alarm events and bearer structure nodes, the hierarchical position of each alarm node in the bearer association structure is determined. Combined with the triggering direction and alarm occurrence time in the sparse alarm causal relationship structure, the starting node of cascading propagation is identified, forming a candidate set of root causes of faults. This set is then mapped to the corresponding network devices, links, or service objects, and the fault location result is output.

[0014] Optionally, the alarm information, service bearer information, link connection relationships, and network topology information in the operation monitoring data include:

[0015] The alarm information is alarm event data generated by network devices during operation, including alarm identifier, alarm type, alarm source device identifier, alarm port identifier, alarm occurrence time, alarm clearing time, alarm level, and alarm object type, used to characterize abnormal network states and their occurrence sequence;

[0016] The service carrying information is the carrying mapping data between services and network resources, including service identifier, service type, service start node, service end node, service carrying path, and the corresponding device identifier and port identifier on the path, which is used to characterize the transmission path and resource occupation relationship of the service in the network.

[0017] The link connection relationship is the physical connection relationship data between network devices, including link identifier, source device identifier, destination device identifier, source port identifier, destination port identifier, link direction, and link operating status, which is used to characterize the connection method and link availability between devices;

[0018] The network topology information is data describing the overall structure of the power optical communication network, including the set of network device nodes and the connection relationships between nodes, used to characterize the topological connection structure between devices in the network and the distribution relationship of services and links.

[0019] Optionally, the standardization process includes: time synchronization, unified object identification, and anomaly filtering.

[0020] Optionally, the formation of the mapping relationship between alarm events and bearing structure nodes, and the generation of the candidate association set, include:

[0021] Based on the service bearer association data, extract the service bearer path and the corresponding device identifier and port identifier on the path, and based on the network topology information, extract the link connection relationship and port connection relationship between network device nodes;

[0022] Connect the device identifier and port identifier in the service bearer path according to the path order, and match them with the link connection relationship and port connection relationship to determine the bearer link sequence consistent with the service bearer path;

[0023] Based on the service bearer path, bearer link sequence, and corresponding device and port identifiers, establish the association relationship between service nodes, link nodes, and device nodes, and generate the bearer association structure between services, links, and network devices.

[0024] Read the alarm source device identifier and alarm port identifier of each alarm event in the standardized alarm event sequence, find the corresponding device node and link node in the bearer association structure, and form a mapping relationship between alarm events and bearer structure nodes;

[0025] Based on the mapping relationship between alarm events and bearer structure nodes, the service path corresponding to each alarm event is determined along the corresponding service bearer path in the bearer association structure, the link path corresponding to each alarm event is determined along the corresponding bearer link sequence, and the device location corresponding to each alarm event is determined according to the mapped device node.

[0026] Based on the service path, link path, and device location, alarm events that satisfy the same service carrying path and adjacent link connection relationship are extracted, and a candidate association set is generated.

[0027] Optionally, the multivariate Hawkes process modeling includes:

[0028] Based on the standardized alarm event sequence, the alarm type and alarm occurrence time of each alarm event are extracted. Combined with the mapping relationship between alarm events and the bearing structure nodes and the candidate association set, the corresponding candidate historical alarm events are determined for each target alarm event.

[0029] For each target alarm event, based on the mapping relationship between the alarm event corresponding to the target alarm event and the bearer structure node, the service path, link path and device location corresponding to the target alarm event are determined in the bearer association structure. Then, along the service bearer path order in the service path corresponding to the target alarm event and the link connection order in the link path corresponding to the target alarm event, historical alarm events with alarm occurrence times earlier than the target alarm event and located in the path position before the target alarm event are selected from the candidate historical alarm events to form the bearer consistency parent event set corresponding to the target alarm event.

[0030] Based on the set of bearer consistency parent events corresponding to each target alarm event, the set of bearer consistency parent events is used as the historical triggering input of the corresponding target alarm event to construct the conditional strength function of the multivariate Hawkes process;

[0031] The first parameter estimation is performed based on the conditional intensity function value, generating a predicted triggering structure that includes the predicted parent event relationship and the corresponding excitation intensity;

[0032] Based on the predicted triggering structure, for each target alarm event, historical alarm events with predicted parent event relationships are extracted from the bearer consistency parent event set corresponding to the target alarm event, and other predicted parent events located on the same business path or the same link path are selected as the control event set.

[0033] Given a set of control events, determine whether each estimated parent event maintains its triggering contribution to the target alarm event, and add the estimated parent events that do not maintain their triggering contribution to the parent event set. This forms the set of parent events after feedback;

[0034] Based on the feedback of the parent event set, the historical excitation input in the conditional intensity function is updated, and a second parameter estimation is performed. Based on the result of the second parameter estimation, the excitation intensity and triggering direction between each alarm event are determined, and an initial alarm association structure containing alarm nodes and triggering directions is generated.

[0035] Optionally, the generation of the sparse alarm causal relationship structure includes:

[0036] Based on the initial alarm association structure, the directed association relationships between each alarm event are extracted. Combined with the mapping relationship from alarm events to bearer structure nodes, the service path, link path and device location of the preceding and following alarm events corresponding to each directed association relationship are determined in the bearer association structure.

[0037] For each directed association in the initial alarm association structure, the preceding alarm event corresponding to the directed association is taken as the event to be examined, and the subsequent alarm event is taken as the target event. Based on the business path, link path and device location determined by the preceding alarm event and the subsequent alarm event in the bearer association structure, other alarm events located on the same business path or the same link path as the preceding alarm event and the subsequent alarm event are extracted.

[0038] Based on the alarm occurrence time in the standardized alarm event sequence, as well as the path order and connection order of the preceding and subsequent alarm events in the corresponding business path, alarm events whose occurrence time is earlier than the subsequent alarm event and whose path position is between the preceding and subsequent alarm events are selected from the remaining extracted alarm events to form a set of conditional events corresponding to the directed association relationship.

