Method, device, electronic equipment and program product for processing alarms of a transport network

Abstract

The application discloses a transmission network alarm processing method and device, electronic equipment and program product, comprising: sending a real-time alarm message to an alarm message queue; associating the real-time alarm message with corresponding resource configuration data based on the alarm message queue to obtain alarm service data; distributing the alarm service data to an external application; obtaining alarm message quantity time sequence data from an alarm message front-end and message processing quantity time sequence data from an alarm message processing service; inputting the alarm message quantity time sequence data into an alarm volume prediction model to obtain an alarm volume prediction result, and performing alarm volume early warning according to the alarm volume prediction result; determining an alarm backlog condition according to the alarm message quantity time sequence data and the message processing quantity time sequence data, and performing alarm storm early warning according to the alarm backlog condition. The application improves the processing efficiency of transmission network alarms, reduces the risk of transmission network alarm storm, and can be widely applied to the technical field of optical transmission networks.

Description

Technical Field

[0001] This invention relates to the field of optical transmission network technology, and in particular to a transmission network alarm processing method, apparatus, electronic device, and program product. Background Technology

[0002] In the current field of optical transmission network management, the massive daily alarms that the transmission network management system needs to quickly and in real-time correlate with a large amount of business resource data, and then quickly and accurately connect the services to send them to upper-layer applications (such as integrated alarm systems). At the same time, with the continuous expansion of network management equipment and the gradual expansion of the transmission network, the number of alarms is increasing day by day. Coupled with the great challenges brought by alarm storms, how to ensure efficient alarm processing is a key issue that must be solved, otherwise it will have a great impact on production. Summary of the Invention

[0003] The purpose of this invention is to at least partially solve one of the technical problems existing in the prior art.

[0004] Therefore, one objective of this invention is to provide a transmission network alarm processing method that improves the processing efficiency of transmission network alarms and reduces the risk of transmission network alarm storms.

[0005] Another objective of this invention is to provide a transmission network alarm processing device.

[0006] To achieve the above-mentioned technical objectives, the technical solutions adopted in the embodiments of the present invention include: On one hand, embodiments of the present invention provide a transmission network alarm processing method, including the following steps: The alarm message front-end acquires real-time alarm messages from multiple transmission network management systems and sends the real-time alarm messages to the alarm message queues corresponding to each of the transmission network management systems. The alarm service associates the real-time alarm messages with the corresponding resource configuration data based on the alarm message queue to obtain alarm service data. The alarm service data is distributed to the external applications corresponding to each of the transmission network management systems through the alarm sending service. The monitoring system obtains alarm message quantity time-series data from the alarm message front-end machine and message processing quantity time-series data from the alarm message processing service. The alarm message quantity time series data is input into a pre-trained alarm volume prediction model to obtain alarm volume prediction results, and then alarm volume warning is issued based on the alarm volume prediction results. The alarm backlog status of each transmission network management system is determined based on the alarm message quantity time-series data and the message processing quantity time-series data, and then an alarm storm warning is issued based on the alarm backlog status.

[0007] Furthermore, in one embodiment of the present invention, sending the real-time alarm message to the alarm message queue corresponding to each of the transmission network management systems specifically includes: The alarm object ID is obtained by parsing the real-time alarm message; The alarm object ID is hashed to obtain the alarm message topic key value; The alarm message queue corresponding to the transmission network management system is determined based on the alarm message topic key value, and the real-time alarm message is sent to the alarm message queue.

[0008] Furthermore, in one embodiment of the present invention, the step of associating the real-time alarm message with the corresponding resource configuration data based on the alarm message queue to obtain alarm service data specifically includes: Read the real-time alarm messages and their corresponding alarm object IDs sequentially from the alarm message queue; Retrieve the corresponding resource configuration data from the resource pool database or Redis cache based on the alarm object ID; The alarm service data is obtained by associating the real-time alarm message with the resource configuration data, and the alarm service data is stored in the alarm database.

[0009] Furthermore, in one embodiment of the present invention, the step of distributing the alarm service data to the external applications corresponding to each of the transmission network management systems specifically includes: The alarm sending service obtains the alarm service data to be distributed and the corresponding alarm object ID from the alarm database. The external application corresponding to the transmission network management system is determined based on the alarm object ID, and the alarm service data is distributed to the corresponding external application through an external Kafka.

