A method and system for analyzing abnormal nodes and influence range of a fault link

Abstract

The application relates to the technical field of power communication network operation and maintenance, and particularly provides a method and system for analyzing abnormal nodes and influence range of a fault link, which comprises the following steps: a network topology structure model of power communication is constructed, the connection relationship between network nodes and links and the service information borne by each link are determined; the running state parameters and alarm parameters of network equipment are collected in real time, and the parameters are associated and mapped to corresponding network nodes or links; the network nodes and / or links that are in fault are identified based on the associated and mapped parameters, so that the corresponding fault links are determined; a graph traversal algorithm is used to perform reverse tracing along the link connection relationship, so that abnormal root cause nodes in the fault links are located; and the influence range, influence degree and influence level of the fault links are evaluated according to the link connection relationship of the abnormal root cause nodes and the service information borne by the abnormal root cause nodes. Through the method, the problems that the fault node positioning is time-consuming and the evaluation is not accurate when a complex network fault is faced in the prior art are solved.

Description

Technical Field

[0001] This invention relates to the field of power communication network operation and maintenance technology, specifically to a method and system for analyzing abnormal nodes and the scope of impact of a faulty link. Background Technology

[0002] With the continuous advancement of smart grid construction, the power communication network, as a key infrastructure supporting the safe and stable operation of the power grid, carries various core services such as relay protection and dispatch data. Due to the characteristics of power communication networks, such as large scale, complex topology, and heterogeneous equipment types, once a network failure occurs (such as equipment downtime or link interruption), it often generates a large number of alarms and can quickly affect related services, seriously threatening the safe and stable operation of the power grid.

[0003] In existing power communication network operation and maintenance technologies, the following methods are typically used to handle faults: (1) Passive alarm response: Relying on maintenance personnel to view real-time alarms through the network management system and troubleshoot faulty nodes layer by layer based on their personal experience. This method is not only inefficient, but also prone to information overload when faced with a large number of concurrent alarms, making it difficult for personnel to quickly and accurately locate the source of the fault.

[0004] (2) Static topology analysis: Based on a pre-drawn network topology diagram, manual simulation is performed to assess the potential impact of the fault. However, since the network status is dynamic, static diagrams cannot accurately reflect the current service carrying capacity, leading to a distortion in the assessment of the impact range.

[0005] (3) Single-dimensional monitoring: Most existing analysis tools view equipment failures in isolation, lacking the ability to explore the fault links, the abnormalities of the nodes themselves, the services carried by the nodes, and the connections between the three. This results in an inaccurate assessment of the impact and an inability to provide a strong quantitative basis for emergency repair decisions.

[0006] In summary, existing technologies suffer from several technical problems when dealing with complex network faults, including long fault location times, high misjudgment rates, and inaccurate and unintuitive assessments of the fault's impact range.

[0007] Therefore, the present invention provides a method and system for analyzing abnormal nodes and the scope of impact of a faulty link, in order to solve the technical problems existing in the prior art. Summary of the Invention

[0008] To overcome the shortcomings of the prior art, the present invention provides a method and system for analyzing abnormal nodes and the scope of impact of a faulty link, so as to solve the problems in the prior art.

[0009] One embodiment of the present invention provides a method for analyzing abnormal nodes and the scope of impact of a faulty link, including the following steps: Construct a network topology model of the power communication network to determine the network nodes, link connections, and the service information carried by each link; Real-time collection of network device operating status parameters and alarm parameters, and mapping of operating status parameters and alarm parameters to corresponding network nodes or links in the network topology model; Based on the operational status parameters and alarm parameters of the association mapping, identify the network nodes and / or links that have failed in the network topology model, so as to determine the corresponding faulty links. A graph traversal algorithm is used to trace the source of the fault by tracing the link connections along the network topology model in reverse, and to locate the abnormal root cause node in the faulty link. Based on the link connection relationship and the service information carried by the abnormal root cause node in the network topology model, the impact range, impact degree and impact level of the faulty link are evaluated.

[0010] This application also relates to a system for analyzing abnormal nodes and the scope of impact in a faulty link, including: The model building module is used to construct a network topology model of the power communication network, and to determine the network nodes, link connections, and the service information carried by each link. The association mapping module is used to collect the operating status parameters and alarm parameters of network devices in real time, and associate and map the operating status parameters and alarm parameters to the corresponding network nodes or links in the network topology model. The fault identification module is used to identify faulty network nodes and / or links in the network topology model based on the operation status parameters and alarm parameters of the association mapping, so as to determine the corresponding faulty link. The reverse tracing module is used to perform reverse tracing along the link connection relationship of the network topology model using a graph traversal algorithm to locate the abnormal root cause node in the faulty link; The fault assessment module is used to assess the impact range, impact degree, and impact level of the faulty link based on the link connection relationship and the service information carried by the abnormal root cause node in the network topology model.

[0011] This application also relates to a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described method for analyzing abnormal nodes and the scope of influence of a faulty link.

[0012] This application also relates to a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described method for analyzing abnormal nodes and the scope of impact of a faulty link.

[0013] The method and system for analyzing abnormal nodes and impact range of a faulty link provided in the above embodiments have the following beneficial effects: This invention solves the problem of evaluation distortion caused by static topology analysis and single-dimensional monitoring in existing technologies by constructing a topology model that includes network nodes, link connection relationships, and service information, and establishing a dynamic correlation mapping between operating status parameters and alarm parameters on topology nodes and links. This ensures that fault analysis is based on real-time and accurate network status. By identifying faulty links based on correlation mapping parameters and using a graph traversal algorithm to trace back along link connection relationships to locate the root cause node of the anomaly, this invention effectively overcomes the shortcomings of low efficiency and information overload in passive alarm response due to manual experience-based troubleshooting, which is prone to failure under large-scale concurrent alarms. This shortens the fault location time and reduces the false judgment rate. By comprehensively evaluating the impact range, impact degree, and impact level based on the link connection relationship of the root cause node and its carried service information, this invention achieves in-depth mining of the correlation between faulty links, abnormal nodes, and carried services, replacing traditional manual deduction. This allows the impact assessment to move from qualitative to quantitative, providing an intuitive quantitative basis for emergency repair decisions. Attached Figure Description

[0014] Figure 1 A flowchart illustrating a method for analyzing abnormal nodes and the scope of impact in a faulty link, as provided in an embodiment of the present invention; Figure 2 This is a schematic block diagram of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0015] The technical solutions in the embodiments of the present invention will now be clearly and completely described in conjunction with the accompanying drawings.

[0016] Reference Figure 1 One embodiment of the present invention provides a method for analyzing abnormal nodes and the scope of impact of a faulty link, comprising the following steps: S10. Construct a network topology model of the power communication network, and determine the network nodes, link connections, and service information carried by each link; S20. Collect the operating status parameters and alarm parameters of network devices in real time, and map the operating status parameters and alarm parameters to the corresponding network nodes or links in the network topology model. S30. Based on the operation status parameters and alarm parameters of the association mapping, identify the network nodes and / or links that have failed in the network topology model, so as to determine the corresponding faulty links. S40. Use a graph traversal algorithm to trace the source backward along the link connection relationship of the network topology model to locate the abnormal root cause node in the faulty link. S50. Based on the link connection relationship and service information carried by the abnormal root cause node in the network topology model, assess the impact range, impact degree and impact level of the faulty link.

[0017] In this embodiment, as described in steps S10~S50 above, specifically: Step S10, which involves constructing a network topology model for the power communication network, involves digitally and structurally abstracting and modeling the physically deployed power communication network. This involves abstracting various communication network elements into network nodes, identifying the physical transmission channels and logical communication channels between these elements as links, and comprehensively depicting the topological connections and upstream / downstream relationships between all network nodes, links, and between nodes and links. Simultaneously, it involves identifying the specific power-specific service types, service flows, and service affiliations carried by each communication link, clarifying the binding relationships between links and services. The core objective of this step is to establish a standardized, algorithm-accessible unified topology data foundation and service association foundation. This addresses the technical problems of traditional power communication networks lacking a unified digital topology carrier, exhibiting fragmented and disordered node-link relationships, and unclear service and link affiliations, leading to a lack of reliable analytical support for subsequent fault identification, root cause tracing, and fault impact assessment. This provides a complete topology framework and service data support for the entire fault analysis process.

[0018] The network device operating status parameters referred to in step S20 are the operating condition indicators, service carrying indicators, and hardware operating indicators generated during the operation of various network elements and transmission links in the power communication network, including real-time operating data such as port status, link bandwidth, transmission latency, equipment load, and operating power consumption; alarm parameters are various alarm event information triggered when network devices and links experience abnormalities, faults, or exceed operating limits, including alarm type, alarm level, alarm generation sequence, and alarm association location; real-time acquisition refers to continuously acquiring the above two types of parameters online according to the set sampling period to ensure the timeliness and continuity of the data; association mapping is to match and associate the collected operating status parameters and alarm parameters with the corresponding network nodes or links in the network topology model according to the device affiliation and link binding relationship, so as to realize a one-to-one correspondence between the actual operating data and alarm data of the physical network entities and the digital topology model. The core objective of this step is to achieve real-time aggregation of network operation data and alarm data, as well as precise location and binding at the topology level. This addresses the technical problems in traditional power communication networks where operation and alarm data are isolated and scattered, cannot be linked to specific topology nodes or links, and have insufficient timeliness, resulting in a lack of real-time and effective data support for subsequent fault identification. This provides a locationable and traceable real-time data foundation for subsequent fault determination and anomaly analysis.