[0039] Based on the set of conditional events, we construct a combination of events to be tested that includes preceding alarm events and a combination of control events that does not include preceding alarm events. At the time when the alarm corresponding to the target event occurs, we compare the impact of the combination of events to be tested and the combination of control events on the triggering state of the target event.

[0040] If the triggering state of the target event by the combination of events to be tested is different from that of the target event by the combination of events to be controlled, it is determined that there is a conditional dependency between the preceding alarm event and the subsequent alarm event under the condition event set, and the directed association relationship is retained.

[0041] If the triggering state of the event combination to be tested on the target event is the same as that of the control event combination on the target event, it is determined that there is no conditional dependency between the preceding alarm event and the subsequent alarm event under the condition event set, and the directed association is deleted.

[0042] The retained directed relationships are organized according to the alarm occurrence time order in the standardized alarm event sequence and the business path order and link connection order in the bearing association structure to generate a sparse alarm causal relationship structure.

[0043] Optionally, determining the hierarchical position of each alarm node in the associated structure includes:

[0044] Based on the mapping relationship between alarm events and bearer structure nodes, determine the corresponding service node, link node, and device node of each alarm event in the bearer associated structure;

[0045] Based on the business nodes, link nodes, and device nodes corresponding to each alarm event, extract the business path and link path corresponding to each alarm event from the bearer association structure;

[0046] Based on the order of the service carrying path in the service path and the order of the link connection in the link path corresponding to each alarm event, determine the sequential position of the node corresponding to each alarm event in the corresponding service path.

[0047] Based on the sequential position of each alarm event's corresponding node in the corresponding business path, each alarm node in the bearer association structure is sequentially numbered, and the sequential number corresponding to each alarm node is determined as the hierarchical position of each alarm node in the bearer association structure.

[0048] Optionally, by combining the triggering direction and alarm occurrence time in the sparse alarm causal relationship structure, identifying the cascading propagation starting node, forming a candidate set of fault root causes, and mapping it to the corresponding network device, link, or service object, the fault location result is output, including:

[0049] Based on the directed correlation in the sparse alarm causal relationship structure, and combined with the alarm occurrence time in the standardized alarm event sequence, the preceding and following alarm nodes of each alarm node are determined.

[0050] For each alarm node, its inbound triggering relationship and outbound triggering relationship are counted based on the directed association relationship, and alarm nodes with empty inbound triggering relationships are selected as candidate starting nodes.

[0051] Among the candidate starting nodes, candidate starting nodes with the same subsequent alarm nodes are compared according to the alarm occurrence time, and the candidate starting node with the earliest alarm occurrence time is retained to form a set of cascading propagation starting nodes.

[0052] Based on the set of cascading propagation starting nodes, the mapping relationship between alarm events corresponding to each cascading propagation starting node and bearer structure nodes is extracted, and the network device nodes, link nodes and service nodes corresponding to each cascading propagation starting node are determined according to the mapping relationship.

[0053] The starting nodes of the cascading propagation of service nodes that are mapped to the same network device nodes and link nodes with directed relationship are merged to form a candidate set of root causes of failure.

[0054] Based on the network device node, link node, or service node corresponding to each candidate node in the candidate set of root causes of the fault, determine the corresponding network device object, link object, or service object, and output the fault location result.

[0055] Optionally, a power optical network fault root cause localization system based on business correlation analysis includes:

[0056] The data acquisition module is used to collect operation monitoring data in the power optical communication network. The operation monitoring data includes alarm information generated by network devices, service carrying information, link connection relationships, and network topology information.

[0057] The data processing module is used to standardize the operation monitoring data and generate standardized alarm event sequences and service-related data, including alarm occurrence times.

[0058] The bearer association construction module is used to construct the bearer association structure between services, links and network devices based on service bearer association data and network topology information, and determine the service path, link path and device location corresponding to each alarm event according to the bearer association structure, form a mapping relationship from alarm events to bearer structure nodes, and generate a candidate association set.

[0059] The Hawkes modeling module is used to perform multivariate Hawkes process modeling on the time triggering relationship between alarm events based on standardized alarm event sequences and candidate association sets, generating an initial alarm association structure that includes alarm nodes and triggering directions.

[0060] The causal relationship generation module is used to perform conditional dependency checks on the relationship between alarm events based on the initial alarm association structure and combined with the business path and link path in the carrier association structure, and generate a sparse alarm causal relationship structure.

[0061] The hierarchy determination module is used to determine the hierarchical position of each alarm node in the associated structure based on the mapping relationship between alarm events and bearer structure nodes.

[0062] The root cause localization module is used to combine the triggering direction and alarm occurrence time in the sparse alarm causal relationship structure to identify the starting node of cascading propagation, form a candidate set of fault root causes, and map them to the corresponding network devices, links or service objects, and output the fault localization results.

[0063] The beneficial effects of this invention are:

[0064] This invention combines service bearer correlation analysis, multivariate Hawkes process modeling, and condition dependency testing to jointly process alarm information, service bearer information, link connection relationships, and network topology information in power optical communication networks. This enables the construction of a bearer correlation structure between services, links, and network devices, and establishes a mapping relationship between alarm events and bearer structure nodes. This allows for constraint analysis of alarm propagation paths in complex service interleaving scenarios, improving the consistency between alarm correlation results and actual network operation.

[0065] This invention models the time-triggered relationship between alarm events based on the bearer association structure using a multivariate Hawkes process model, and constructs a bearer-consistent parent event set by combining the business path sequence, link connection sequence, and candidate association set. This enables alarm association analysis to go beyond alarm co-occurrence relationships or static rule matching, and instead characterize the triggering direction and propagation process between alarm events according to the alarm occurrence time and bearer path relationship, thereby improving the accuracy of the initial association structure in complex cascading alarm scenarios.