[0010] Furthermore, in one embodiment of the present invention, the alarm message quantity time-series data includes the number of alarm messages obtained by the alarm message front-end machine from each of the transmission network management systems in multiple consecutive historical time periods, and the message processing quantity time-series data includes the number of alarm services for which the alarm message processing service has completed associated processing in multiple consecutive historical time periods.

[0011] Furthermore, in one embodiment of the present invention, the alarm volume prediction model is trained through the following steps: Multiple alarm message quantity time-series samples are obtained from the alarm message front-end machine, and the corresponding alarm volume labels are determined by manual annotation. The time-series sample of the alarm message quantity is input into a pre-built LSTM neural network to obtain the predicted alarm volume. The loss value is determined based on the predicted alarm volume and the alarm volume label; The parameters of the LSTM neural network are updated based on the loss value using the backpropagation algorithm to obtain the trained alarm volume prediction model.

[0012] Furthermore, in one embodiment of the present invention, the step of determining the alarm backlog status of each of the transmission network management systems based on the alarm message quantity time-series data and the message processing quantity time-series data, and then performing alarm storm early warning based on the alarm backlog status, specifically includes: The alarm backlog growth rate of the alarm message queue corresponding to each of the transmission network management systems is determined based on the alarm message quantity time-series data and the message processing quantity time-series data. Obtain the real-time alarm message count of the alarm message queue; When the real-time alarm message data exceeds a preset first threshold and the alarm backlog growth rate exceeds a preset second threshold, the corresponding alarm storm warning of the transmission network management system is triggered.

[0013] On the other hand, embodiments of the present invention provide a transmission network alarm processing device, comprising: The alarm message acquisition module is used to acquire real-time alarm messages from multiple transmission network management systems through the alarm message front-end unit, and send the real-time alarm messages to the alarm message queues corresponding to each of the transmission network management systems. The alarm message association module is used to associate the real-time alarm message with the corresponding resource configuration data based on the alarm message queue through the alarm message processing service to obtain alarm service data; The alarm service distribution module is used to distribute the alarm service data to the external applications corresponding to each of the transmission network management systems through the alarm sending service; The alarm data monitoring module is used to obtain alarm message quantity time-series data from the alarm message front-end machine through the monitoring system, and to obtain message processing quantity time-series data through the alarm message processing service; The alarm volume warning module is used to input the time series data of the number of alarm messages into a pre-trained alarm volume prediction model to obtain the alarm volume prediction result, and then to issue an alarm volume warning based on the alarm volume prediction result. The alarm storm warning module is used to determine the alarm backlog status of each of the transmission network management systems based on the alarm message quantity time-series data and the message processing quantity time-series data, and then to issue an alarm storm warning based on the alarm backlog status.

[0014] On the other hand, embodiments of the present invention provide an electronic device, the electronic device including a memory, a processor, a computer program stored in the memory and executable on the processor, and a data bus for implementing connection communication between the processor and the memory, wherein the computer program, when executed by the processor, implements the transmission network alarm processing method as described above.

[0015] On the other hand, embodiments of the present invention also provide a storage medium, which is a computer-readable storage medium for computer-readable storage. The storage medium stores one or more computer programs, which can be executed by one or more processors to implement the transmission network alarm processing method as described above.

[0016] On the other hand, embodiments of the present invention also provide a computer program product, including a computer program that, when executed by a processor, implements the transmission network alarm processing method as described above.