[0019] Step S30 utilizes the operational status parameters and alarm parameters from the completed topology mapping as the basis for analysis and judgment. Using preset fault judgment rules and threshold conditions, it identifies network nodes and / or links in the constructed network topology model that exhibit abnormal operating conditions, exceed limits, or trigger alarms. These network nodes and / or links cover three actual operating scenarios: only network node failure, only communication link failure, and simultaneous failure of both network nodes and communication links. Combining the topology connections within the network topology model, the upstream and downstream business flow logic, and fault propagation characteristics, the identified faulty network nodes or links are further correlated and analyzed to define the corresponding faulty links affected by the anomaly and experiencing fault propagation. The core objective of this step is to achieve accurate identification of faulty topology entities from real-time operational data and alarm data, and then to accurate location of faulty links. This solves the technical problems of traditional power communication networks, which can only receive scattered alarm information, cannot accurately distinguish faulty nodes and links based on digital topology models, and struggle to quickly define the complete faulty link range. It provides a clear analytical object and boundary range for subsequent reverse fault tracing to locate the root cause node of the anomaly.

[0020] The graph traversal algorithm referred to in step S40 is a path search algorithm adapted to the characteristics of the power communication network topology (such as an improved form of depth-first traversal or breadth-first traversal adapted to the power communication topology, combined with service weight filtering, and limiting the direction of reverse fault tracing). It can achieve directional path tracing based on the clearly defined link connection relationships and node association logic in the network topology model. Reverse tracing refers to tracing along the reverse direction of service flow in the network topology (i.e., from the fault occurrence end to the upstream associated node / link) starting from the fault link determined in step S30, rather than forward diffusion investigation. The abnormal root cause node refers to the initial source node that caused the fault link to occur, which is the starting point of the fault propagation chain. The core execution logic of this step is: to use the algorithm to perform a structured traversal of the link connection relationships in the digital topology model, skip irrelevant paths, focus on fault-related links, and deduce from the locked fault links to locate the initial root cause node that triggered the fault. Its core purpose is to solve the technical problems of traditional power communication network fault root cause investigation relying on manual experience, low efficiency, and susceptibility to complex topology interference, which leads to inaccurate or missed root cause location. Through algorithmic and automated reverse tracing, it provides root cause analysis targets for subsequent fault impact assessment, and at the same time provides core basis for rapid fault handling.

[0021] The abnormal root cause node referred to in step S50 is the initial source node of the fault located in step S40. The link connection relationship is the structured connection relationship formed by this abnormal root cause node with upstream and downstream nodes and related links in the network topology model. The service information carried includes core information such as the service type, service priority, service capacity, and service scope corresponding to the root cause node and related links. The evaluation process takes the abnormal root cause node as the core entry point, combines its link connection relationship to sort out the topology coverage area where the fault may spread, and analyzes the impact of the fault on various services based on the service information carried. Then, a complete evaluation result is formed from three dimensions: impact range, impact degree, and impact level. Among them, the impact range corresponds to the topology area and service type affected by the fault, which is the coverage breadth of the overall evaluation; the impact degree focuses on the quantitative interference degree of the fault on service operation and network stability, which is the damage depth of the overall evaluation; the impact level is the graded judgment formed based on the first two (such as general, relatively serious, severe, major, etc.), which corresponds to the urgency level of fault handling. The core objective of this step is to achieve a comprehensive, quantitative, and graded assessment of the impact of faulty links. This addresses the technical problems of traditional power communication network fault impact assessment, which relies solely on experience-based judgment, has a single assessment dimension, lacks unified standards, and has vague grading, making it difficult to accurately grasp the degree of fault damage and formulate targeted handling strategies. This provides a scientific and accurate basis for subsequent business protection and fault handling, ensuring the effectiveness and targeted nature of fault handling.

[0022] In one embodiment, step S10 specifically includes: S101. Extract network device data and link resource data from the power communication network, preprocess them, and construct a topology framework including node objects and link objects. S102. Obtain the real-time operating indicators, link-bearing service information and service flow status of the network device, and associate and bind the real-time operating indicators, link-bearing service information and service flow status to the corresponding node objects or link objects in the topology framework respectively. S103. Based on the service protection mechanism and equipment linkage logic of the power communication network, define and configure dynamic association rules between each node object, between each link object, and between node objects and link objects. S104. The topology framework, real-time operation indicators and dynamic association rules are integrated and encapsulated to construct a network topology model of the power communication network.

[0023] In this embodiment, as described in steps S101~S104 above, specifically: The network device data referred to in step S101 is the basic attribute data of various physical and logical network elements in the power communication network, including core information such as device model, hardware configuration, deployment location, device identification, and functional module parameters; the link resource data is the data related to the transmission channels connecting various network devices, covering information such as link transmission medium type, link bandwidth, link identification, link start and end points, link physical path, and logical affiliation; preprocessing refers to cleaning (removing invalid and erroneous data), deduplication (deleting duplicate and redundant records), standardization (unifying data format and naming conventions), and association alignment (establishing a preliminary mapping relationship between devices and corresponding links) of the two types of raw data to ensure the accuracy, consistency, and usability of the data; the node object is a structured carrier after the physical / logical network element device is digitally abstracted, and the link object is a structured carrier after the transmission channel is abstracted. The two together constitute the core component of the topology framework; the topology framework is the structured skeleton that carries the node object, link object, and their basic relationship, and does not include the subsequent bound operation indicators and association rules. The core objective of this step is to transform the physical entities and resources of the power communication network into standardized digital objects through data extraction and preprocessing, and to build a basic topology framework. This addresses the technical problems of traditional power communication network equipment and link data being scattered, inconsistent in format, and weakly correlated, making them unsuitable for direct use in digital topology modeling. It provides a structured and standardized framework to support subsequent parameter association and binding, and dynamic association rule configuration.

[0024] The real-time operating indicators referred to in step S102 are dynamic operating condition data generated by network devices during operation, including parameters reflecting the real-time operating status of devices and links such as device port transmit / receive rates, CPU load, memory utilization, power supply status, link transmission latency, and packet loss rate. Link-borne service information refers to data related to the power communication-specific services actually carried by each link, covering core information such as service identifier, service type (e.g., dispatch data network service, relay protection service, automation service), service priority, service bandwidth requirements, and service service objects. Service flow status refers to the real-time status of service transmission in the link, including dynamic information such as service flow direction, service connection establishment status, and whether service transmission is interrupted or stalled. Association binding refers to matching real-time operating indicators to corresponding node objects (because operating indicators originate from devices) and accurately matching link-borne service information and service flow status to corresponding link objects (because services rely on link transmission) based on the unique mapping relationship between device identifiers, link identifiers, and node objects and link objects in the topology framework. This achieves a one-to-one correspondence between the three types of data and structured objects in the topology framework, enabling the topology framework, which originally only contained basic structures, to have data carrying capabilities. The core purpose of this step is to fill the topology framework with dynamic operational data and business-related data, solving the technical problem that the topology framework built by S101 is only an empty skeleton and lacks actual operational and business attribute support, which makes it impossible to carry out subsequent fault identification and correlation analysis. This allows the digital topology model to have both structural form and data content, providing a data foundation for the configuration of subsequent dynamic correlation rules, and providing accurate object-data binding relationships for subsequent parameter mapping and fault analysis.

[0025] The service protection mechanism referred to in step S103 is a pre-set protection strategy system in the power communication network to ensure the continuous operation of core services. It includes service self-healing protection, redundant backup switching, fault isolation, and priority service priority protection. For example, critical services are configured with two independent transmission channels, primary and backup. When the primary channel is abnormal, it automatically switches to the backup channel to maintain service connectivity. When a ring transmission link is interrupted, a detour path can be replanned to ensure that the service is not interrupted. The device linkage logic refers to the associated action rules formed by different node objects and link objects in the network based on functional coordination and fault response. For example, after a node device fails, it triggers the traffic diversion action of the upstream associated node, and after a link is interrupted, it triggers the automatic activation logic of the backup link. Dynamic association rules refer to association judgment rules that adapt to changes in network state, defined for three association scenarios—between node objects, between link objects, and between node objects and link objects—based on the aforementioned business protection mechanisms and device linkage logic. Their dynamism is reflected in the fact that the rules can be updated synchronously according to adjustments in business protection mechanisms, optimizations in device linkage logic, or changes in network topology. The rules for the three scenarios focus on the collaborative response relationship between node objects, the redundancy backup and fault switching relationship between link objects, and the trigger linkage relationship between node objects and link objects, respectively. When a node experiences operational anomalies and reaches preset fault conditions, the associated link switches from normal transmission state to standby bearer state, achieving seamless service continuity. The core execution logic of this step is to organically integrate the business protection strategy, device collaboration logic, and topology architecture association relationships of the power communication network, transforming them into structured rules that the topology model can recognize and invoke. Its core purpose is to solve the technical problem that the constructed topology framework only possesses physical topology structure and static business data, lacking dynamic association logic at the business operation level and device interaction level, resulting in subsequent fault analysis being unable to simulate the collaborative response and fault propagation characteristics of a real network.