[0066] This invention performs conditional dependency checks on the initial alarm association structure and filters the directed associations between alarm events by combining business paths, link paths, and condition event sets. It can delete association edges that do not satisfy the conditional dependency relationship and generate a sparse alarm causal relationship structure. This reduces the interference of common upstream faults, indirect propagation relationships, and accidental co-occurrence relationships on the root cause localization results, and makes the generated alarm causal relationship structure have a clearer propagation hierarchy and direction relationship.

[0067] This invention identifies the starting node of cascading propagation by combining the triggering direction, alarm occurrence time, and hierarchical position of the alarm node in the bearer association structure within the sparse alarm causal relationship structure, forming a candidate set of fault root causes. This candidate set of fault root causes is then mapped to the corresponding network devices, links, or service objects, thereby enabling the location and output of fault sources in power optical communication networks. This reduces reliance on manual intervention and improves the accuracy and efficiency of fault root cause location in complex network environments. Attached Figure Description

[0068] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0069] Figure 1 The flowchart shows the power optical network fault root cause localization method and system based on service correlation analysis proposed in this invention.

[0070] Figure 2 This is a schematic diagram illustrating the multivariate Hawkes process modeling and initial alarm association structure generation in this invention. Detailed Implementation

[0071] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0072] refer to Figures 1-2 A method and system for locating the root cause of faults in power optical networks based on business correlation analysis includes the following steps:

[0073] Collect operational monitoring data in the power optical communication network, including alarm information generated by network devices, service carrying information, link connection relationships, and network topology information;

[0074] Standardize the operation monitoring data to generate a standardized alarm event sequence containing the alarm occurrence time and service carrying related data;

[0075] Based on the service bearer association data and network topology information, a bearer association structure between services, links and network devices is constructed. Based on the bearer association structure, the service path, link path and device location corresponding to each alarm event are determined, forming a mapping relationship from alarm events to bearer structure nodes, and generating a candidate association set.

[0076] Using a standardized alarm event sequence as input, a multivariate Hawkes process model is performed on the time triggering relationship between alarm events to generate an initial alarm association structure that includes alarm nodes and triggering directions;

[0077] Based on the initial alarm association structure and combined with the business path and link path in the bearer association structure, condition dependency checks are performed on the association relationship between alarm events to generate a sparse alarm causal relationship structure.

[0078] Based on the mapping relationship between alarm events and bearer structure nodes, the hierarchical position of each alarm node in the bearer association structure is determined. Combined with the triggering direction and alarm occurrence time in the sparse alarm causal relationship structure, the starting node of cascading propagation is identified, forming a candidate set of root causes of faults. This set is then mapped to the corresponding network devices, links, or service objects, and the fault location result is output.

[0079] In this embodiment, the alarm information, service carrying information, link connection relationships, and network topology information in the operation monitoring data include:

[0080] The alarm information is alarm event data generated by network devices during operation, including alarm identifier, alarm type, alarm source device identifier, alarm port identifier, alarm occurrence time, alarm clearing time, alarm level, and alarm object type, used to characterize abnormal network states and their occurrence sequence;

[0081] The service carrying information is the carrying mapping data between services and network resources, including service identifier, service type, service start node, service end node, service carrying path, and the corresponding device identifier and port identifier on the path, which is used to characterize the transmission path and resource occupation relationship of the service in the network.

[0082] The link connection relationship is the physical connection relationship data between network devices, including link identifier, source device identifier, destination device identifier, source port identifier, destination port identifier, link direction, and link operating status, which is used to characterize the connection method and link availability between devices;

[0083] The network topology information is data describing the overall structure of the power optical communication network, including the set of network device nodes and the connection relationships between nodes, used to characterize the topological connection structure between devices in the network and the distribution relationship of services and links.

[0084] In this embodiment, the standardization process includes: time synchronization, unified object identification, and anomaly filtering.

[0085] Specifically, time synchronization processing involves clock correction of alarm events generated by different network devices based on a unified time reference, ensuring that the occurrence times of each alarm are aligned under the same time reference system; unified object identification processing involves uniformly encoding and associating alarm objects from different data sources based on network device identifiers, port identifiers, and service identifiers, ensuring that the same physical or logical object has a unique identifier in the standardized alarm event sequence; and anomaly filtering processing involves removing or merging repeatedly reported alarms, persistent jitter alarms, and cleared historical alarms based on the alarm occurrence time, alarm clearance time, and alarm level, while retaining valid alarm events that reflect the current network status.

[0086] In this embodiment, the formation of the mapping relationship between the alarm event and the bearing structure node, and the generation of the candidate association set, include:

[0087] Based on the service bearer association data, extract the service bearer path and the corresponding device identifier and port identifier on the path, and based on the network topology information, extract the link connection relationship and port connection relationship between network device nodes;

[0088] Connect the device identifier and port identifier in the service bearer path according to the path order, and match them with the link connection relationship and port connection relationship to determine the bearer link sequence consistent with the service bearer path;

[0089] Based on the service bearer path, bearer link sequence, and corresponding device and port identifiers, establish the association relationship between service nodes, link nodes, and device nodes, and generate the bearer association structure between services, links, and network devices.

[0090] Read the alarm source device identifier and alarm port identifier of each alarm event in the standardized alarm event sequence, find the corresponding device node and link node in the bearer association structure, and form a mapping relationship between alarm events and bearer structure nodes;

[0091] Based on the mapping relationship between alarm events and bearer structure nodes, the service path corresponding to each alarm event is determined along the corresponding service bearer path in the bearer association structure, the link path corresponding to each alarm event is determined along the corresponding bearer link sequence, and the device location corresponding to each alarm event is determined according to the mapped device node.

[0092] Based on the service path, link path, and device location, alarm events that satisfy the same service carrying path and adjacent link connection relationship are extracted, and a candidate association set is generated.