[0017] The advantages and beneficial effects of the present invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention: This invention employs an alarm message front-end processor to acquire real-time alarm messages from multiple transmission network management systems and sends these messages to the corresponding alarm message queues of each system. An alarm message processing service associates the real-time alarm messages with corresponding resource configuration data based on the alarm message queues to obtain alarm service data. An alarm sending service distributes this data to the external applications corresponding to each transmission network management system. A monitoring system acquires alarm message quantity time-series data from the alarm message front-end processor and message processing quantity time-series data from the alarm message processing service. This data is then input into a pre-trained alarm volume prediction model to obtain alarm volume prediction results. Based on these predictions, an alarm volume warning is issued. Finally, the alarm backlog status of each transmission network management system is determined based on the alarm message quantity time-series data and the message processing quantity time-series data, and an alarm storm warning is issued based on the alarm backlog status. This invention provides a way to evenly distribute real-time alarm messages to an alarm message queue. Based on the alarm message queue, the real-time alarm messages are efficiently associated and stored in a database, and then distributed to the corresponding external applications of the transmission network management system, thereby improving the processing efficiency of transmission network alarms. In addition, alarm volume prediction can help to detect alarm processing limits in advance, and alarm storm warnings can reduce the risk of transmission network alarm storms. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the embodiments of the present invention are described below. It should be understood that the drawings described below are only for the convenience of clearly describing some embodiments of the technical solutions of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A flowchart illustrating the steps of a transmission network alarm processing method provided in an embodiment of the present invention; Figure 2 This is a data interaction diagram for real-time alarm message processing provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of data interaction between the alarm message front-end machine and the alarm message processing unit provided in an embodiment of the present invention. Figure 4 This is a data interaction diagram of the alarm message processing service provided in an embodiment of the present invention; Figure 5 This is a data interaction diagram of the alarm sending service provided in an embodiment of the present invention; Figure 6 This is a data interaction diagram of alarm volume warning and alarm storm warning provided in an embodiment of the present invention; Figure 7This is a schematic diagram of the structure of the transmission network alarm processing device provided in an embodiment of the present invention; Figure 8 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present invention; Figure 9 This is a schematic diagram of the structure of the storage medium provided in an embodiment of the present invention. Detailed Implementation

[0020] The embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application. It should be noted that although functional modules are divided in the system schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the system schematic diagram or the order in the flowchart. The step numbers in the following embodiments are only set for ease of explanation and do not limit the order between steps. The execution order of each step in the embodiments can be adaptively adjusted according to the understanding of those skilled in the art.

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0022] The following explains some of the terms used in the embodiments of the present invention.

[0023] EMS (Element Management System) is a core component in the optical communication network management architecture, mainly used for configuring, monitoring and maintaining transmission equipment (such as SDH / DWDM network elements) from a single vendor.

[0024] The transmission network alarm processing method provided in this application embodiment can be applied to a terminal, a server, or software running on a terminal or server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, or vehicle terminal, but is not limited to these; the server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network; the software can be an application implementing a driver status monitoring method based on machine vision, but is not limited to the above forms.

[0025] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0026] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards of the relevant countries and regions. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirects to confirmation pages. Only after obtaining the user's separate permission or consent is the necessary user-related data for the proper functioning of the embodiments of this application obtained.

[0027] like Figure 1 The diagram shown is a flowchart of one step of the transmission network alarm processing method provided in an embodiment of the present invention. (Refer to...) Figure 1This invention provides a method for handling transmission network alarms, specifically including the following steps: S101. Obtain real-time alarm messages from multiple transmission network management systems through the alarm message front-end unit, and send the real-time alarm messages to the alarm message queues corresponding to each transmission network management system. S102. The alarm message processing service associates real-time alarm messages with corresponding resource configuration data based on the alarm message queue to obtain alarm service data. S103. Distribute alarm service data to the corresponding external applications of each transmission network management system through the alarm sending service; S104. Obtain alarm message quantity time-series data from the alarm message front-end machine through the monitoring system, and obtain message processing quantity time-series data through the alarm message processing service; S105. Input the alarm message quantity time series data into the pre-trained alarm volume prediction model to obtain the alarm volume prediction result, and then issue an alarm volume warning based on the alarm volume prediction result. S106. Determine the alarm backlog status of each transmission network management system based on the alarm message quantity time sequence data and the message processing quantity time sequence data, and then issue an alarm storm warning based on the alarm backlog status.

[0028] like Figure 2 The diagram illustrates the data interaction in real-time alarm message processing according to an embodiment of the present invention. (Refer to...) Figure 2 The embodiments of the present invention provide efficient processing for massive daily alarms: 1) Real-time alarm messages are evenly distributed into the alarm message queue. The all-optical network controller's alarm message front-end unit connects to the massive real-time alarm messages from multiple transmission vendors' network management systems. It efficiently parses the received alarm message I2 packets in parallel using multiple threads, and uses the object ID generated by the DN MD5 hash of the alarm object as the message queue key to send them in batches to the multi-partition Kafka alarm message queue, ensuring the orderliness and real-time nature of alarms.