[0026] The topology framework referred to in step S104 is the structured basic skeleton containing node objects and link objects constructed in S101. The real-time operation indicators are the dynamic operating conditions and business flow data associated and bound to node objects or link objects in S102. The dynamic association rules are the business protection and device collaboration logic defined in S103 for the three types of association scenarios. The fusion and encapsulation is not a simple superposition of the three elements, but rather, through structured integration technology, the binding relationship between real-time operation indicators and node objects and link objects is embedded into the topology framework, and the dynamic association rules are deeply coupled with the structural association and data association of the topology framework, thus integrating the three parts of the topology framework, real-time operation indicators, and dynamic association rules as a whole. Among them, the topology framework corresponds to the physical structure carrier of the network, the real-time operation indicators correspond to the dynamic business data of the network, and the dynamic association rules correspond to the association logic between network devices and services. The three are integrated into one, giving the topology framework comprehensive capabilities for data storage, logical invocation, and dynamic updates. The final constructed network topology model is a digital twin carrier that can accurately map the physical entities of the power communication network, reflect the network operating status in real time, and intelligently support association analysis. It can be directly called by subsequent fault identification, tracing, evaluation, and other algorithms. The core objective of this step is to complete the final closed loop of digital modeling of power communication networks, and to solve the technical problem that the topology framework, operating indicators, and association rules produced by S101-S103 are scattered and independent, and cannot form a unified analysis carrier, resulting in a lack of complete digital support for subsequent algorithms. The final output is a network topology model that has structural integrity, data timeliness, and logical intelligence.

[0027] In one embodiment, step S20 specifically includes: S201. Based on the service affiliation attributes of node objects and link objects in the topology framework, collect the operating status parameters and alarm parameters of the corresponding network devices in real time. S202. Perform validity verification and redundancy removal on the operating status parameters and alarm parameters to obtain a valid parameter dataset. S203. Based on the network topology model, dynamic association rules associate and map the effective parameter dataset to the corresponding node objects or link objects in the topology framework to complete the parameter mapping and binding. S204. Monitor the change status of dynamic association rules in real time. When the dynamic association rules are adjusted, update the mapping relationship between the running status parameters, alarm parameters and node objects and link objects synchronously.

[0028] In this embodiment, as described in steps S201~S204 above, specifically: The topology framework referred to in step S201 is the structured basic skeleton containing node objects and link objects constructed in S101. The business affiliation attribute of node objects and link objects is one of the core attributes associated and bound in S102. Specifically, it includes information such as the business type (e.g., relay protection business, automation business, etc.), business priority, business service scope, business affiliation department, and business association identifier corresponding to the node object and link object. This attribute clarifies the correspondence between the node object and link object and the specific business in the power communication network. Real-time acquisition refers to continuously acquiring data online according to a preset sampling period (e.g., millisecond level, second level, which can be dynamically adjusted according to the importance of the business) to ensure the timeliness and continuity of the collected parameters. The corresponding network device operating status parameters cover operating indicators such as CPU load, memory utilization rate, and port transmit and receive rate of the device associated with the node object, as well as operating data such as bandwidth utilization, transmission delay, and packet loss rate of the transmission channel associated with the link object. Alarm parameters include abnormal event information such as alarm type, alarm level, and alarm occurrence time triggered by the device or channel associated with the node object and link object. The core execution logic of this step is to establish a mapping relationship between service affiliation, node objects or link objects, and physical device channels based on the clearly defined service affiliation attributes in the topology framework. This allows for the targeted collection of operational status parameters and alarm parameters strongly related to core services, avoiding data redundancy caused by indiscriminate collection. Its core purpose is to solve the technical problems of traditional power communication network parameter collection, such as the lack of clear affiliation guidelines, blind collection, large amounts of data redundancy, or omissions of key service parameters, thereby achieving precise and targeted parameter collection.

[0029] The operating status parameters and alarm parameters referred to in step S202 are the raw data collected in real time in S201. These may include invalid data due to equipment malfunction, transmission interference, sampling errors, etc., as well as redundant data generated by multi-source collection and repeated reporting. Validity verification refers to multi-level verification of the core attributes of these two types of parameters, including data format verification (ensuring parameters conform to preset data specifications and field requirements), value range verification (removing abnormal values ​​exceeding the normal operating threshold of the device / link, such as negative link bandwidth or alarm levels exceeding the set level), and timing consistency verification (verifying the matching of parameter timestamps with the collection period). The process involves several steps: First, filtering out data with outdated time sequences; second, verifying data integrity (ensuring alarm parameters include key fields such as type, level, and time, and that no core indicators are missing from operational status parameters); third, redundancy removal (using data feature comparison to remove duplicate reports of identical data, irrelevant data not directly related to node / link objects, and low-value, repetitive, fluctuating data (such as static, redundant records that haven't changed for a long time), retaining core data with analytical value); and fourth, a standardized dataset of valid parameters, after validity verification and redundancy removal, characterized by uniform format, reasonable values, no redundancy, and direct usability for subsequent mapping, binding, and fault analysis. The core logic of this step is to refine the raw data, first filtering out invalid data to avoid interfering with subsequent analysis, and then removing redundant data to reduce storage and computational pressure. Its core purpose is to address the technical problems of invalid, redundant, and formatted raw data collected by S201, which, when directly used for mapping and binding, affect the accuracy of topology association, consume excessive system resources, and interfere with the accuracy of subsequent fault identification.

[0030] The dynamic association rules of the network topology model referred to in step S203 are the service protection and device collaboration rules defined and configured in S103, covering the relationships between node objects, link objects, and between node objects and link objects. These rules clarify the basis for determining the association between various parameters and topology objects. The effective parameter dataset is a standardized data set obtained after validity verification and redundancy removal in S202, containing compliant operating status parameters and alarm parameters. The topology framework is the structured basic skeleton constructed in S101, and its node objects and link objects have been bound to core attributes such as service affiliation through S102. Association mapping refers to comparing the parameters with the corresponding attributes of node objects or link objects in the topology framework based on the dynamic association rules, combined with the parameters' own device identifier, link identifier, service affiliation, and other attributes. The operating status parameters (corresponding to the device and channel conditions associated with the node object or link) and alarm parameters (corresponding to the abnormal events associated with the node object or link object) are respectively attached to their respective topology objects, realizing a unique correspondence between various parameters and topology objects. Parameter mapping binding is the solidification operation after the association mapping is completed, so that the effective parameter dataset and topology objects form a stable association relationship, which can be directly called by subsequent analysis steps. The core execution logic of this step is to build a matching bridge between various parameters and topology objects, avoiding mismatches or omissions between parameters and objects, and achieving deep integration of data and topology. Its core purpose is to solve the technical problem in traditional power communication networks where operation and alarm data are disconnected from topology entities and the mapping relationship is ambiguous, leading to the inability to accurately locate the source of anomalies in subsequent fault analysis, and to complete the input of effective data into the topology model.

[0031] The dynamic association rules referred to in step S204 are the service protection and device collaboration rules defined and configured in S103 and embedded in the network topology model. Their change status covers scenarios such as adding, modifying (e.g., optimizing device linkage logic, adjusting service protection strategies) and deleting (e.g., removing redundant associations). Real-time monitoring refers to continuously tracking the changes in dynamic association rules through a preset rule status monitoring mechanism to ensure that rule change events are captured as soon as possible. The monitoring frequency is adapted to the parameter collection cycle of S201 to ensure the timeliness of change response. Synchronous update refers to re-verifying and adjusting the original mapping relationship between operating status parameters, alarm parameters and node objects and link objects based on the new rule definition after capturing dynamic association rule changes. This includes adding parameters that conform to the new rules and mapping them to topology objects, modifying the original mappings that conflict with the new rules, and deleting mappings that have become invalid due to rule deletion, ensuring that the mapping relationship is always consistent with the currently effective dynamic association rules. The mapping relationship here is the association and binding relationship between operating parameters and node objects and link objects completed in S203, which is the core link for the deep integration of data and topology objects. The core execution logic of this step is to establish a dynamic linkage mechanism between rule changes and mapping updates, avoiding the disconnection of mapping relationships after rule changes and ensuring the continuous effectiveness of data correlation in the topology model. Its core purpose is to solve the technical problem in traditional power communication networks where mapping relationships are fixed once established, unable to adapt to changes in dynamic association rules, leading to subsequent mismatches between parameters and topology objects and decreased accuracy in fault analysis. It achieves dynamic self-adaptive maintenance of mapping relationships, ensuring that the network topology model maintains accurate correspondence between data and topology objects even under rule change scenarios. This provides a continuous, stable, and dynamically adaptable correlation foundation for full-process fault analysis, enabling the parameter mapping system constructed in S201-S203 to form a complete closed loop from initial establishment of binding relationships to subsequent dynamic maintenance.

[0032] In one embodiment, step S30 specifically includes: S301. Extract the service weights of each node object and link object in the network topology model, and based on the analysis of the associated operating status parameters and alarm parameters mapped to the network topology model, set differentiated fault triggering thresholds according to the service weights; wherein, the higher the service weight, the lower the corresponding fault triggering threshold. S302. Within the preset monitoring time window, monitor the associated and mapped operating status parameters and alarm parameters in the topology framework in real time. When the operating status parameter of any node object and / or link object continuously exceeds the corresponding fault trigger threshold, or the alarm parameter meets the preset alarm type, trigger a fault warning. S303. Invoke the dynamic association rules and service protection mechanisms in the network topology model to perform upstream and downstream service flow path verification based on topology connection relationship and fault propagation verification based on device linkage logic on the node objects and / or link objects corresponding to the fault warning. S304. If the verification confirms that the abnormal state of the node object and / or link object corresponding to the fault warning exceeds the fault tolerance range of the service protection mechanism, and the dynamic association rules determine that it will cause the fault propagation of upstream and downstream node objects and / or link objects, then it is confirmed as a valid fault link.

