Alarm aggregation method and device, storage medium, and electronic device

Abstract

Embodiments of the present disclosure provide an alarm aggregation method and device, a storage medium, and an electronic device. The method comprises: on the basis of the alarm types of a plurality of alarms, determining whether the plurality of alarms have an association relationship; when the plurality of alarms have the association relationship, determining an association time window of the plurality of alarms; and on the basis of whether the plurality of alarms meet a time constraint condition, determining whether to aggregate the plurality of alarms, wherein the time constraint condition is used for indicating that a difference value between alarm occurrence time points of two alarms is less than the association time window. The present disclosure solves the problem in the prior art of inaccurate alarm aggregation caused by fixation of association time windows.

Description

Alarm aggregation method and device, storage medium and electronic device

[0001] This disclosure claims priority to the Chinese patent application filed with the China Patent Office on June 28, 2023, with application number 202310790292.2 and invention name “Alarm aggregation method and device, storage medium and electronic device”, the entire content of which is incorporated by reference in this disclosure. Technical Field

[0002] The embodiments of the present disclosure relate to the field of communications, and in particular, to an alarm aggregation method and device, a storage medium, and an electronic device. Background Art

[0003] As the scale of bearer networks grows and the network structure becomes more complex, when a network failure occurs, a large number of related alarms are usually generated. In order to quickly and accurately locate the fault, it is necessary to aggregate the alarms caused by the fault to generate a major fault event. Current alarm aggregation methods mainly use a fixed time window for aggregation, aggregating related alarms within the aggregation time window to generate a major fault event. Due to the use of a fixed aggregation time window, inaccurate alarm aggregation may occur in actual applications. For example, when the occurrence time of related alarms caused by a fault exceeds the aggregation time window, they will be aggregated into different faults, resulting in fewer alarms. When alarms caused by different faults occur within the same aggregation time window, they will be aggregated into one fault, resulting in more alarms.

[0004] In order to solve the above-mentioned problem of inaccurate alarm aggregation, the alarm aggregation results can be improved by adding the judgment of the alarm correlation relationship during alarm aggregation. That is, when alarms are aggregated, if there is an alarm correlation relationship between two alarms, it is determined that the aggregation conditions are met. Otherwise, it is determined that the aggregation conditions are not met. However, the existing solutions mainly use common association rule mining algorithms (such as Apriori algorithm, FP-growth algorithm, prefixspan algorithm, etc.) to mine the correlation between alarms based on historical alarm data in advance. The use of this solution can improve the aggregation results to a certain extent, but it cannot solve the problem of inaccurate alarm aggregation. The main disadvantages are as follows:

[0005] (1) The existing scheme only mines the alarm correlation relationship, without considering the differences in the correlation time windows between different alarms. When the occurrence time difference between different alarms exceeds the aggregation time window, they will still be aggregated into different faults.

[0006] (2) Due to algorithmic limitations, the existing schemes can only mine limited alarm correlations and cover some alarm types. When applied to alarm aggregation, it is easy to cause misjudgment. For example, alarms that have alarm correlations themselves are misjudged as not being aggregated into one fault because the alarm correlations are not mined.

[0007] Therefore, the existing technology only considers mining alarm correlation relationships, without considering the differences in the correlation time windows between different alarms. When the occurrence time difference between different alarms exceeds the aggregation time window, they will still be aggregated into different faults.

[0008] Summary of the Invention

[0009] The embodiments of the present disclosure provide an alarm aggregation method and device, a storage medium, and an electronic device to at least solve the problem in the related art that when the occurrence time difference between different alarms exceeds the aggregation time window, they will be aggregated into different faults.

[0010] According to an embodiment of the present disclosure, a method for aggregating alarms is provided, comprising: determining whether multiple alarms have a correlation relationship based on their alarm types; determining the correlation time window of the multiple alarms when the multiple alarms have a correlation relationship; and determining whether to aggregate the multiple alarms based on whether the multiple alarms meet a time constraint condition, wherein the time constraint condition is used to indicate that the difference between the alarm occurrence times of two alarms is less than the correlation time window.