[0093] In this embodiment, the multivariate Hawkes process modeling includes:

[0094] Based on the standardized alarm event sequence, the alarm type and alarm occurrence time of each alarm event are extracted. Combined with the mapping relationship between alarm events and the bearing structure nodes and the candidate association set, the corresponding candidate historical alarm events are determined for each target alarm event.

[0095] For each target alarm event, based on the mapping relationship between the alarm event corresponding to the target alarm event and the bearer structure node, the service path, link path and device location corresponding to the target alarm event are determined in the bearer association structure. Then, along the service bearer path order in the service path corresponding to the target alarm event and the link connection order in the link path corresponding to the target alarm event, historical alarm events with alarm occurrence times earlier than the target alarm event and located in the path position before the target alarm event are selected from the candidate historical alarm events to form the bearer consistency parent event set corresponding to the target alarm event.

[0096] Specifically, the screening process is as follows: First, based on the alarm occurrence time in the standardized alarm event sequence, all candidate historical alarm events are compared with the target alarm event in terms of time, retaining historical alarm events whose occurrence time is earlier than the target alarm event. Then, based on the mapping relationship between alarm events and bearer structure nodes, the node positions corresponding to each candidate historical alarm event are determined in the bearer association structure, and mapped to the service path and link path corresponding to the target alarm event. Further, based on the service bearer path order and link connection order, the positions of each candidate historical alarm event in the path are compared sequentially, retaining historical alarm events that are located before the node corresponding to the target alarm event in the path order, thus obtaining a set of historical alarm events that simultaneously satisfy both time sequence constraints and path order constraints.

[0097] Based on the set of bearer consistency parent events corresponding to each target alarm event, and using each set of bearer consistency parent events as the historical triggering input for the corresponding target alarm event, a conditional strength function for the multivariate Hawkes process is constructed:

[0098] ;

[0099] in, Indicates the alarm type is Alarm events at all times The conditional strength function value, Indicates the alarm type is Background intensity, An index representing the alarm type to which historical alarm events belong. Indicates the alarm type is The The time of occurrence of each historical alarm event. Indicate alarm type Alarm type The excitation intensity, Indicate alarm type Historical alarm events and alarm types The time decay effect function, This represents the set of parent events that bear consistency corresponding to the target alarm event. This represents the set of parent events that have been removed from the set of parent events that carry consistency.

[0100] Specifically, the conditional strength function originates from the modeling method of continuous-time event triggering mechanisms using multivariate Hawkes processes. It characterizes the causal relationship between events by superimposing the contributions of historical events to the current event. In this method, the conditional strength function is structurally improved: instead of using conventional Hawkes processes to uniformly model all historical events, it extracts a set of bearer consistency parent events that satisfy the constraints of business path order and link connection order from the bearer association structure based on the mapping relationship between alarm events and bearer structure nodes. To replace the traditional full-history input; introduce a set of feedback parent events. After the first parameter estimation, parent events that do not maintain trigger contributions are removed from the excitation input by trigger contribution determination, and are then added to the conditional intensity function. The historical excitation terms are constrained in the form of "parent event reconstruction + feedback pruning", thus forming a dual improved structure. Through the above improvements, the conditional intensity function retains only historical alarm events that satisfy the bearing path constraints and have real triggering effects, effectively reducing interference terms introduced by irrelevant events, indirect propagation and accidental co-occurrence, thereby improving the accuracy of excitation intensity estimation and making the obtained alarm triggering relationship more consistent with the actual operating mechanism of power optical communication network.

[0101] The first parameter estimation is performed based on the conditional intensity function value, generating a predicted triggering structure that includes the predicted parent event relationship and the corresponding excitation intensity;

[0102] Specifically, the first parameter estimation process is as follows: based on the occurrence time of each alarm event in the standardized alarm event sequence and the constructed conditional intensity function, the conditional intensity function value of each type of alarm event within the observation time interval is calculated, and the conditional intensity function value corresponding to the occurrence time of each alarm event is used as input to construct an objective function about the background intensity and the excitation intensity; under the excitation structure constraints limited by the candidate association set and the set of parent events bearing consistency, the objective function is solved to obtain the background intensity parameter and the excitation intensity parameter between each alarm type that make the conditional intensity function match the actual alarm occurrence time sequence, thereby forming an estimated triggering structure that includes the estimated parent event relationship and the corresponding excitation intensity;

[0103] Based on the predicted triggering structure, for each target alarm event, historical alarm events with predicted parent event relationships are extracted from the bearer consistency parent event set corresponding to the target alarm event, and other predicted parent events located on the same business path or the same link path are selected as the control event set.

[0104] Given a set of control events, determine whether each estimated parent event maintains its triggering contribution to the target alarm event, and add the estimated parent events that do not maintain their triggering contribution to the parent event set. This forms the set of parent events after feedback;

[0105] Specifically, the judgment process is as follows: For each target alarm event, historical alarm events with a predicted parent event relationship to the target alarm event are extracted from the predicted trigger structure, and a control event set is determined from them; given the control event set, the changes in the conditional intensity function value corresponding to the target alarm event are compared when a certain predicted parent event is retained and when the predicted parent event is removed; if the conditional intensity function value corresponding to the target alarm event at the time of alarm occurrence decreases after removing the predicted parent event, and the excitation intensity corresponding to the predicted parent event is still non-zero, then it is determined that the predicted parent event maintains a triggering contribution to the target alarm event; if the conditional intensity function value corresponding to the target alarm event at the time of alarm occurrence remains unchanged or the corresponding excitation intensity is zero after removing the predicted parent event, then it is determined that the predicted parent event does not maintain a triggering contribution to the target alarm event.

[0106] Based on the feedback set of parent events, the historical excitation input in the conditional intensity function is updated, and a second parameter estimation is performed. Based on the result of the second parameter estimation, the excitation intensity and triggering direction between each alarm event are determined, and an initial alarm association structure containing alarm nodes and triggering directions is generated.