[0033] In this embodiment, as described in steps S301~S304 above, specifically: The business weight referred to in step S301 is a weight value quantified based on factors such as the importance, priority, service scope, scale of users affected, and irreplaceability of the power business carried by the node object and link (for example, the business weight of the node object and link carrying core businesses such as relay protection and dispatch data network is higher than that of the object carrying ordinary monitoring data transmission; the specific weight value can be determined according to the actual situation). This weight has been integrated into the network topology model through the association and binding process in S102. The associated and mapped operating status parameters and alarm parameters of the network topology model, i.e., the effective parameter dataset after binding in S203, are the core data basis for fault determination. The differentiated fault trigger threshold refers to the fault determination threshold set separately for node objects and link objects with different business weights, rather than a uniform threshold standard. The overall logic is that the higher the business weight, the lower the threshold should be. That is, the nodes and links corresponding to core businesses are more sensitive to anomalies, and slight parameter fluctuations or low-level alarms can trigger fault determination, while objects corresponding to ordinary businesses need to reach a more significant degree of anomaly to trigger determination, thereby realizing the priority differentiation of fault identification. The core execution logic of this step is to first extract preset service weights from the topology model, and then establish a correlation mapping between service importance and fault sensitivity based on the bound real-time parameters, setting differentiated thresholds through an inverse proportional relationship. Its core purpose is to solve the technical problems of traditional power communication network fault judgment using a uniform trigger threshold, which leads to easy underreporting of core service faults, easy false alarms of ordinary services, and a lack of priority differentiation in fault identification. It aims to achieve more accurate and differentiated fault identification, prioritizing the timely detection of faults in high-weight core services, providing reasonable judgment criteria for S302 fault warning and S303 fault verification, and improving the targeting and reliability of fault identification.

[0034] The preset monitoring time window referred to in step S302 is a fixed duration (such as 3 seconds or 5 seconds, which can be dynamically adjusted according to the service type) set according to the stability requirements of power communication network services, parameter fluctuation characteristics, and fault response time. It is used to filter out misjudgments caused by instantaneous parameter fluctuations and ensure the stability of fault judgment. The associated and mapped operating status parameters and alarm parameters are valid data after topology binding in S203 and purification in S202, and have been mounted to the corresponding node object or link object. Any node object and / or link object covers three scenarios: only node object, only link object, and both node object and link object are abnormal at the same time, adapting to the diverse forms of actual network faults. Continuously exceeding the corresponding fault trigger threshold This specifically refers to the differentiated thresholds set by S301 for each node and link object. It emphasizes that parameters must exceed the corresponding fault trigger threshold multiple times consecutively (e.g., exceeding it for three consecutive data collection cycles, not just a single instantaneous exceedance) to avoid false alarms caused by occasional fluctuations. The preset alarm types are a set of key alarms based on the fault level classification of the power communication network and the pre-defined impact on services (such as core service interruption alarms, equipment hardware fault alarms, link transmission interruption alarms, etc.), not all types of alarms triggering an alarm. Fault warnings refer to the system generating preliminary abnormality prompt information, including the abnormal object identifier, abnormal parameter type, alarm level, and trigger time. This is only used as a candidate for subsequent fault verification, not the final fault confirmation. The core execution logic of this step is, under the constraint of a time window, to continuously monitor the real-time parameters bound to the topology based on the differentiated thresholds of S301 and the preset alarm types, capturing stable abnormal events and triggering alarms. Its core purpose is to solve the technical problems of traditional fault monitoring, such as lack of time window constraints, susceptibility to instantaneous fluctuations, and high false alarm rates due to lack of alarm triggering. It aims to achieve preliminary identification and screening of faults, provide clear candidate objects for S303 fault verification, and improve the efficiency and accuracy of subsequent fault confirmation.

[0035] The dynamic association rules in the network topology model referred to in step S303 are the collaborative logic and association judgment rules between node objects, link objects, and between the two as defined and configured in S103. The service protection mechanism is the self-healing protection, redundancy backup, fault isolation, and other protection strategies preset by the power communication network. Together, they constitute the core logical basis for fault verification. The node objects and / or link objects corresponding to the fault warning are the abnormal candidate objects that trigger the warning in S302, covering three scenarios: node abnormality alone, link abnormality alone, and both abnormal at the same time. The upstream and downstream service flow path verification based on the topology connection relationship refers to the verification of the upstream and downstream service flow paths based on the nodes and links clearly defined in the network topology model. The link connection relationship is traced back to the upstream and downstream related business paths of the warning object, verifying whether the anomaly has a related impact along the business flow direction (e.g., whether an upstream node anomaly will propagate to the downstream link, or whether a downstream link anomaly originates from an upstream node failure), and eliminating isolated warnings that contradict the topology association logic; the fault propagation verification based on device linkage logic refers to calling the device collaborative response logic in the dynamic association rules to verify whether the anomaly of the warning object conforms to the fault propagation law of the power communication network (e.g., whether a node failure will trigger an abnormal state of the related link, or whether a link interruption will trigger the linkage activation of the backup node), and filtering out warning events with reasonable fault propagation links. The core execution logic of this step is to perform dual verification from both topology association and fault propagation aspects, and with the help of the rules and mechanisms embedded in the topology model, to screen the initial warnings of S302, eliminating false warnings that are unrelated and have no propagation logic. Its core purpose is to solve the technical problem that S302 triggers early warnings based solely on the abnormality of a single object parameter, without considering network topology association and fault propagation characteristics, resulting in a high false alarm rate. It upgrades the judgment from single object anomaly to comprehensive verification of associated logic, providing reliable candidate objects that have undergone double verification for the effective fault link confirmation of S304, thereby improving the accuracy and rigor of the final fault judgment.

[0036] The verification and confirmation referred to in step S304 is the verification result obtained after verifying both the topology connection relationship and fault propagation. The node object and / or link object corresponding to the fault warning are the abnormal candidate objects screened in S303. The fault tolerance range of the service protection mechanism refers to the upper limit of abnormal fluctuations that the preset protection strategy (such as self-healing protection and redundant backup) of the power communication network can withstand (for example, a slight packet loss in the core service link can be compensated by the redundant channel, and this level of packet loss is within the fault tolerance range; if it exceeds this range, it must be judged as abnormal). Its specific threshold has been integrated into the configuration logic of the service protection mechanism. The dynamic association rule is the node and link association and coordination rule defined in S103, which is the core basis for determining the possibility of fault propagation. Fault propagation refers to the abnormal state being transmitted from the current warning object to the upstream and downstream related node objects and / or link objects along the topology connection relationship and service flow path, resulting in a chain reaction of more topology entities experiencing abnormalities. The effective fault link refers to the fault-related link that has been confirmed through the complete process of parameter warning, dual verification, and condition judgment, which is real, exceeds the protection capability, and has the risk of propagation. It is the core analysis object for subsequent reverse tracing. The core execution logic of this step is based on the S303 verification foundation, superimposed with two conditions: fault tolerance range determination and fault propagation determination (both must be met simultaneously), to perform a final validity confirmation of anomaly candidates: if the anomaly does not exceed the fault tolerance range (e.g., it can self-heal through business protection mechanisms), or will not cause upstream and downstream fault propagation (e.g., isolated anomalies have no propagation path), then the candidate is eliminated; only when both conditions are met is it defined as a valid fault link. Its core purpose is to solve the technical problem that traditional fault determination does not combine business protection capabilities and fault propagation risks, leading to over-judgment of minor anomalies and misjudgment of isolated anomalies as valid faults, and to achieve the screening and final confirmation of fault links.

[0037] In one embodiment, step S40 specifically includes: S401. Starting from the faulty link, the link connection relationship of the network topology model is screened according to the business weight of each node object and the link object and the fault propagation direction of the faulty link. Redundant tracing paths with business weights lower than the preset weight threshold are eliminated to obtain a set of candidate paths to be reverse traced. S402. Combining the dynamic association rules of the network topology model with the device linkage logic, set the graph traversal reverse tracing rules. S403. Based on the graph traversal reverse tracing rules, a directional restricted graph reverse traversal is performed along the link connection relationship of the network topology model in the candidate path set, and the associated node objects and / or link objects are traced back level by level. The business weight of each candidate path and the matching degree of each candidate path relative to the dynamic association rules are extracted to calculate the root cause matching degree of each candidate path. S404. Perform path convergence comparison on each source branch formed by reverse traversal to obtain the valid source branches and their corresponding candidate root cause nodes. S405. Based on the fault tolerance range of the business protection mechanism, remove the valid tracing branches containing pseudo-root cause nodes, select the valid tracing branch with the highest root cause matching degree among the remaining valid tracing branches, and determine the upstream node object or link object corresponding to the valid tracing branch as the abnormal root cause node.