[0011] According to another embodiment of the present disclosure, an alarm aggregation device is provided, including: a first determination module, configured to determine whether multiple alarms have a correlation relationship based on the alarm types of the multiple alarms; a second determination module, configured to determine the correlation time window of the multiple alarms when the multiple alarms have a correlation relationship; and a third determination module, configured to determine whether to aggregate the multiple alarms based on whether the multiple alarms meet a time constraint condition, wherein the time constraint condition is used to indicate that the difference between the alarm occurrence time of two alarms is less than the correlation time window.

[0012] According to another embodiment of the present disclosure, a computer-readable storage medium is provided, in which a computer program is stored. The computer program is configured to execute the steps of any one of the above method embodiments when running.

[0013] According to another embodiment of the present disclosure, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any one of the above method embodiments.

[0014] Through the present disclosure, it is determined whether there is a correlation between the multiple alarms based on their alarm types; in the case that there is a correlation between the multiple alarms, the correlation time window of the multiple alarms is determined; and based on whether the multiple alarms meet the time constraint condition, it is determined whether to aggregate the multiple alarms, wherein the time constraint condition is used to indicate that the difference in the alarm occurrence time of two alarms is less than the correlation time window. Through the present disclosure, the correlation relationship and the correlation time window between different alarm types are flexibly determined, and whether to aggregate is determined based on the correlation relationship and the correlation time window, which solves the problem of inaccurate alarm aggregation due to the fixed correlation time window in the prior art, thereby improving the alarm aggregation result and enhancing the accuracy of alarm aggregation. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] FIG1 is a hardware structure block diagram of a computer terminal of an alarm aggregation method according to an embodiment of the present disclosure;

[0016] FIG2 is a flow chart of a method for aggregating alarms according to an embodiment of the present disclosure;

[0017] FIG3 is a structural diagram of an alarm relationship mining system according to an embodiment of the present disclosure;

[0018] FIG4 is a schematic diagram of a resource knowledge graph corresponding to a schema according to an embodiment of the present disclosure;

[0019] FIG5 is a schematic diagram of a resource knowledge graph schema corresponding to an SPN network according to an embodiment of the present disclosure;

[0020] FIG6 is a structural block diagram of an alarm aggregation device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0021] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the accompanying drawings and in conjunction with embodiments.

[0022] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0023] The method embodiments provided in the embodiments of the present disclosure can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 is a hardware structure block diagram of a computer terminal of an alarm aggregation method in an embodiment of the present disclosure. As shown in Figure 1, the computer terminal may include one or more (only one is shown in Figure 1) processors 102 (the processor 102 may include but is not limited to a microprocessor (Central Processing Unit, MCU) or a programmable logic device (Field Programmable Gate Array, FPGA) and a memory 104 for storing data, wherein the above-mentioned computer terminal may also include a transmission device 106 and an input and output device 108 for communication functions. It can be understood by those skilled in the art that the structure shown in Figure 1 is only for illustration and does not limit the structure of the above-mentioned computer terminal. For example, the computer terminal may also include more or fewer components than those shown in Figure 1, or have a configuration different from that shown in Figure 1.

[0024] The memory 104 can be configured to store computer programs, for example, software programs and modules of application software, such as a computer program corresponding to an alarm aggregation method in an embodiment of the present disclosure. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, implementing the above-mentioned method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely located relative to the processor 102, and these remote memories may be connected to the computer terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0025] The transmission device 106 is configured to receive or transmit data via a network. A specific example of the aforementioned network may include a wireless network provided by a computer terminal's communications provider. In one embodiment, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, the transmission device 106 may be a radio frequency (RF) module configured to communicate with the Internet wirelessly.

[0026] FIG2 is a flow chart of a method for aggregating alarms according to an embodiment of the present disclosure. As shown in FIG2 , the process includes the following steps:

[0027] Step S202: determining whether there is a correlation between the multiple alarms based on their alarm types;

[0028] The above alarm types are defined to measure the differences between different alarms and are unique. If alarms for different network devices or network element roles do not differ, the alarm type is a unique key value consisting of the corresponding alarm detection point code and alarm code. If alarms for different network devices or network element roles do differ, the alarm type is a unique key value consisting of the network element device type or role, alarm detection point code, and alarm code.