[0107] Specifically, the second parameter estimation process is as follows: after forming the parent event set after feedback, the parent event set... The corresponding historical alarm events are deleted from the historical triggering input of the target alarm events, and the conditional intensity function corresponding to each target alarm event is reconstructed based on the deleted set of parent events with consistent bearing. Then, according to the occurrence time of each alarm event in the standardized alarm event sequence, the conditional intensity function value corresponding to each alarm event at its occurrence time is recalculated. Under the constraints of the updated historical triggering input, the background intensity parameter and triggering intensity parameter in the conditional intensity function are solved again to make the reconstructed conditional intensity function match the actual alarm occurrence time sequence. Finally, the triggering intensity parameters and corresponding triggering directions after deleting parent events that do not maintain triggering contribution are obtained, and the initial alarm association structure is generated accordingly.

[0108] In this embodiment, the generation of the sparse alarm causal relationship structure includes:

[0109] Based on the initial alarm association structure, the directed association relationships between each alarm event are extracted. Combined with the mapping relationship from alarm events to bearer structure nodes, the service path, link path and device location of the preceding and following alarm events corresponding to each directed association relationship are determined in the bearer association structure.

[0110] For each directed association in the initial alarm association structure, the preceding alarm event corresponding to the directed association is taken as the event to be examined, and the subsequent alarm event is taken as the target event. Based on the business path, link path and device location determined by the preceding alarm event and the subsequent alarm event in the bearer association structure, other alarm events located on the same business path or the same link path as the preceding alarm event and the subsequent alarm event are extracted.

[0111] Based on the alarm occurrence time in the standardized alarm event sequence, as well as the path order and connection order of the preceding and subsequent alarm events in the corresponding business path, alarm events whose occurrence time is earlier than the subsequent alarm event and whose path position is between the preceding and subsequent alarm events are selected from the remaining extracted alarm events to form a set of conditional events corresponding to the directed association relationship.

[0112] Based on the set of conditional events, we construct a combination of events to be tested that includes preceding alarm events and a combination of control events that does not include preceding alarm events. At the time when the alarm corresponding to the target event occurs, we compare the impact of the combination of events to be tested and the combination of control events on the triggering state of the target event.

[0113] If the triggering state of the target event by the combination of events to be tested is different from that of the target event by the combination of events to be controlled, it is determined that there is a conditional dependency between the preceding alarm event and the subsequent alarm event under the condition event set, and the directed association relationship is retained.

[0114] If the triggering state of the event combination to be tested on the target event is the same as that of the control event combination on the target event, it is determined that there is no conditional dependency between the preceding alarm event and the subsequent alarm event under the condition event set, and the directed association is deleted.

[0115] The retained directed relationships are organized according to the alarm occurrence time order in the standardized alarm event sequence and the business path order and link connection order in the bearing association structure to generate a sparse alarm causal relationship structure.

[0116] In this embodiment, determining the hierarchical position of each alarm node in the associated structure includes:

[0117] Based on the mapping relationship between alarm events and bearer structure nodes, determine the corresponding service node, link node, and device node of each alarm event in the bearer associated structure;

[0118] Based on the business nodes, link nodes, and device nodes corresponding to each alarm event, extract the business path and link path corresponding to each alarm event from the bearer association structure;

[0119] Based on the order of the service carrying path in the service path and the order of the link connection in the link path corresponding to each alarm event, determine the sequential position of the node corresponding to each alarm event in the corresponding service path.

[0120] Based on the sequential position of each alarm event's corresponding node in the corresponding business path, each alarm node in the bearer association structure is sequentially numbered, and the sequential number corresponding to each alarm node is determined as the hierarchical position of each alarm node in the bearer association structure.

[0121] In this embodiment, the step of combining the triggering direction and alarm occurrence time in the sparse alarm causal relationship structure to identify the cascading propagation starting node, forming a candidate set of fault root causes, and mapping it to the corresponding network device, link, or service object, and outputting the fault location result includes:

[0122] Based on the directed correlation in the sparse alarm causal relationship structure, and combined with the alarm occurrence time in the standardized alarm event sequence, the preceding and following alarm nodes of each alarm node are determined.

[0123] For each alarm node, its inbound triggering relationship and outbound triggering relationship are counted based on the directed association relationship, and alarm nodes with empty inbound triggering relationships are selected as candidate starting nodes.

[0124] Among the candidate starting nodes, candidate starting nodes with the same subsequent alarm nodes are compared according to the alarm occurrence time, and the candidate starting node with the earliest alarm occurrence time is retained to form a set of cascading propagation starting nodes.

[0125] Specifically, the comparison process is as follows: among the candidate starting nodes, for multiple candidate starting nodes with the same subsequent alarm node, the alarm occurrence time of each candidate starting node in the standardized alarm event sequence is extracted, and these candidate starting nodes are sorted based on the alarm occurrence time; the candidate starting node with the earliest alarm occurrence time is determined as the reserved node, and the remaining candidate starting nodes with alarm occurrence times later than the reserved node are deleted, thereby ensuring that the starting node corresponding to the same subsequent alarm node is unique;

[0126] Based on the set of cascading propagation starting nodes, the mapping relationship between alarm events corresponding to each cascading propagation starting node and bearer structure nodes is extracted, and the network device nodes, link nodes and service nodes corresponding to each cascading propagation starting node are determined according to the mapping relationship.

[0127] The starting nodes of the cascading propagation of service nodes that are mapped to the same network device nodes and link nodes with directed relationship are merged to form a candidate set of root causes of failure.

[0128] Based on the network device node, link node, or service node corresponding to each candidate node in the candidate set of root causes of the fault, determine the corresponding network device object, link object, or service object, and output the fault location result.

[0129] In this embodiment, the power optical network fault root cause localization system based on service correlation analysis includes:

[0130] The data acquisition module is used to collect operation monitoring data in the power optical communication network. The operation monitoring data includes alarm information generated by network devices, service carrying information, link connection relationships, and network topology information.