[0029] 2) Efficient Real-Time Alarm Data Association and Storage. The alarm message processing service uses multi-threading to consume and process alarm messages in batches, resolving the previous issue of slow overall processing and alarm backlog caused by sequential processing of single alarms. Batch association of alarm network resource configuration data is performed, caching resource pool configuration data in Redis. Alarm object association data already cached in Redis is retrieved directly from Redis (read speed from the cache is in the single-digit millisecond range), eliminating the need to query the resource pool and improving alarm network resource association efficiency. Alarm business data is entered into the alarm database in batches, resolving the issue of excessively long database waiting times caused by single commits of massive amounts of data, which further degrades overall database performance. 3) The alarm sending service retrieves all alarms to be sent in batches, and sends them in batches according to EMS category.

[0030] like Figure 6 The diagram illustrates the data interaction between alarm volume warning and alarm storm warning provided in an embodiment of the present invention. (Refer to...) Figure 6 This invention, in its embodiments, proactively anticipates alarm handling limits and risks through alarm volume prediction. Specifically, the alarm message front-end provides business metrics such as the number of alarm messages received from the network management side. The Prometheus monitoring system retrieves alarm business metric data from the alarm front-end every 15 seconds. The intelligent operation support system periodically acquires the real-time alarm message volume per minute from each network management system through Prometheus and stores this data volume metric. AI technology is introduced to analyze historical alarm message volume data, clean outliers and missing data, and establish a correlation model between the data volume metrics and alarm business model metrics. Using a time-series algorithm, the model is trained by gradually increasing complexity, starting with a simple model. The model is retrained weekly or monthly based on the latest data. An early warning mechanism is established to address prediction biases and regularly evaluates the model's performance in the real environment to assess alarm growth. Based on the alarm volume prediction results and alarm handling capabilities, an alarm volume warning is triggered.

[0031] Furthermore, this embodiment of the invention automatically expands alarm message processing instances through alarm storm warnings to ensure efficient alarm processing. Specifically, the alarm message front-end provides business metrics such as the number of alarm messages received from the network management side, while the alarm message processing service provides business metrics such as the number of messages processed. The Prometheus monitoring system acquires alarm business metric data every 15 seconds. Simultaneously, the consumption status of alarm message topics in the Kafka component is also included in Prometheus monitoring. The intelligent operation support system monitors the number of alarm messages received and processed through Prometheus. When monitoring detects a surge in the number of alarm messages received, and the difference between the number of messages received and processed exceeds a threshold within a specified time, and simultaneously, the backlog of consumers in each partition of the Kafka alarm message topic exceeds the threshold, an alarm storm warning is triggered, and the intelligent operation support system triggers Kubernetes to automatically expand the alarm message processing service instances.

[0032] It can be recognized that the embodiments of the present invention send real-time alarm messages evenly to the alarm message queue, efficiently associate and store the real-time alarm messages in the database based on the alarm message queue, and then distribute them to the corresponding external applications of the transmission network management system, thereby improving the processing efficiency of transmission network alarms; in addition, alarm volume prediction can detect alarm processing limit risks in advance, and alarm storm warning can reduce the risk of transmission network alarm storms.

[0033] As a further optional implementation, real-time alarm messages are sent to the corresponding alarm message queues of each transmission network management system, specifically including: S1011. Parse the real-time alarm message to obtain the alarm object ID; S1012. Hash the alarm object ID to obtain the alarm message topic key value; S1013. Determine the alarm message queue corresponding to the transmission network management system based on the alarm message topic key value, and send the real-time alarm message to the alarm message queue.