[0029] Step S204: if the multiple alarms are associated, determine the associated time windows of the multiple alarms;

[0030] Step S206 , determining whether to aggregate the multiple alarms based on whether the multiple alarms meet a time constraint condition, wherein the time constraint condition is used to indicate that a difference between alarm occurrence times of two alarms is less than the associated time window.

[0031] It can be understood that whether the multiple alarms meet the time constraint condition refers to whether the time difference between two alarms is less than the set alarm occurrence time window.

[0032] Through the above steps, it is determined whether there is a correlation between the multiple alarms based on their alarm types; in the case that there is a correlation between the multiple alarms, the correlation time window of the multiple alarms is determined; and based on whether the multiple alarms meet the time constraint conditions, it is determined whether to aggregate the multiple alarms, wherein the time constraint conditions are used to indicate that the difference in the alarm occurrence time of two alarms is less than the correlation time window. Through the present disclosure, the correlation relationship and the correlation time window between different alarm types are flexibly determined, and whether to aggregate is determined based on the correlation relationship and the correlation time window, which solves the problem of inaccurate alarm aggregation due to the fixed correlation time window in the prior art, thereby improving the alarm aggregation results and enhancing the accuracy of alarm aggregation.

[0033] Optionally, the above step S204 can be determined in the following manner: determine whether the multiple alarms meet the spatial constraint conditions, wherein the spatial constraint conditions are used to indicate: there are associated scenarios between the two alarms, and the associated scenarios include one of the following: the alarm locations are the same, the links corresponding to the alarms are the same, the service paths corresponding to the alarms are the same, and the root nodes of the resource nodes corresponding to the alarms are the same, and the resource nodes and the root nodes are nodes in the resource knowledge graph; when the multiple alarms meet the spatial constraint conditions, determine the associated scenarios corresponding to the multiple alarms; determine the associated time window based on the associated scenarios corresponding to the multiple alarms and the alarm types of the multiple alarms.

[0034] It is understood that the associated scenarios are scenarios that need to be mined based on business needs, and each scenario corresponds to a typical business application scenario. For example, in PTN and SPN networks, associated scenarios can be mined for the same alarm location, the link corresponding to the same alarm, the service path corresponding to the same alarm, and the root node of the resource node corresponding to the same alarm. Each associated scenario corresponds to an application scenario for fault alarm aggregation. Furthermore, associated scenarios can be expanded based on business needs.

[0035] It should be noted that whether multiple alarms meet the spatial constraint conditions refers to whether the resource nodes corresponding to the alarms are directly or indirectly connected in the resource knowledge graph, and there is a resource dependency or association relationship between one resource node and another resource node. For each associated scenario, there is a corresponding spatial constraint condition. For example, when the associated scenario is the same alarm location, the spatial constraint condition is the same alarm location; when it is a link corresponding to the same alarm, the alarms at the ports at both ends of the same link are deemed to meet the spatial constraint conditions; when it is the root node of the resource node corresponding to the same alarm, the root node of the alarm object is the same root node and is deemed to meet the spatial constraint conditions; when it is a business path corresponding to the same alarm, the alarm objects are all on the same business path and are deemed to meet the spatial constraint conditions.

[0036] Optionally, before determining the associated scenarios corresponding to the multiple alarms, it is necessary to construct a resource knowledge graph corresponding to the target network. The embodiment of the present disclosure constructs the resource knowledge graph in the following manner: determining the network element configuration and service configuration of the target network that generates the multiple alarms; constructing the resource knowledge graph based on the network element configuration and the service configuration, wherein the resource knowledge graph includes: resource nodes and edges, the resource nodes are used to indicate the network transmission resources in the target network, and the edges are used to indicate the dependencies of the network transmission resources.