[0131] The data processing module is used to standardize the operation monitoring data and generate standardized alarm event sequences and service-related data, including alarm occurrence times.

[0132] The bearer association construction module is used to construct the bearer association structure between services, links and network devices based on service bearer association data and network topology information, and determine the service path, link path and device location corresponding to each alarm event according to the bearer association structure, form a mapping relationship from alarm events to bearer structure nodes, and generate a candidate association set.

[0133] The Hawkes modeling module is used to perform multivariate Hawkes process modeling on the time triggering relationship between alarm events based on standardized alarm event sequences and candidate association sets, generating an initial alarm association structure that includes alarm nodes and triggering directions.

[0134] The causal relationship generation module is used to perform conditional dependency checks on the relationship between alarm events based on the initial alarm association structure and combined with the business path and link path in the carrier association structure, and generate a sparse alarm causal relationship structure.

[0135] The hierarchy determination module is used to determine the hierarchical position of each alarm node in the associated structure based on the mapping relationship between alarm events and bearer structure nodes.

[0136] The root cause localization module is used to combine the triggering direction and alarm occurrence time in the sparse alarm causal relationship structure to identify the starting node of cascading propagation, form a candidate set of fault root causes, and map them to the corresponding network devices, links or service objects, and output the fault localization results.

[0137] Example 1:

[0138] To verify the feasibility of this invention in practice, it was applied to the operation and maintenance scenario of an optical communication network in a large power system. The network has a wide coverage area and carries various critical services, including dispatch automation systems, relay protection systems, video surveillance systems, and distribution automation systems. This network consists of hundreds of optical transmission devices, which are interconnected through multiple fiber optic links, forming a complex hybrid ring and mesh topology. Simultaneously, a large number of services are carried on the same links and devices through multiplexing. In actual operation, when a link or device malfunctions, it often triggers a large number of alarms at different levels. These alarms occur densely in time and propagate along service and link paths, forming a cascading alarm phenomenon. Due to the large number of alarms and their dispersed sources, maintenance personnel find it difficult to quickly determine the source of the fault. They typically need to manually analyze alarm logs, topology relationships, and service paths for troubleshooting, a time-consuming process prone to misjudgment or omission.

[0139] In this scenario, the system first collects operational monitoring data from the network management platform, including alarm information reported by each optical transmission device, service bearer configuration data, link connection relationship data, and network topology data. The collected alarm information includes fields such as alarm type, alarm source device, port information, and occurrence time. Service bearer data records the transmission path of the service in the network, link connection relationship data describes the physical connections between devices, and network topology information provides the overall network structure. The system processes this data uniformly, performing time synchronization, unified identification, and anomaly filtering to form standardized alarm event sequences and service bearer-related data.

[0140] The system constructs a bearer association structure between services, links, and devices based on service bearer data and network topology information. By parsing the service bearer path, it associates the service with each link and device it traverses, establishing a complete path mapping relationship. When an alarm occurs, the system can map each alarm to the corresponding device node, link node, or service node, and further determine the service path and link path where the alarm occurs. Based on these mapping relationships, the system generates a candidate association set, retaining only alarm event pairs that are on the same service path or have a direct link connection, providing constraints for subsequent analysis.

[0141] The system models the time-triggered relationships of standardized alarm event sequences. Unlike traditional methods that directly analyze all historical alarms, this embodiment filters historical alarm events related to the target alarm through a bearer association structure, retaining only alarms upstream of the service path and link path as candidate parent events, thus constructing a bearer-consistent parent event set. Based on this, a multivariate Hawkes process model is established to estimate the parameters of the triggering relationships between alarms, obtaining the initial alarm association structure. In a certain fault scenario, when an attenuation anomaly occurs in a fiber optic link, the system detects more than 120 different types of alarm events generated within a few seconds. Through this modeling process, the originally potentially thousands of associations are reduced to approximately 260 meaningful triggering relationships.

[0142] After obtaining the initial alarm association structure, the system further performs conditional dependency checks by combining the bearer path information. For each alarm association, the system constructs a set of conditional events and compares the triggering status of the target alarm with and without the preceding alarm to determine whether the association is valid. Through this process, a large number of false associations caused by common upstream faults or accidental co-occurrence are eliminated. In the above fault case, after the conditional dependency check, the number of alarm associations was further reduced to approximately 85, and the association structure became sparser and more clearly directional.

[0143] Based on the sparse alarm causal relationship structure, the system determines the hierarchical position of each alarm node within the associated structure. By mapping alarms to corresponding business paths and numbering nodes according to the path order, the system can clearly define the relative position of each alarm in the propagation chain. In this case, the system divides all alarm nodes into multiple levels, with the uppermost level containing only a small number of nodes, which have a strong propagation influence.

[0144] The system identifies the starting node of cascading propagation by combining the trigger direction, alarm occurrence time, and hierarchical location. During the aforementioned fault process, although over 120 alarms were generated, the system ultimately identified only two starting nodes: one was a link optical power anomaly alarm, and the other was a device interface anomaly alarm. Through further analysis of these two nodes, the system maps them to their corresponding link and device objects, forming a candidate set of fault root causes, and outputs the final location result.

[0145] In practical operational data verification, when handling a complex fault scenario containing approximately 150 alarms, traditional methods required maintenance personnel to manually analyze the data for about 25 minutes to initially locate the fault. However, using the method of this invention, the processing time from alarm generation to outputting the root cause localization result was controlled within 15 seconds. In another network anomaly scenario containing approximately 300 alarms, traditional rule-based methods generated more than 10 candidate root causes, while this method reduced the number of candidate root causes to 2 to 3, consistent with the actual fault point. In 20 consecutively tested sets of different fault samples, the root cause localization accuracy of this method reached over 92%, while the accuracy of traditional rule-based methods was approximately 68%, and the accuracy of methods based on simple statistical association was approximately 74%.