[0034] Specifically, such as Figure 3 The diagram illustrates the data interaction of the alarm message front-end server provided in this embodiment of the invention. The alarm message front-end server interfaces with alarm messages from multiple network management systems of various transmission vendors. It efficiently parses the massive amounts of real-time alarm messages (I2 format packets) received in parallel using multiple threads. The alarm object name is then used to generate an alarm object ID using the MD5 algorithm. This alarm object ID hash is used as the Kafka key for balanced distribution to the alarm message topic (the number of partitions matches the number of network management systems). This method ensures the balance of message quantity and the orderliness of alarms across each partition of the alarm message topic. Simultaneously, messages are compressed and a batch sending mechanism is employed to improve the throughput of the entire message queue.

[0035] As a further optional implementation, alarm service data is obtained by associating real-time alarm messages with corresponding resource configuration data based on the alarm message queue, specifically including: S1021. Read real-time alarm messages and corresponding alarm object IDs sequentially from the alarm message queue; S1022. Retrieve the corresponding resource configuration data from the resource pool database or Redis cache based on the alarm object ID; S1023. Associate the real-time alarm messages with the resource configuration data to obtain alarm service data, and store the alarm service data in the alarm database.

[0036] Specifically, such as Figure 4The diagram illustrates the data interaction of the alarm message processing service provided in this embodiment of the invention. The alarm message processing service uses multiple consumer threads to consume alarm messages from each partition in batches, processing them and associating alarm objects with resource and configuration data. The associated data is cached in Redis. For alarm objects already cached in Redis, the associated data is retrieved directly from Redis (read speed from the cache is in the single digits milliseconds). If the cache does not exist, the data is retrieved from the resource pool database and simultaneously added to the cache. Appropriate timeouts are set for cached data to ensure that the association is re-established if resource configuration data changes. This solves the time overhead of querying the resource pool database (at least tens of milliseconds) every time, which was necessary in the previous system without a caching mechanism. Real-time alarm data associated with resource pool data in the same batch is submitted in batches to the original alarm table in the alarm database. New alarm batches are added to the current alarm table, and cleared alarm batches are added to the historical table. Furthermore, alarms with the same sequence number within a batch are not added to the current alarm table, reducing database operations and improving processing efficiency. Simultaneously, alarms are merged and processed, with alarm data also batch-committed to the alarm merging and alarm merging association tables. All tables in the alarm database are batch-committed, reducing the number of commits and improving database performance and ingestion efficiency. Batch committing resolves the issue of excessively long database wait times caused by single-row commits of massive amounts of ingested data, which further degrades overall database performance. Verification shows that processing 20 records in a batch takes roughly the same time as processing 3 records individually, resolving the alarm backlog problem that often occurred during alarm storms when processing and ingesting data serially and individually.

[0037] As a further optional implementation, alarm service data is distributed to the corresponding external applications of each transmission network management system, specifically including: S1031. Obtain the alarm service data to be distributed and the corresponding alarm object ID from the alarm database through the alarm sending service; S1032. Determine the external application corresponding to the transmission network management system based on the alarm object ID, and distribute the alarm service data to the corresponding external application through the external Kafka.

[0038] Specifically, such as Figure 5 The diagram shows the data interaction of the alarm sending service provided in this embodiment of the invention. The alarm sending service obtains all alarms to be sent from the alarm sending table in batches, groups them according to EMS, and sends them to external applications in batches through multi-threaded external Kafka.

[0039] As an optional implementation, the alarm message quantity time-series data includes the number of alarm messages obtained by the alarm message front-end machine from each transmission network management system in multiple consecutive historical time periods, and the message processing quantity time-series data includes the number of alarm services that the alarm message processing service completes associated processing in multiple consecutive historical time periods.

[0040] As an optional implementation, the alarm volume prediction model is trained through the following steps: S201. Obtain multiple alarm message quantity time-series samples from the alarm message front-end machine, and determine the corresponding alarm volume labels through manual annotation; S202. Input the time-series sample of the number of alarm messages into a pre-built LSTM neural network to obtain the predicted alarm volume. S203. Determine the loss value based on the predicted alarm volume and alarm volume label; S204. Update the parameters of the LSTM neural network based on the loss value using the backpropagation algorithm to obtain the trained alarm volume prediction model.