[0037] That is to say, the above-mentioned resource knowledge graph refers to a knowledge graph constructed based on the corresponding network element configuration and business configuration in the target network. The knowledge graph reflects the various relationships between different resources and is composed of different nodes and edges. The resource knowledge graph has a variety of generation methods, for example: based on the network element configuration and business configuration data of the target network, the resource knowledge graph is automatically generated through a mapping script. When the resource nodes and relationships change, the corresponding resource knowledge graph can be updated synchronously, thereby ensuring the consistency of the configuration data of the target network of the resource knowledge graph. In specific implementation, the resource knowledge graph can be constructed, stored and applied using a graph database, including but not limited to the use of the following graph databases: OrientDB, Neo4j, etc.

[0038] For example, when the target network is a packet transport network (PTN), resource nodes include, but are not limited to, network elements, boards, ports, links, transmission management systems (TMS), tunnels, pseudowires, Layer 2 Virtual Private Networks (L2VPN), time division multiplexing (TDM), Layer 3 Virtual Private Networks (L3VPN), and Layer 3 Virtual Private Network peers (L3VPNPeer). Edges indicate one of the following: holds, belongedTrailTo, multiplex, memberOf, or topologyForm. When the target network is a service provider network (SPN), the resource nodes include but are not limited to 5G slices such as Flexible Ethernet Group (FlexEGroup), Flexible Ethernet Logical Signaling Channel (FlexELSP), Flexible Ethernet Channel (FlexEChannel), and Flexible Ethernet Ethernet Channel (FlexEEthCH); the edge is used to indicate one of the following: holds, belongedTrailTo, multiplex, memberOf, and topologyForm.

[0039] Optionally, the embodiment of the present disclosure determines whether to aggregate the multiple alarms in the following manner:

[0040] If the multiple alarms meet the time constraint conditions, determine whether the multiple alarms are located in the aggregation time window, and determine whether to aggregate the multiple alarms based on whether the multiple alarms are located in the aggregation time window; if the multiple alarms do not meet the time constraint conditions, aggregating the multiple alarms is prohibited.

[0041] Further, when the multiple alarms are located in the aggregation time window, it is determined that the multiple alarms are to be aggregated; when the multiple alarms are not located in the aggregation time window and the correlation between the multiple alarms is a strong correlation, it is determined that the multiple alarms are to be aggregated; when the multiple alarms are not located in the aggregation time window and the correlation between the multiple alarms is a weak correlation, it is prohibited to aggregate the multiple alarms.

[0042] In the disclosed embodiment, the support count for alarm types AB indicates the number of times alarm types A and B appear simultaneously. The support for alarm type AB indicates the ratio of the support counts for alarm types A and B to the total number of alarms. The confidence for alarm type AB indicates the ratio of the support counts for alarm types A and B to the total number of alarms for type A.

[0043] It is understood that the correlation relationship refers to the correlation between the generation of alarms. According to the size of support and confidence, the correlation relationship includes: strong correlation relationship, weak correlation relationship, no correlation relationship and island alarm.

[0044] (1) Strong correlation: refers to the alarm correlation relationship between alarms with a confidence level greater than or equal to a set threshold (default 5%) and a support level greater than or equal to a set threshold (default 0.005%).

[0045] (2) Weak correlation: refers to the existence of correlation between alarms, but the confidence or support is lower than the set threshold.

[0046] (3) No correlation: This means that there is no correlation data support between the alarms, the confidence is 0, and the support count is 0.

[0047] (4) Island alarm: refers to an alarm that is not associated with any other alarm and the number of associations is 0.

[0048] It is understandable that if there is a strong correlation between two alarms, and the difference in the alarm occurrence time is within the correlation time window and the aggregation time window, the two alarms will be aggregated into one fault; if a fault has been generated, and the difference in the alarm occurrence time is within the aggregation time window, the later generated alarm will be updated to the generated fault, and a fault message will be sent to notify the fault analysis and processing. If there is a weak correlation between two alarms, and the difference in the alarm occurrence time is within the correlation time window and the aggregation time window, the two alarms will be aggregated into one fault. If a fault has been generated, the aggregation of the multiple alarms is prohibited, and the generated fault will no longer be updated. If it is found that there is no correlation between the two alarms, the two alarms will not be aggregated into one fault; if it is found that an alarm is an island alarm, a separate fault will be generated.