[0038] In this embodiment, as described in steps S401-S405 above, specifically: The faulty link referred to in step S401 is the valid faulty link finally confirmed in S304, which is the starting reference point for reverse tracing. The business weight of each node object and link object is the quantitative weight value (reflecting business importance) that has been associated and bound in S102 and extracted in S301. The preset weight threshold is a weight critical value set in advance according to the fault tracing accuracy requirements of the power communication network and the core business protection priority (e.g., only the path corresponding to the object with a business weight ≥ 0.7 is retained). The fault propagation direction of the faulty link refers to the actual path direction of the fault spreading from the initial root cause node to the upstream and downstream (e.g., from the upstream node to the downstream node via the intermediate link). Its reverse direction is the tracing direction. When screening paths, the associated links need to be locked in the opposite direction. Redundant tracing paths refer to tracing paths with business weights lower than the preset weight threshold, carrying non-core businesses, and not substantially helping to locate the root cause (e.g., the path corresponding to a low-weight link that only carries ordinary monitoring data). The candidate path set to be reverse traced is a set of structured paths that have been screened and retained, focusing on high-weight business associated links and having root cause investigation value. The core execution logic of this step starts with an effective fault path, first clarifying the reverse tracing direction of fault propagation, and then using business weight as the filtering criterion. Low-value redundant paths are eliminated by setting preset weight thresholds, retaining only high-weight paths strongly related to core business and potentially containing the root cause, forming a focused set of candidate paths. Its core purpose is to solve the technical problems of traditional reverse tracing that fail to filter paths, resulting in chaotic tracing paths, excessive redundant paths, massive computational load, and low tracing efficiency, thus achieving precise focusing and optimization of tracing paths.

[0039] The dynamic association rules of the network topology model referred to in step S402 are the service protection and coordination judgment rules between node objects, link objects, and between the two as defined and configured in S103. The device linkage logic is the association action rule formed by each topology object in the network based on functional coordination and fault response (such as link switching triggered by node failure, traffic diversion caused by link anomaly). The two together constitute the core logical basis of the tracing rules. The graph traversal reverse tracing rules are targeted rules adapted to the candidate path set after S401 screening. They are not general traversal rules. Their setting process needs to deeply integrate the above two types of logic: on the one hand, based on the dynamic association rules, the rules are clearly defined. The rules prioritize the association of topological objects in the candidate paths (e.g., traversing paths corresponding to objects with high business weights first) and implement reverse adaptation logic for fault propagation (e.g., defining the traversal direction according to the reverse direction of business flow). On the other hand, the rules combine device linkage logic to set traversal termination conditions (e.g., stopping tracing when traversing to a node with fault isolation function) and fault association judgment criteria (e.g., only including nodes that meet the device linkage triggering relationship in the root cause candidate range). The rules also include path conflict handling mechanisms (e.g., prioritizing paths with higher business weights when multiple candidate paths intersect) and abnormal association verification requirements (e.g., only retaining traversal paths consistent with the abnormal characteristics of faulty links). The core execution logic of this step is to transform the topological association characteristics and device collaboration logic of the power communication network into structured rules recognizable by the graph traversal algorithm, providing clear path guidance, priority ranking, and judgment criteria for reverse tracing, making the traversal process more closely aligned with the actual operating characteristics of the power communication network. Its core purpose is to solve the technical problems of traditional graph traversal algorithms, which use general rules for reverse tracing but do not combine the dynamic association rules and equipment linkage logic specific to power communication networks. This leads to the tracing path deviating from the core business, low traversal efficiency, and susceptibility to interference from irrelevant nodes. It provides precise rule support for the directional restricted traversal of S403, ensuring that the subsequent tracing process can focus on the core path, avoid invalid traversal, and improve the accuracy and efficiency of abnormal root cause node location.

[0040] The graph traversal reverse tracing rules referred to in step S403 are exclusive tracing rules set in S402 by combining dynamic association rules and device linkage logic. These rules include core elements such as path priority sorting, traversal direction constraints, and termination condition definitions. The candidate path set is the set of high-weight core paths obtained after eliminating redundant paths in S401. This set defines the scope of the reverse traversal, avoiding indiscriminate traversal that leads to inefficiency. In the directional restricted graph reverse traversal, "directional" specifically refers to traversing in the opposite direction of the fault propagation direction specified in S401 (i.e., the tracing direction from the fault link to the root cause node). "Restricted" means strictly adhering to the graph traversal reverse tracing rules, traversing only within the candidate path set and the association relationships allowed by the rules, without deviating from the core business association paths. The step-by-step backtracking of associated node objects and / or link objects refers to traversing upwards from the starting point of the fault link according to the topological connection relationship and business flow logic. The process involves tracing back each candidate path, sequentially identifying associated node objects, link objects, or a combination of both to form a hierarchical tracing trajectory. The business weight of each candidate path is a comprehensive quantitative value (e.g., a weighted sum) of the business weights of all node and link objects on that path, reflecting the overall importance of the business carried by the path. The matching degree of each candidate path relative to the dynamic association rules refers to the degree of fit between the path's tracing trajectory, node / link relationships, and the device linkage logic and business protection mechanisms in the dynamic association rules (e.g., whether it conforms to fault propagation patterns and association triggering conditions), quantified into a value between 0 and 1 using a rule matching algorithm. The root cause matching degree is a comprehensive quantitative indicator calculated using a preset weighted algorithm (e.g., business weight accounting for 60%, rule matching degree accounting for 40%), combining the business weight and rule matching degree of the candidate paths. A higher value indicates a greater probability that the path corresponds to an abnormal root cause node. The core execution logic of this step is to perform a targeted and efficient reverse traversal under rule constraints and path limitations, quantitatively evaluating the business importance and rule fit of candidate paths to form a root cause matching degree ranking, providing a quantitative basis for root cause node location. Its core purpose is to solve the technical problem that traditional reverse tracing relies solely on path traversal tracing and lacks quantitative evaluation standards, resulting in ambiguous priority of root cause candidate paths and difficulty in accurately locking the core tracing direction, and to achieve quantitative analysis and orderly sorting of the tracing process.

[0041] The tracing branches formed by the reverse traversal referred to in step S404 are multiple independent tracing trajectories formed due to differences in path relationships and intersections of topology nodes after the directed restricted traversal in the candidate path set in S403. Each branch corresponds to a complete tracing path extending from the faulty link to upstream related nodes and links, and then locating the potential root cause node. Path convergence comparison refers to using the dynamic association rules of the network topology structure model, business flow logic, and topology connection relationships as the core basis to perform multi-dimensional consistency verification and core node extraction on all tracing branches, including comparing the overlap of the tracing trajectories of each branch (such as whether they point to the same batch of upstream related nodes) and the relationship between nodes and links. The core logic of this step involves analyzing the differences in the compatibility (whether it conforms to the device linkage logic) and root cause matching scores, while simultaneously filtering common intersection nodes between branches—key nodes traced to by multiple branches—and eliminating isolated branches with trajectory conflicts, root cause matching scores below a preset threshold, or no related intersection points. Valid tracing branches are those that, after convergence comparison, possess trajectory consistency, high rule compatibility, meet root cause matching standards, and have core intersection nodes; these are the core basis for root cause localization. Candidate root cause nodes are the common intersection nodes or tracing endpoint nodes of valid tracing branches. These nodes are the focal points of multiple high-confidence branches, possessing the core suspicion of causing the fault link anomaly, and are key objects for subsequent final root cause confirmation. The core execution logic of this step is to eliminate invalid branches and extract core clues from the multi-branch tracing results, eliminating redundancy and conflicts among multiple branches through convergence comparison, and extracting valid branches with consistent direction and their corresponding core candidate nodes. Its core purpose is to solve the technical problems that may arise after S403 traversal, such as multiple messy tracing branches, scattered pointers between branches, and difficulty in locking core root cause candidates. It achieves the advancement from multi-branch traversal to core candidate focus, providing a precise and concentrated candidate range for the final confirmation of abnormal root cause nodes in S405, avoiding subsequent root cause determination from falling into multi-path interference, and improving the efficiency and accuracy of root cause localization.

[0042] The fault tolerance range of the business protection mechanism referred to in step S405 is the upper limit of abnormal fluctuations that the business protection strategy (such as self-healing protection and redundant backup) defined in S103 can withstand. It is consistent with the definition standard of the fault tolerance range in S304 and is the core basis for determining pseudo-root cause nodes. Pseudo-root cause nodes refer to node objects / link objects in the effective tracing branch that appear to be the source of the fault, but whose abnormal state does not exceed the fault tolerance range of the business protection mechanism (such as self-healing through the protection strategy) or whose abnormality cannot trigger the spread of the fault link. These nodes are only intermediate interference nodes on the tracing path and are not the real initial source of the fault. The effective tracing branch is the focused tracing branch obtained by path convergence comparison in S404, which has trajectory consistency and high rule matching degree. The root cause matching degree is a comprehensive quantitative indicator obtained by weighted calculation of business weight and rule matching degree in S403, which directly reflects the probability of the branch corresponding to the root cause node. The upstream node object or link object refers to the core topology object near the starting point of the fault propagation chain in the effective tracing branch and is the initial triggering source of the fault link abnormality. The core execution logic of this step is as follows: First, using the fault tolerance range of the business protection mechanism as the screening benchmark, interference branches containing pseudo-root cause nodes are eliminated, ensuring that the remaining branches all point to candidate nodes with real fault triggering capabilities. Then, among the purified effective tracing branches, the branch with the highest root cause matching degree is selected as the optimal tracing path, based on the core sorting criterion. Finally, the upstream core topology object (node ​​object or link object) corresponding to the optimal path is defined as the abnormal root cause node, completing the final closed loop of root cause localization. Its core purpose is to solve the technical problem that the effective tracing branches screened by S404 may still contain pseudo-root cause interference, and the root cause priority among multiple branches is unclear. Through the dual optimization of pseudo-root cause elimination and highest matching degree screening, the accurate locking of abnormal root cause nodes is achieved, avoiding deviations or misjudgments in root cause localization.