[0041] Specifically, the alarm message front-end provides business metrics such as the number of alarm messages received from the network management side. The Prometheus monitoring system retrieves alarm business metric data from the alarm front-end every 15 seconds. The intelligent operation support system uses Prometheus to periodically obtain the real-time alarm message volume per minute from each network management system and stores this data volume metric. Applying AI technology and using the Qiming AI large-scale model, historical alarm message volume data is analyzed, outliers and missing data are cleaned, and a correlation model is established between the data volume metrics and alarm business model metrics. Through time-series algorithms, the model is trained, starting with a simple model and gradually increasing its complexity. The model is retrained hourly, daily, weekly, and monthly based on the latest data. An early warning mechanism is established to address prediction biases, and the model's performance in the real environment is regularly evaluated to assess alarm growth.

[0042] The intelligent operations support system predicts alarm volume and, based on the prediction results and alarm processing capacity, triggers alarm volume warnings to notify operations personnel. Based on the warnings, operations personnel increase the number of alarm message queue topic partitions (to improve Kafka throughput) and the number of message processing service instances (to increase the number of processing threads) to resolve the issue, proactively preventing potential problems such as alarm backlog due to insufficient processing capacity caused by continued vendor expansion. As alarm capacity prediction becomes more accurate in the future, the intelligent operations support system automatically triggers the expansion of the number of alarm message queue topic partitions and message processing service instances to ensure production.

[0043] As a further optional implementation, the alarm backlog status of each transmission network management system is determined based on the alarm message quantity time-series data and the message processing quantity time-series data, and then an alarm storm warning is issued based on the alarm backlog status, specifically including: S1061. Determine the alarm backlog growth rate of the alarm message queue corresponding to each transmission network management system based on the alarm message quantity time sequence data and the message processing quantity time sequence data. S1062. Obtain the number of real-time alarm messages in the alarm message queue; S1063. When the real-time alarm message data exceeds the preset first threshold and the alarm backlog growth rate exceeds the preset second threshold, the corresponding transmission network management system alarm storm warning is triggered.

[0044] Specifically, the alarm message front-end server (multi-instance deployment) provides business metrics such as the number of alarm messages received from the network management side, while the alarm message processing service (multi-instance deployment) provides business metrics such as the number of messages processed. The Prometheus monitoring system acquires alarm business metric data every 15 seconds. Simultaneously, the Prometheus monitoring system monitors the Kafka component to provide the backlog status of each partition of the alarm message topic. The intelligent operations support system monitors the number of alarm messages received and processed through Prometheus. When monitoring detects a surge in the number of alarm messages received per minute compared to the daily average, and the difference between the number of received and processed messages exceeds a threshold within a specified time, while the backlog of consumption in each partition of the Kafka alarm message topic exceeds the threshold, an alarm storm warning is triggered. The intelligent operations support system then triggers Kubernetes to automatically expand the alarm message processing service instances.

[0045] The implementation process of the present invention has been described above. It is understood that the embodiments of the present invention send real-time alarm messages evenly to the alarm message queue, efficiently associate and store the real-time alarm messages in the database based on the alarm message queue, and then distribute them to the corresponding external applications of the transmission network management system, thereby improving the processing efficiency of transmission network alarms. Furthermore, alarm volume prediction can help anticipate alarm processing limits and risks, and alarm storm warnings reduce the risk of transmission network alarm storms.

[0046] like Figure 7 The diagram shown is a structural schematic of the transmission network alarm processing device provided in an embodiment of the present invention. (Refer to...) Figure 7 This invention provides a transmission network alarm processing device, comprising: The alarm message acquisition module is used to acquire real-time alarm messages from multiple transmission network management systems through the alarm message front-end unit, and send the real-time alarm messages to the alarm message queues corresponding to each transmission network management system. The alarm message association module is used to associate real-time alarm messages with corresponding resource configuration data based on the alarm message queue through the alarm message processing service to obtain alarm business data; The alarm service distribution module is used to distribute alarm service data to the corresponding external applications of each transmission network management system through the alarm sending service. The alarm data monitoring module is used to obtain the time-series data of the number of alarm messages from the alarm message front-end machine through the monitoring system, and to obtain the time-series data of the number of messages processed through the alarm message processing service; The alarm volume early warning module is used to input the time series data of the number of alarm messages into a pre-trained alarm volume prediction model to obtain the alarm volume prediction result, and then to issue an alarm volume early warning based on the alarm volume prediction result. The alarm storm warning module is used to determine the alarm backlog status of each transmission network management system based on the alarm message quantity time-series data and the message processing quantity time-series data, and then to issue alarm storm warnings based on the alarm backlog status.