[0049] Optionally, after executing step S206, it also includes: determining the alarm propagation relationship corresponding to the multiple alarms; determining the root cause alarms and derivative alarms corresponding to the multiple alarms based on the alarm propagation relationship corresponding to the multiple alarms, wherein the derivative alarms are used to indicate the alarms generated due to the root cause alarms.

[0050] It should be noted that the alarm propagation relationship corresponding to the multiple alarms is determined based on the resource hierarchy relationship, and the propagation relationship is propagated from low to high levels. For alarms at the same level, the alarm propagation relationship is mainly determined based on the chronological order of the alarms. In principle, the alarm that occurs first is usually the root cause alarm.

[0051] In an exemplary embodiment, determining the alarm propagation relationship corresponding to the multiple alarms includes: determining the correspondence between the alarm type and the alarm propagation relationship; and determining the alarm propagation relationship corresponding to the multiple alarms based on the correspondence, wherein the correspondence is determined based on historical alarm information.

[0052] The embodiment of the present disclosure mines historical alarms to determine the alarm relationship between different alarm types. Specifically: an alarm relationship mining task is configured, wherein the task parameters of the alarm relationship mining task include one of the following: basic task parameters, alarm parameters and algorithm parameters; the alarm relationship mining results of the historical alarms are determined according to the alarm relationship mining task, wherein the alarm relationship mining results include: alarm correlation information and alarm propagation relationship.

[0053] The alarm propagation relationship between the above multiple alarm types includes but is not limited to: root alarm type, root alarm number, derived alarm type, derived alarm number, support count, support, confidence, correlation degree, resource hierarchy relationship, alarm time sequence, etc.

[0054] The alarm correlation information between the above multiple alarm types includes but is not limited to: associated scenarios, alarm types, alarm times, associated alarm types, associated alarm times, support count, support, confidence, correlation degree, and associated time window (including minimum and maximum values).

[0055] After determining the alarm relationship mining results for historical alarms according to the alarm relationship mining task, the process further includes: displaying alarm correlation information and alarm propagation relationships in a list format, while allowing users to modify the mined alarm correlation relationships. For example, users can modify the mined alarm correlation relationships to no correlation, modify weak correlations to strong correlations, or modify strong correlations to weak correlations.

[0056] Optionally, the alarm correlation information of historical alarms is determined according to the alarm relationship mining task, including: determining the confidence and support between the alarm types of historical alarms; when the confidence is greater than or equal to a first preset threshold, and the support is greater than or equal to a second preset threshold, determining that the historical alarms have a strong correlation relationship; when the confidence is less than the first preset threshold and greater than a third preset threshold, and / or the support is less than the second preset threshold and greater than the third preset threshold, determining that the historical alarms have a weak correlation relationship; when the confidence is equal to the third preset threshold, and / or the support is equal to the third preset threshold, determining that the historical alarms do not have a correlation relationship.

[0057] For example, the first preset threshold is preset to 5%, the second preset threshold is preset to 0.05%, and the third preset threshold is preset to 0.0005%. When the confidence level is greater than or equal to 5% and the support level is greater than or equal to 0.05%, it is determined that the historical alarms have a strong correlation; when the confidence level is less than 5% and greater than 0.0005%, and / or the support level is less than 0.05% and greater than 0.0005%, it is determined that the historical alarms have a weak correlation; when the confidence level is equal to 0.0005%, and / or the support level is equal to 0.0005%, it is determined that there is no correlation between the alarm types.

[0058] Optionally, the alarm propagation relationship of the historical alarm is determined according to the alarm relationship mining task, including: determining the first resource node corresponding to the historical alarm, and determining the resource hierarchical relationship of the first resource node in the resource indication map; determining the alarm propagation relationship of the historical alarm according to the resource hierarchical relationship.