[0043] In one embodiment, step S403, extracting the business weight of each candidate path and the matching degree of each candidate path relative to the dynamic association rule, to calculate the root cause matching degree of each candidate path specifically includes the following steps: S4031. Extract the business weights of the node objects and link objects contained in each candidate path according to the graph traversal reverse tracing rules, and accumulate or average the business weights of each node object and link object in the path to obtain the total business weight score of each candidate path. S4032. Based on the alarm parameters of device linkage logic and association mapping, calculate the connection tightness between node objects and link objects in the candidate path and the timing consistency of alarm occurrence to obtain the rule matching score of each candidate path. S4033. Based on the graph traversal reverse tracing rules and the fault propagation direction of the fault link, configure differentiated hierarchical attenuation coefficients for node objects and / or link objects at different levels in each candidate path, so that the weight contribution value of upstream nodes that are farther away from the fault link is lower. S4034. The total business weight score, rule matching score and hierarchical attenuation coefficient are combined and weighted according to the preset weighting coefficient to obtain the root cause matching degree of each candidate path.

[0044] In this embodiment, as described in step S4031 above, specifically: The graph traversal reverse tracing rule referred to in step S4031 is the exclusive tracing rule set in S402. It clarifies the selection criteria and traversal logic of candidate paths and is the core basis for extracting topological objects within the path. Each candidate path is a set of high-weight core paths obtained after eliminating redundant paths in S401. Each path contains several interconnected node objects and link objects. The business weights of node objects and link objects are the quantitative weight values ​​(reflecting the importance of the business carried by a single object) that are associated and bound in S102 and extracted in S301. The total business weight score is the result of uniformly quantifying and integrating the business weights of all node objects and link objects within a single candidate path. The integration method can be selected according to the analysis needs of the power communication network. The summation method focuses on reflecting the total importance of the business carried by the path (e.g., the summation score of paths with dense core business is higher), while the averaging method focuses on reflecting the average level of the overall business importance of the path (avoiding the excessive influence of a single high-weight object on the overall evaluation of the path). Both methods can realize the transformation from the weight of a single object to the comprehensive weight at the path level. The core execution logic of this step is to rely on tracing rules to identify all topological objects within the candidate path. Through standardized quantitative integration, the dispersed business weights of individual objects are transformed into a unified indicator (total business weight score) at the path level, providing a quantitative basis for horizontal comparison of path importance. Its core purpose is to solve the technical problems in S403 where path business weights lack a unified calculation standard and relying solely on the weight of a single object cannot fully reflect the overall importance of the path, thereby achieving accurate quantification of the business importance of candidate paths.

[0045] The device linkage logic referred to in step S4032 is the collaborative response rules between node objects and link objects defined and configured in S103 (such as link switching triggered by node failure, traffic diversion caused by link anomaly, etc.), which is the core basis for determining the rationality of object association; the alarm parameters of the association mapping are the effective alarm data after topology binding is completed in S203 and purification in S202, including key information such as alarm type, occurrence time, and triggering object; the connection tightness is an indicator that quantifies the association strength between node objects and link objects in the candidate path, and is determined based on the device linkage logic; if there is a direct collaborative response relationship between the two (such as primary and backup nodes, core business links and bearer nodes), the tightness value is high (such as the range of 0.8-1.0); if there is only an indirect association or no clear linkage relationship, the connection tightness value is low. A low density value (e.g., 0.0-0.3) primarily reflects the strength of the correlation between objects in fault propagation. The timing consistency of alarm occurrences refers to whether the order of alarm occurrences for each object in the candidate path matches the fault propagation timing specified by the device linkage logic (e.g., root cause node alarms should precede downstream link alarms, and linkage trigger object alarms should follow the trigger source alarm). This is calculated through timing difference quantification (1.0 for perfect timing consistency, 0.0 for severe deviation). The rule matching score is a comprehensive quantitative value (range 0-1) obtained by weighting and summing the connection density and timing consistency according to preset weights (e.g., density accounts for 50%, timing consistency accounts for 50%). A higher score indicates a stronger fit between the candidate path and dynamic association rules and fault propagation patterns. The core execution logic of this step is to first calculate the correlation strength between objects based on the device linkage logic, then verify the rationality of fault propagation by combining alarm timing, and finally form a unified rule matching score through weighted integration, achieving a dual quantitative evaluation of association logic and timing characteristics. Its core purpose is to solve the technical problem in S403 where the lack of quantitative standards for rule matching and reliance on qualitative judgments leads to ambiguity in path fit assessment. It provides precise quantitative support at the rule level for root cause matching calculation, complementing the business weight total score of S4031. This ensures that the assessment of root cause matching takes into account both business importance and network operation logic, thereby improving the comprehensiveness and accuracy of subsequent root cause localization.

[0046] The graph traversal reverse tracing rules referred to in step S4033 are the exclusive tracing rules set in S402, which clarify the core requirements such as tracing direction and path constraints. The fault propagation direction of the fault link is the fault propagation path direction defined in S401 (such as extending from the upstream node to the downstream node through the intermediate link), and its reverse is the tracing direction, which is the core basis for hierarchical division. The candidate paths are the set of high-weight core paths after screening in S401, and each path is naturally divided into different levels according to the tracing order. Taking the fault link as the base level (level 0), the upstream nodes / links adjacent to the fault link are level 1, the upstream related objects of level 1 objects are level 2, and so on. The larger the level number, the closer to the fault. The farther the faulty link, the more significant the impact. Differentiated hierarchical attenuation coefficients are weight correction coefficients set for each level (range 0-1). The core logic is that the farther the distance from the faulty link, the smaller the coefficient. For example, level 0 has a coefficient of 1.0 (no attenuation), level 1 has 0.8, level 2 has 0.6, and level 3 and above has 0.4 (which can be dynamically adjusted according to the attenuation characteristics of power communication network fault propagation). This is used to correct the weight contribution of objects at different levels. The weight contribution value is the product of the node object / link object's own business weight (bound by S102) and the corresponding hierarchical attenuation coefficient. The weight contribution value of an upstream node farther from the faulty link decreases due to the reduced attenuation coefficient, avoiding interference from distant high-weight nodes in root cause determination. The core execution logic of this step is to first divide the path hierarchy according to the tracing distance, then configure a gradient attenuation coefficient for each level. By multiplying the coefficient with the business weight, a weight contribution value that balances business importance and tracing distance is obtained, ensuring that root cause assessment conforms to the actual propagation pattern: the closer the fault source is to the faulty link, the higher the impact weight; the farther away, the lower the impact weight. Its core purpose is to solve the technical problem that traditional source tracing does not consider the distance attenuation characteristics of fault propagation, which leads to high-weight nodes that are far from the fault link being misjudged as the core root cause. By correcting the weight contribution through hierarchical attenuation coefficient, the root cause matching degree calculation is made more in line with the actual law of fault propagation in power communication networks. This provides a scientific basis for weight correction for the subsequent accurate quantification of root cause matching degree, and further improves the accuracy of abnormal root cause node location.

[0047] The total business weight in step S4034 is a quantitative value of the overall business importance of the candidate path obtained by summing or averaging in S4031, which intuitively reflects the degree to which the path carries core business; the rule matching score is a comprehensive indicator calculated by S4032 based on connection tightness and timing consistency, reflecting the degree of fit between the path and device linkage logic and fault propagation law; the hierarchical attenuation coefficient is a weight correction coefficient configured for different levels of the path in S4033, whose core function is to weaken the weight contribution of nodes farther from the fault link, conforming to the actual propagation law that the closer the fault source, the higher the weight contribution, and the farther the distance, the lower the weight contribution; the preset weighting coefficient is... Based on the core requirements of fault tracing in power communication networks, a proportional allocation rule is established (e.g., 30% for total business weight score, 40% for rule matching score, and 30% for hierarchical attenuation coefficient). This allocation logic prioritizes the weight of rule matching while considering business importance and distance attenuation characteristics, and can be dynamically adjusted according to the actual network scenario. The weighted calculation involves adjusting the total business weight score and rule matching score according to the preset proportions and then summing them to obtain a comprehensive quantitative index ranging from 0 to 1, namely the root cause matching degree. A higher score indicates higher credibility and accuracy of the abnormal root cause node corresponding to the candidate path. The core execution logic of this step is to construct a quantitative evaluation model combining business importance, rule matching degree, and distance attenuation. By using preset weighting coefficients, the three dimensions of indicators are organically integrated to achieve a comprehensive and accurate quantification of the root cause probability of candidate paths, avoiding bias caused by single-dimensional evaluation. Its core purpose is to solve the technical problem that the indicators of each dimension of S4031-S4033 are scattered and independent and cannot comprehensively reflect the root cause probability. It integrates the scattered quantitative results into a unified root cause matching degree indicator, providing a scientific and unified quantitative ranking basis for path convergence comparison of S404 and final confirmation of root cause nodes of S405. This ensures that the location of abnormal root cause nodes not only meets the core business needs but also conforms to the network fault propagation law, while avoiding interference from distant nodes, and further improving the accuracy and reliability of root cause location.

[0048] In one embodiment, step S50 specifically includes: S501. Based on the link connection relationship of the network topology model and the direction of fault propagation of the fault link, traverse the network with the root cause node as the center, delineate the topological region where the fault spreads, and determine the topological influence range of the fault link. S502. Within the topology impact range, match the business information and business flow path carried by each node object and link object, calculate the business type, business quantity and associated business sites affected by the fault, and determine the business impact range of the faulty link. S503. Combining the business weights of the node objects and / or link objects corresponding to the services affected by the fault, the duration of the fault, and the hierarchical relationship of equipment linkage, construct an impact assessment model to quantitatively calculate the degree of fault impact of the faulty link. S504. Preset impact level classification threshold standards, match and classify the corresponding fault impact levels according to the topology impact range, business impact range and fault impact degree, and generate corresponding protection strategies based on the business protection mechanism.