[0047] It is understood that the content of the above method embodiments is applicable to the present device embodiments. The specific functions implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0048] This invention also provides an electronic device, comprising: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for communication between the processor and the memory. When the program is executed by the processor, it implements the aforementioned transmission network alarm processing method. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0049] like Figure 8 The diagram shown is a hardware structure schematic of an electronic device provided in an embodiment of the present invention. (Refer to...) Figure 8 This invention provides an electronic device, comprising: The processor 801 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention. The memory 802 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 802 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 802 and is called and executed by the processor 801 to execute the transmission network alarm processing method of the embodiments of this invention. The 803 input / output interface is used to implement information input and output. The communication interface 804 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). Bus 805 transmits information between various components of the device (e.g., processor 801, memory 802, input / output interface 803, and communication interface 804); The processor 801, memory 802, input / output interface 803, and communication interface 804 are connected to each other within the device via bus 805.

[0050] It is understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0051] like Figure 9 The diagram shown is a structural schematic of the storage medium provided in an embodiment of the present invention. (Refer to...) Figure 9 The present invention also provides a storage medium, which is a computer-readable storage medium for computer-readable storage. The storage medium stores one or more programs 901, which can be executed by one or more processors to implement the above-described transmission network alarm processing method.

[0052] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0053] This invention also discloses a computer program product, including a computer program that, when executed by a processor, implements the above-described transmission network alarm processing method.

[0054] It is understood that the content of the above method embodiments is applicable to the embodiments of this program product. The specific functions implemented by the embodiments of this program product are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0055] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0056] The embodiments described in this invention are for the purpose of more clearly illustrating the technical solutions of the embodiments of this invention, and do not constitute a limitation on the technical solutions provided by the embodiments of this invention. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this invention are also applicable to similar technical problems.

[0057] The terms "first," "second," "third," "fourth," etc. (if present) in the specification and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0058] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the aforementioned blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this invention are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is changed and sub-operations described as part of a larger operation are executed independently.

[0059] Furthermore, although the invention has been described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the aforementioned functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the invention. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of conventional skill of an engineer. Therefore, those skilled in the art can implement the invention as set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and not intended to limit the scope of the invention, which is determined by the full scope of the appended claims and their equivalents.

[0060] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0061] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-including system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0062] More specific examples (a non-exhaustive list) of computer-readable media include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the aforementioned program can be printed, because the aforementioned program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0063] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0064] In the foregoing description of this specification, references to terms such as "one embodiment," "another embodiment," or "some embodiments" indicate that a specific feature, structure, material, or characteristic described in connection with an embodiment or example is included in at least one embodiment or example of the present invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0065] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

[0066] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.

Claims

1. A method for processing alarms in a transmission network, characterized in that, Includes the following steps: The alarm message front-end acquires real-time alarm messages from multiple transmission network management systems and sends the real-time alarm messages to the alarm message queues corresponding to each of the transmission network management systems. The alarm service associates the real-time alarm messages with the corresponding resource configuration data based on the alarm message queue to obtain alarm service data. The alarm service data is distributed to the external applications corresponding to each of the transmission network management systems through the alarm sending service. The monitoring system obtains alarm message quantity time-series data from the alarm message front-end machine and message processing quantity time-series data from the alarm message processing service. The alarm message quantity time series data is input into a pre-trained alarm volume prediction model to obtain alarm volume prediction results, and then alarm volume warning is issued based on the alarm volume prediction results. The alarm backlog status of each transmission network management system is determined based on the alarm message quantity time-series data and the message processing quantity time-series data, and then an alarm storm warning is issued based on the alarm backlog status.

2. The method for processing transmission network alarms according to claim 1, characterized in that, The step of sending the real-time alarm message to the alarm message queue corresponding to each of the transmission network management systems specifically includes: The alarm object ID is obtained by parsing the real-time alarm message; The alarm object ID is hashed to obtain the alarm message topic key value; The alarm message queue corresponding to the transmission network management system is determined based on the alarm message topic key value, and the real-time alarm message is sent to the alarm message queue.