[0146] As can be seen from the above implementation process, in complex power optical communication network environments, the method of the present invention can effectively utilize service carrying relationships to constrain alarm propagation paths, and combine time triggering relationships and condition dependency verification mechanisms to perform refined modeling and screening of multi-source alarms. Thus, in the case of a large number of alarms and complex service interweaving, it can achieve rapid and accurate location of the root cause of the fault, and significantly improve network operation and maintenance efficiency.

[0147] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for locating the root cause of faults in power optical networks based on business correlation analysis, characterized in that, include: Collect operational monitoring data in the power optical communication network, including alarm information generated by network devices, service carrying information, link connection relationships, and network topology information; Standardize the operation monitoring data to generate a standardized alarm event sequence containing the alarm occurrence time and service carrying related data; Based on the service bearer association data and network topology information, a bearer association structure between services, links and network devices is constructed. Based on the bearer association structure, the service path, link path and device location corresponding to each alarm event are determined, forming a mapping relationship from alarm events to bearer structure nodes, and generating a candidate association set. Using a standardized alarm event sequence as input, a multivariate Hawkes process model is performed on the time triggering relationship between alarm events to generate an initial alarm association structure that includes alarm nodes and triggering directions; Based on the initial alarm association structure and combined with the business path and link path in the bearer association structure, condition dependency checks are performed on the association relationship between alarm events to generate a sparse alarm causal relationship structure. Based on the mapping relationship between alarm events and bearer structure nodes, the hierarchical position of each alarm node in the bearer association structure is determined. Combined with the triggering direction and alarm occurrence time in the sparse alarm causal relationship structure, the starting node of cascading propagation is identified, forming a candidate set of root causes of faults. This set is then mapped to the corresponding network devices, links, or service objects, and the fault location result is output.

2. The power optical network fault root cause localization method based on service correlation analysis according to claim 1, characterized in that, The alarm information, service carrying information, link connection relationships, and network topology information in the operation monitoring data include: The alarm information is alarm event data generated by network devices during operation, including alarm identifier, alarm type, alarm source device identifier, alarm port identifier, alarm occurrence time, alarm clearing time, alarm level, and alarm object type; The service carrying information is the carrying mapping data between services and network resources, including service identifier, service type, service start node, service end node, service carrying path, and the corresponding device identifier and port identifier on the path; The link connection relationship refers to the physical connection relationship data between network devices, including link identifier, source device identifier, destination device identifier, source port identifier, destination port identifier, link direction, and link operating status; The network topology information is data describing the overall structure of the power optical communication network, including the set of network device nodes and the connection relationships between nodes.

3. The power optical network fault root cause localization method based on service correlation analysis according to claim 1, characterized in that, The standardization process includes: time synchronization, unified object identification, and anomaly filtering.

4. The power optical network fault root cause localization method based on service correlation analysis according to claim 1, characterized in that, The formation of the mapping relationship between alarm events and the supporting structure nodes, as well as the generation of the candidate association set, includes: Based on the service bearer association data, extract the service bearer path and the corresponding device identifier and port identifier on the path, and based on the network topology information, extract the link connection relationship and port connection relationship between network device nodes; Connect the device identifier and port identifier in the service bearer path according to the path order, and match them with the link connection relationship and port connection relationship to determine the bearer link sequence consistent with the service bearer path; Based on the service bearer path, bearer link sequence, and corresponding device and port identifiers, establish the association relationship between service nodes, link nodes, and device nodes, and generate the bearer association structure between services, links, and network devices. Read the alarm source device identifier and alarm port identifier of each alarm event in the standardized alarm event sequence, find the corresponding device node and link node in the bearer association structure, and form a mapping relationship between alarm events and bearer structure nodes; Based on the mapping relationship between alarm events and bearer structure nodes, the service path corresponding to each alarm event is determined along the corresponding service bearer path in the bearer association structure, the link path corresponding to each alarm event is determined along the corresponding bearer link sequence, and the device location corresponding to each alarm event is determined according to the mapped device node. Based on the service path, link path, and device location, alarm events that satisfy the same service carrying path and adjacent link connection relationship are extracted, and a candidate association set is generated.

5. The power optical network fault root cause localization method based on service correlation analysis according to claim 1, characterized in that, The multivariate Hawkes process modeling includes: Based on the standardized alarm event sequence, the alarm type and alarm occurrence time of each alarm event are extracted. Combined with the mapping relationship between alarm events and the bearing structure nodes and the candidate association set, the corresponding candidate historical alarm events are determined for each target alarm event. For each target alarm event, based on the mapping relationship between the alarm event corresponding to the target alarm event and the bearer structure node, the service path, link path and device location corresponding to the target alarm event are determined in the bearer association structure. Then, along the service bearer path order in the service path corresponding to the target alarm event and the link connection order in the link path corresponding to the target alarm event, historical alarm events with alarm occurrence times earlier than the target alarm event and located in the path position before the target alarm event are selected from the candidate historical alarm events to form the bearer consistency parent event set corresponding to the target alarm event. Based on the set of bearer consistency parent events corresponding to each target alarm event, the set of bearer consistency parent events is used as the historical triggering input of the corresponding target alarm event to construct the conditional strength function of the multivariate Hawkes process; The first parameter estimation is performed based on the conditional intensity function value, generating a predicted triggering structure that includes the predicted parent event relationship and the corresponding excitation intensity; Based on the predicted triggering structure, for each target alarm event, historical alarm events with predicted parent event relationships are extracted from the bearer consistency parent event set corresponding to the target alarm event, and other predicted parent events located on the same business path or the same link path are selected as the control event set. Given a set of control events, determine whether each estimated parent event maintains its triggering contribution to the target alarm event, and add the estimated parent events that do not maintain their triggering contribution to the parent event set. This forms the set of parent events after feedback; Based on the feedback of the parent event set, the historical excitation input in the conditional intensity function is updated, and a second parameter estimation is performed. Based on the result of the second parameter estimation, the excitation intensity and triggering direction between each alarm event are determined, and an initial alarm association structure containing alarm nodes and triggering directions is generated.