[0049] In this embodiment, as described in steps S501~S504 above, specifically: The link connection relationship in the network topology model referred to in step S501 is the structured association relationship between the previously constructed node objects and link objects, which clarifies the connection path and collaborative scope of each topology object; the fault propagation direction of the faulty link is the actual path direction of the fault spreading from the root cause node to the upstream and downstream as defined in S401 (such as the fault spreading from the upstream root cause node through the intermediate associated link to the downstream affected node); the abnormal root cause node is the initial triggering source of the fault (node ​​object or link object) finally confirmed in S405; the traversal centered on the abnormal root cause node refers to the directional tracing along the fault propagation direction based on the link connection relationship of the network topology model. Tracing and traversing is not an indiscriminate global traversal. During the traversal, it is necessary to capture all node objects and link objects that are directly or indirectly related to the root cause node and affected by the fault propagation. The topology region where the fault propagates refers to the structured set of affected topology objects locked after traversal. This region clearly defines the diffusion boundary of the fault at the topology level, including both core topology objects directly impacted by the fault and extended topology objects indirectly affected by related connections. The topology impact range is the specific coverage area corresponding to this topology region, which not only includes all node objects and link objects within the region but also implicitly includes the related services carried by these objects, achieving a dual definition of the topology objects and related services. The core execution logic of this step is to combine the connection relationship of the topology structure with the actual propagation trajectory of the fault to accurately trace all related topology objects of the fault propagation from the root cause node, forming a clearly defined topology impact region, providing a clear range benchmark for the quantitative assessment of the degree of fault impact. Its core purpose is to solve the technical problem that the traditional fault impact range definition relies solely on experience judgment and does not combine the topology structure and fault propagation rules, resulting in ambiguity or omission of the range, and to achieve accurate delineation of the fault topology impact range.

[0050] The topology impact range referred to in step S502 is the fault propagation topology area defined in S501, which includes all node objects and link objects affected by the fault association; the service information carried by each node object and link object is the core attribute associated and bound in S102, including service type (such as relay protection service, automation service, dispatch data network service, etc.), service priority, service level, service department, etc. The service flow path is the service transmission path clearly defined in the network topology structure model, such as the service transmission trajectory formed by the service from site A through the core node and link B to site C. The matching operation refers to accurately associating each node / link object with its corresponding business information and business flow path within the topology impact range, locking down the business relationships interrupted or affected by topology object anomalies. The types of businesses affected by the fault need to be distinguished between core and ordinary businesses, and single and composite businesses. The number of businesses is the specific numerical value of all affected businesses within the range (including main businesses and related auxiliary businesses). Related business sites refer to the physical sites carrying these affected businesses (such as substations, control centers, communication sites, etc.). These three are calculated and confirmed one by one through matching analysis of business information and flow paths. The business impact range of the faulty link is a comprehensive definition of the affected business types, quantities, and related sites, forming a structured result of a business type list, business quantity statistics, and site coverage list. This clarifies the actual impact range of the fault at the business level, including both directly interrupted businesses and indirectly affected businesses due to path obstruction or abnormal related objects. The core execution logic of this step extends from the topology impact range of S501 to the business level. Through accurate matching of topology objects and business information, the abstract topology anomaly is transformed into specific quantitative indicators of business impact, completing the layer-by-layer transformation of topology range analysis, business association matching, and impact degree quantification. Its core purpose is to address the technical problem that traditional fault impact assessments only focus on the topology level and ignore the actual impact on services, resulting in a one-sided determination of the scope of impact and a lack of business-specific response strategies. It clarifies the specific impact of faults on the core services of power communication networks, provides a business-dimensional basis for the formulation of S503 response strategies, and ensures that fault handling can prioritize the restoration of critical services and the normal operation of core sites.

[0051] The business weights of the node objects and / or link objects corresponding to the services affected by the fault in step S503 are the quantitative weight values ​​extracted in S102 (association and binding) and S301 (association and binding), which directly reflect the importance level of the affected services (high weight for core services and low weight for ordinary services); the fault duration refers to the cumulative time from the occurrence of the fault to the present or expected recovery, which is obtained through real-time monitoring data of the network topology model. The longer the duration, the greater the impact on services and network operation; the hierarchical association of device linkage is the coordination level between node objects and link objects defined in S103 (such as the linkage relationship between the core layer, aggregation layer, and access layer). The higher the level, the wider the scope of association and the stronger the chain effect of fault propagation. The impact assessment model is a quantitative analysis model built upon the three core factors mentioned above. During its construction, standardized weights must first be assigned to each factor (e.g., 40% for business weight, 30% for fault duration, and 30% for equipment linkage hierarchy; these weights can be dynamically adjusted according to the operational needs of the power communication network). Then, normalization is used to unify the quantitative indicators of each factor to the same dimension. Finally, a weighted summation algorithm is used to integrate them into a single quantitative result. The degree of fault impact is the specific quantitative value output by this model (ranging from 0-100, with higher scores indicating more severe fault impact). The quantitative calculation process must be combined with the business impact range determined by S502 to ensure that the assessment results accurately cover the affected business types, quantities, and sites. The core execution logic of this step is to organically integrate the three key influencing factors—business importance, time dimension, and scope of related diffusion—and achieve a quantitative assessment of the degree of fault impact through a standardized model, avoiding assessment bias caused by single-dimensional judgment. Its core purpose is to solve the technical problems of traditional fault impact assessment relying on qualitative descriptions, lacking unified quantitative standards, and being unable to accurately distinguish fault severity levels. It provides a scientific quantitative basis for fault handling, ensuring that subsequent response strategies can be prioritized according to the degree of impact, and resources can be allocated first to handle high-impact faults, so as to minimize the impact of faults on the core business and overall operation of the power communication network.

[0052] The preset impact level classification threshold standard referred to in step S504 is a multi-dimensional quantitative standard set by combining the core service guarantee requirements, fault handling resource allocation capabilities, and service interruption tolerance of the power communication network. It is divided into several levels according to severity (e.g., Level 1 to Level 4, with Level 1 being the highest impact level). Each level corresponds to a specific topology impact range threshold (e.g., Level 1 corresponds to topology impact covering ≥3 core layer nodes, Level 4 corresponds to coverage of only a single access layer link), a service impact range threshold (e.g., Level 1 corresponds to ≥5 types of core service interruptions or ≥10 associated sites, Level 4 corresponds to ≤1 type of ordinary service interruption and no core site impact), and a fault impact degree threshold (e.g., Level 1 corresponds to a quantitative value ≥80 points, Level 4 corresponds to ≤30 points). The threshold standard can be dynamically adjusted according to the network operation scenario; the topology impact range is defined in S501. The defined fault propagation topology area and the scope of business impact are structured results obtained by S502 from three dimensions: business type, business quantity, and related business sites. The degree of fault impact is the quantitative score output by the evaluation model in S503. These three factors together constitute the core basis for the level classification. Matching the corresponding fault impact level means comparing the actual results of the three dimensions with preset threshold standards one by one. If all of them meet the threshold requirements of a certain level (or are judged to meet the standard according to preset weights), then the level is determined, avoiding misjudgment of the level due to the bias of a single dimension. Based on the business protection mechanism, the corresponding protection strategy is generated synchronously. This means that according to the classified fault impact level, the business protection mechanism (self-healing protection, redundancy backup, fault isolation, etc.) defined in S103 is invoked to generate a targeted handling plan. For example, for a level 1 fault, an emergency repair process is initiated, core business is switched to a backup path, and the fault area is isolated to prevent propagation; for a level 2 fault, resources are prioritized to repair high-weight business-related objects and a local redundancy mechanism is activated; for a level 3 fault, a conventional repair process is adopted and the business status is continuously monitored; for a level 4 fault, a minor anomaly handling script is automatically triggered without manual intervention, ensuring that the protection strategy is accurately matched with the fault severity and business protection requirements. The core execution logic of this step is to comprehensively determine the level of fault impact based on preset standardized thresholds, considering factors such as topology impact, service impact, and quantification. Then, relying on service protection mechanisms, differentiated protection strategies are generated, forming a closed-loop handling logic of level classification and strategy adaptation. Its core purpose is to solve the technical problems of traditional fault handling, such as the lack of clear level standards, insufficient targeting of protection strategies, and disordered resource allocation. It achieves hierarchical and classified management of fault impact, ensuring that high-level faults are prioritized and handled quickly, while low-level faults are handled efficiently and automatically, minimizing the impact of faults on the overall operation of the power communication network and ensuring the continuous stability of core services.

[0053] In one embodiment, a system for analyzing abnormal nodes and the scope of impact of a faulty link is provided. This system corresponds to the method for analyzing abnormal nodes and the scope of impact of a faulty link described in the above embodiments. The system includes: The model building module is used to construct a network topology model of the power communication network, and to determine the network nodes, link connections, and the service information carried by each link. The association mapping module is used to collect the operating status parameters and alarm parameters of network devices in real time, and associate and map the operating status parameters and alarm parameters to the corresponding network nodes or links in the network topology model. The fault identification module is used to identify faulty network nodes and / or links in the network topology model based on the operation status parameters and alarm parameters of the association mapping, so as to determine the corresponding faulty link. The reverse tracing module is used to perform reverse tracing along the link connection relationship of the network topology model using a graph traversal algorithm to locate the abnormal root cause node in the faulty link; The fault assessment module is used to assess the impact range, impact degree, and impact level of the faulty link based on the link connection relationship and the service information carried by the abnormal root cause node in the network topology model.