3. The method for processing transmission network alarms according to claim 2, characterized in that, The step of associating the real-time alarm messages with the corresponding resource configuration data based on the alarm message queue to obtain alarm service data specifically includes: Read the real-time alarm messages and their corresponding alarm object IDs sequentially from the alarm message queue; Retrieve the corresponding resource configuration data from the resource pool database or Redis cache based on the alarm object ID; The alarm service data is obtained by associating the real-time alarm message with the resource configuration data, and the alarm service data is stored in the alarm database.

4. The transmission network alarm processing method according to claim 3, characterized in that, The step of distributing the alarm service data to the external applications corresponding to each of the transmission network management systems specifically includes: The alarm sending service obtains the alarm service data to be distributed and the corresponding alarm object ID from the alarm database. The external application corresponding to the transmission network management system is determined based on the alarm object ID, and the alarm service data is distributed to the corresponding external application through an external Kafka.

5. The method for processing transmission network alarms according to claim 1, characterized in that, The alarm message quantity time-series data includes the number of alarm messages obtained by the alarm message front-end machine from each of the transmission network management systems in multiple consecutive historical time periods, and the message processing quantity time-series data includes the number of alarm services that the alarm message processing service completed associated processing in multiple consecutive historical time periods.

6. The method for processing transmission network alarms according to claim 1, characterized in that, The alarm volume prediction model is trained through the following steps: Multiple alarm message quantity time-series samples are obtained from the alarm message front-end machine, and the corresponding alarm volume labels are determined by manual annotation. The time-series sample of the alarm message quantity is input into a pre-built LSTM neural network to obtain the predicted alarm volume. The loss value is determined based on the predicted alarm volume and the alarm volume label; The parameters of the LSTM neural network are updated based on the loss value using the backpropagation algorithm to obtain the trained alarm volume prediction model.

7. A transmission network alarm processing method according to any one of claims 1 to 6, characterized in that, The step of determining the alarm backlog status of each transmission network management system based on the alarm message quantity time-series data and the message processing quantity time-series data, and then issuing an alarm storm warning based on the alarm backlog status, specifically includes: The alarm backlog growth rate of the alarm message queue corresponding to each of the transmission network management systems is determined based on the alarm message quantity time-series data and the message processing quantity time-series data. Obtain the real-time alarm message count of the alarm message queue; When the real-time alarm message data exceeds a preset first threshold and the alarm backlog growth rate exceeds a preset second threshold, the corresponding alarm storm warning of the transmission network management system is triggered.

8. A transmission network alarm processing device, characterized in that, include: The alarm message acquisition module is used to acquire real-time alarm messages from multiple transmission network management systems through the alarm message front-end unit, and send the real-time alarm messages to the alarm message queues corresponding to each of the transmission network management systems. The alarm message association module is used to associate the real-time alarm message with the corresponding resource configuration data based on the alarm message queue through the alarm message processing service to obtain alarm service data; The alarm service distribution module is used to distribute the alarm service data to the external applications corresponding to each of the transmission network management systems through the alarm sending service; The alarm data monitoring module is used to obtain alarm message quantity time-series data from the alarm message front-end machine through the monitoring system, and to obtain message processing quantity time-series data through the alarm message processing service; The alarm volume warning module is used to input the time series data of the number of alarm messages into a pre-trained alarm volume prediction model to obtain the alarm volume prediction result, and then to issue an alarm volume warning based on the alarm volume prediction result. The alarm storm warning module is used to determine the alarm backlog status of each of the transmission network management systems based on the alarm message quantity time-series data and the message processing quantity time-series data, and then to issue an alarm storm warning based on the alarm backlog status.

9. An electronic device, characterized in that, The electronic device includes a memory, a processor, a computer program stored in the memory and executable on the processor, and a data bus for enabling communication between the processor and the memory. When the computer program is executed by the processor, it implements the transmission network alarm processing method as described in any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the transmission network alarm processing method as described in any one of claims 1 to 7.

Images