6. The power optical network fault root cause localization method based on service correlation analysis according to claim 1, characterized in that, The generation of the sparse alarm causal relationship structure includes: Based on the initial alarm association structure, the directed association relationships between each alarm event are extracted. Combined with the mapping relationship from alarm events to bearer structure nodes, the service path, link path and device location of the preceding and following alarm events corresponding to each directed association relationship are determined in the bearer association structure. For each directed association in the initial alarm association structure, the preceding alarm event corresponding to the directed association is taken as the event to be examined, and the subsequent alarm event is taken as the target event. Based on the business path, link path and device location determined by the preceding alarm event and the subsequent alarm event in the bearer association structure, other alarm events located on the same business path or the same link path as the preceding alarm event and the subsequent alarm event are extracted. Based on the alarm occurrence time in the standardized alarm event sequence, as well as the path order and connection order of the preceding and subsequent alarm events in the corresponding business path, alarm events whose occurrence time is earlier than the subsequent alarm event and whose path position is between the preceding and subsequent alarm events are selected from the remaining extracted alarm events to form a set of conditional events corresponding to the directed association relationship. Based on the set of conditional events, we construct a combination of events to be tested that includes preceding alarm events and a combination of control events that does not include preceding alarm events. At the time when the alarm corresponding to the target event occurs, we compare the impact of the combination of events to be tested and the combination of control events on the triggering state of the target event. If the triggering state of the target event by the combination of events to be tested is different from that of the target event by the combination of events to be controlled, it is determined that there is a conditional dependency between the preceding alarm event and the subsequent alarm event under the condition event set, and the directed association relationship is retained. If the triggering state of the event combination to be tested on the target event is the same as that of the control event combination on the target event, it is determined that there is no conditional dependency between the preceding alarm event and the subsequent alarm event under the condition event set, and the directed association is deleted. The retained directed relationships are organized according to the alarm occurrence time order in the standardized alarm event sequence and the business path order and link connection order in the bearing association structure to generate a sparse alarm causal relationship structure.

7. The power optical network fault root cause localization method based on service correlation analysis according to claim 1, characterized in that, Determining the hierarchical position of each alarm node in the associated structure includes: Based on the mapping relationship between alarm events and bearer structure nodes, determine the corresponding service node, link node, and device node of each alarm event in the bearer associated structure; Based on the business nodes, link nodes, and device nodes corresponding to each alarm event, extract the business path and link path corresponding to each alarm event from the bearer association structure; Based on the order of the service carrying path in the service path and the order of the link connection in the link path corresponding to each alarm event, determine the sequential position of the node corresponding to each alarm event in the corresponding service path. Based on the sequential position of each alarm event's corresponding node in the corresponding business path, each alarm node in the bearer association structure is sequentially numbered, and the sequential number corresponding to each alarm node is determined as the hierarchical position of each alarm node in the bearer association structure.

8. The power optical network fault root cause localization method based on service correlation analysis according to claim 1, characterized in that, The method combines the triggering direction and alarm occurrence time in the sparse alarm causal relationship structure to identify the cascading propagation starting node, form a candidate set of fault root causes, and map them to the corresponding network devices, links, or service objects. The output fault location results include: Based on the directed correlation in the sparse alarm causal relationship structure, and combined with the alarm occurrence time in the standardized alarm event sequence, the preceding and following alarm nodes of each alarm node are determined. For each alarm node, its inbound triggering relationship and outbound triggering relationship are counted based on the directed association relationship, and alarm nodes with empty inbound triggering relationships are selected as candidate starting nodes. Among the candidate starting nodes, candidate starting nodes with the same subsequent alarm nodes are compared according to the alarm occurrence time, and the candidate starting node with the earliest alarm occurrence time is retained to form a set of cascading propagation starting nodes. Based on the set of cascading propagation starting nodes, the mapping relationship between alarm events corresponding to each cascading propagation starting node and bearer structure nodes is extracted, and the network device nodes, link nodes and service nodes corresponding to each cascading propagation starting node are determined according to the mapping relationship. The starting nodes of the cascading propagation of service nodes that are mapped to the same network device nodes and link nodes with directed relationship are merged to form a candidate set of root causes of failure. Based on the network device node, link node, or service node corresponding to each candidate node in the candidate set of root causes of the fault, determine the corresponding network device object, link object, or service object, and output the fault location result.

9. A power optical network fault root cause localization system based on business correlation analysis, characterized in that, include: The data acquisition module is used to collect operation monitoring data in the power optical communication network. The operation monitoring data includes alarm information generated by network devices, service carrying information, link connection relationships, and network topology information. The data processing module is used to standardize the operation monitoring data and generate standardized alarm event sequences and service-related data, including alarm occurrence times. The bearer association construction module is used to construct the bearer association structure between services, links and network devices based on service bearer association data and network topology information, and determine the service path, link path and device location corresponding to each alarm event according to the bearer association structure, form a mapping relationship from alarm events to bearer structure nodes, and generate a candidate association set. The Hawkes modeling module is used to perform multivariate Hawkes process modeling on the time triggering relationship between alarm events based on standardized alarm event sequences and candidate association sets, generating an initial alarm association structure that includes alarm nodes and triggering directions. The causal relationship generation module is used to perform conditional dependency checks on the relationship between alarm events based on the initial alarm association structure and combined with the business path and link path in the carrier association structure, and generate a sparse alarm causal relationship structure. The hierarchy determination module is used to determine the hierarchical position of each alarm node in the associated structure based on the mapping relationship between alarm events and bearer structure nodes. The root cause localization module is used to combine the triggering direction and alarm occurrence time in the sparse alarm causal relationship structure to identify the starting node of cascading propagation, form a candidate set of fault root causes, and map them to the corresponding network devices, links or service objects, and output the fault localization results.

Images