[0054] For specific limitations regarding the system for analyzing the abnormal nodes and impact range of a faulty link, please refer to the limitations of the method for analyzing the abnormal nodes and impact range of a faulty link described above, which will not be repeated here. Each module in the aforementioned system for analyzing the abnormal nodes and impact range of a faulty link can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0055] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows. Figure 2As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database is used for data storage, data processing, and data analysis. The network interface is used for communication with external terminals via a network connection. When executed by the processor, the computer program implements a method for analyzing abnormal nodes and the scope of impact in a faulty link.

[0056] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements a method for analyzing abnormal nodes and the scope of impact of a faulty link.

[0057] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements a method for analyzing abnormal nodes and the scope of impact of a faulty link.

[0058] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0059] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0060] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for analyzing abnormal nodes and the scope of impact in a faulty link, characterized in that, Includes the following steps: Construct a network topology model of the power communication network to determine the network nodes, link connections, and the service information carried by each link; Real-time collection of network device operating status parameters and alarm parameters, and mapping of operating status parameters and alarm parameters to corresponding network nodes or links in the network topology model; Based on the operational status parameters and alarm parameters of the association mapping, identify the network nodes and / or links that have failed in the network topology model, so as to determine the corresponding faulty links. A graph traversal algorithm is used to trace the source of the fault by tracing the link connections along the network topology model in reverse, and to locate the abnormal root cause node in the faulty link. Based on the link connection relationship and the service information carried by the abnormal root cause node in the network topology model, the impact range, impact degree and impact level of the faulty link are evaluated.

2. The method for analyzing abnormal nodes and impact range of a faulty link as described in claim 1, characterized in that, The steps of constructing a network topology model for a power communication network and determining network nodes, link connections, and the service information carried by each link specifically include: Extract network device data and link resource data from the power communication network, preprocess them, and construct a topology framework including node objects and link objects; Obtain real-time operating metrics, link-bearing service information, and service flow status of network devices, and associate and bind the real-time operating metrics, link-bearing service information, and service flow status to the corresponding node objects or link objects in the topology framework; Based on the service protection mechanism and equipment linkage logic of the power communication network, define and configure dynamic association rules between each node object, between each link object, and between node objects and link objects; The aforementioned topology framework, real-time operating indicators, and dynamic association rules are integrated and encapsulated to construct a network topology model for the power communication network.

3. The method for analyzing abnormal nodes and impact range of a faulty link as described in claim 2, characterized in that, The step of real-time acquisition of network device operating status parameters and alarm parameters, and associating and mapping these parameters to corresponding network nodes or links in the network topology model, specifically includes: Based on the business affiliation attributes of node objects and link objects in the topology framework, the operating status parameters and alarm parameters of the corresponding network devices are collected in real time. The validity of the operating status parameters and alarm parameters is verified and redundancy is removed to obtain a dataset of valid parameters. Based on the dynamic association rules of the network topology model, the effective parameter dataset is associated and mapped to the corresponding node objects or link objects in the topology framework, thus completing the parameter mapping and binding. Real-time monitoring of changes in dynamic association rules; when dynamic association rules are adjusted, synchronously updating the mapping relationship between running status parameters, alarm parameters, node objects, and link objects.

4. The method for analyzing abnormal nodes and impact range of a faulty link as described in claim 2, characterized in that, The step of identifying faulty network nodes and / or links in the network topology model based on the operational status parameters and alarm parameters of the association mapping, and determining the corresponding faulty links, specifically includes: The service weights of each node and link object in the network topology model are extracted, and the operation status parameters and alarm parameters mapped to the network topology model are used as the basis for analysis. Differentiated fault triggering thresholds are set according to the service weights; where the higher the service weight, the lower the corresponding fault triggering threshold is set. Within the preset monitoring time window, the system monitors the associated and mapped operating status parameters and alarm parameters within the topology framework in real time. When the operating status parameter of any node object and / or link object continuously exceeds the corresponding fault trigger threshold, or the alarm parameter meets the preset alarm type, a fault warning is triggered. The dynamic association rules and service protection mechanisms in the network topology model are invoked to perform upstream and downstream service flow path verification based on topology connection relationship and fault propagation verification based on device linkage logic on the node objects and / or link objects corresponding to the fault warning. If the verification confirms that the abnormal state of the node object and / or link object corresponding to the fault warning exceeds the fault tolerance range of the service protection mechanism, and it is determined based on the dynamic association rules that it will cause the fault propagation of upstream and downstream node objects and / or link objects, then it is confirmed as a valid fault link.

5. The method for analyzing abnormal nodes and impact range of a faulty link as described in claim 4, characterized in that, The step of using a graph traversal algorithm to reverse-engineer the network topology model and locate the root cause node in the faulty link specifically includes: Starting from the faulty link, the link connection relationship of the network topology model is screened according to the business weight of each node object and the link object and the fault propagation direction of the faulty link. Redundant tracing paths with business weights lower than the preset weight threshold are eliminated to obtain a set of candidate paths to be traced in reverse. By combining the dynamic association rules of the network topology model with the device linkage logic, a graph traversal reverse tracing rule is defined. Based on the graph traversal reverse tracing rule, a directional restricted graph reverse traversal is performed along the link connection relationship of the network topology model in the candidate path set, and the associated node objects and / or link objects are traced back level by level. The business weight of each candidate path and the matching degree of each candidate path relative to the dynamic association rule are extracted to calculate the root cause matching degree of each candidate path. For each source branch formed by reverse traversal, perform path convergence comparison to obtain the valid source branch and its corresponding candidate root cause node; Based on the fault tolerance range of the business protection mechanism, the valid tracing branches containing pseudo-root cause nodes are removed. Among the remaining valid tracing branches, the valid tracing branch with the highest root cause matching degree is selected, and the upstream node object or link object corresponding to the valid tracing branch is identified as the abnormal root cause node.

6. The method for analyzing abnormal nodes and impact range of a faulty link as described in claim 5, characterized in that, The extraction of the business weights of each candidate path and the matching degree of each candidate path relative to the dynamic association rules, in order to calculate the root cause matching degree of each candidate path, specifically includes the following steps: Based on the reverse tracing rules of graph traversal, the business weights of the node objects and link objects contained in each candidate path are extracted, and the business weights of each node object and link object in the path are accumulated or averaged to obtain the total business weight score of each candidate path. Based on the alarm parameters of device linkage logic and association mapping, the connection tightness between node objects and link objects in the candidate path and the timing consistency of alarm occurrence are calculated to obtain the rule matching score of each candidate path. Based on the graph traversal reverse tracing rules and the fault propagation direction of the fault link, configure differentiated hierarchical attenuation coefficients for node objects and / or link objects at different levels in each candidate path, so that the weight contribution value of upstream nodes farther away from the fault link is lower. By integrating the total business weight score, rule matching score, and hierarchical attenuation coefficient, and performing a weighted calculation according to a preset weighting coefficient, the root cause matching degree of each candidate path is obtained.

7. The method for analyzing abnormal nodes and impact range of a faulty link as described in claim 1, characterized in that, The step of assessing the impact range, degree of impact, and level of impact of the faulty link based on the link connection relationship and service information carried by the abnormal root cause node in the network topology model specifically includes: Based on the link connection relationship of the network topology model and the direction of fault propagation of the fault link, the topology region where the fault spreads is delineated and the topology influence range of the fault link is determined by traversing the network with the root cause node as the center. Within the topology impact range, match the business information and business flow path carried by each node object and link object, calculate the business type, business quantity and associated business site affected by the fault, and determine the business impact range of the faulty link; By combining the business weights of the node objects and / or link objects corresponding to the affected services, the duration of the failure, and the hierarchical relationship of device linkage, an impact assessment model is constructed to quantitatively calculate the degree of failure impact of the faulty link. The system sets a threshold standard for classifying impact levels. Based on the topology impact range, business impact range, and degree of fault impact, it matches and classifies the corresponding fault impact levels, and generates corresponding protection strategies based on the business protection mechanism.

8. A system for analyzing abnormal nodes and the scope of impact of a faulty link, used to implement the steps of the method for analyzing abnormal nodes and the scope of impact of a faulty link as described in any one of claims 1-7, characterized in that, include: The model building module is used to construct a network topology model of the power communication network, and to determine the network nodes, link connections, and the service information carried by each link. The association mapping module is used to collect the operating status parameters and alarm parameters of network devices in real time, and associate and map the operating status parameters and alarm parameters to the corresponding network nodes or links in the network topology model. The fault identification module is used to identify faulty network nodes and / or links in the network topology model based on the operation status parameters and alarm parameters of the association mapping, so as to determine the corresponding faulty link. The reverse tracing module is used to perform reverse tracing along the link connection relationship of the network topology model using a graph traversal algorithm to locate the abnormal root cause node in the faulty link; The fault assessment module is used to assess the impact range, impact degree, and impact level of the faulty link based on the link connection relationship and the service information carried by the abnormal root cause node in the network topology model.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method for analyzing abnormal nodes and impact range of a faulty link as described in any one of claims 1-7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the method for analyzing abnormal nodes and impact range of a faulty link as described in any one of claims 1-7.

Images