[0059] The above resource hierarchical relationships include: low level -> high level, same level, and high level -> low level.

[0060] Optionally, the alarm propagation relationship of the historical alarm is determined according to the resource hierarchy relationship, including: when the resource hierarchy relationship indicates that the second resource node is a low-level resource node and the third resource node is a high-level resource node, the first alarm propagation relationship of the historical alarm is determined, wherein the first alarm propagation relationship indicates that the alarm corresponding to the second resource node is a root cause alarm, and the alarm corresponding to the third resource node is a derivative alarm, and the first resource node includes: the second resource node and the third resource node; when the resource hierarchy relationship indicates that the first resource node is a resource node at the same level, the alarm occurrence time of the historical alarm is determined, and the second alarm propagation relationship of the historical alarm is determined according to the alarm occurrence time, wherein the second alarm propagation relationship indicates that the alarm corresponding to the first alarm occurrence time is a root cause alarm, and the alarm corresponding to the second alarm occurrence time is a derivative alarm, and the first alarm occurrence time is earlier than the second alarm occurrence time.

[0061] It is understandable that all alarms except the root alarm are derived alarms.

[0062] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present disclosure, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory / random access memory (ROM / RAM), a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present disclosure.

[0063] In order to better understand the process of the above-mentioned alarm aggregation method, the implementation process of the above-mentioned running time determination method is described below in combination with an optional embodiment, but it is not used to limit the technical solution of the embodiment of the present disclosure.

[0064] To facilitate understanding of the technical solutions provided by the present disclosure, embodiments of specific scenarios will be described in detail below.

[0065] Figure 3 is a structural diagram of the alarm relationship mining system according to an embodiment of the present disclosure. The system includes two major parts: an alarm relationship mining front-end user interface (UI) module and an alarm relationship mining background service module. Among them, the alarm relationship mining front-end UI module is responsible for providing the user interface. The alarm relationship mining front-end UI module specifically includes: an alarm relationship mining task management component, an island alarm display and confirmation component, and an alarm relationship display and modification component; the alarm relationship mining background service module is responsible for executing the alarm relationship mining task and outputting the alarm relationship mining results according to the configured tasks and algorithm parameters. The alarm relationship mining background service module specifically includes an alarm relationship query and modification component, an alarm relationship mining task processing component, a historical alarm query component, an alarm noise reduction component, an alarm relationship mining backfill component, and an alarm association statistics mining component.

[0066] (1) Alarm relationship mining task management component, which is set to provide functions such as creating, deleting and modifying alarm relationship mining tasks, configuring task parameters, and viewing task execution results. The task parameters of the alarm relationship mining task include: basic parameters, alarm parameters and algorithm parameters. Among them, the basic parameters include: task name (task name is unique and cannot be repeated), enablement status (enabled by default), task cycle (daily, weekly, default daily), planned execution time (default 1:05), task description, etc.; alarm parameters include: alarm occurrence time window (default 15 minutes), alarm disappearance time window (default 1 minute) and associated scenarios (including the same location, same link, same root node, same service path, time clock adjacent network elements, etc., which can be expanded according to business needs, default all); algorithm parameters include: support threshold (default 0.005%), confidence threshold (default 5%).

[0067] (2) The island alarm display and confirmation component is configured to list the island alarms found by alarm relationship mining and provide an operation option for the user to confirm whether to take effect. If it is determined to be an island alarm, the fault alarm will no longer be aggregated with other alarms when it is aggregated, and a major fault event will be directly generated.

[0068] (3) The alarm relationship display and modification component is set to present the mined alarm association relationship and alarm propagation relationship in a list format, and allows users to modify it. For the mined alarm association relationship, users can modify it to no association, or modify weak association to strong association, or modify strong association to weak association. Different alarm aggregation strategies will be adopted for different degrees of association. For the mined alarm propagation relationship, users can confirm whether it is effective. By default, it is not effective. It will only take effect after the user confirms it.

[0069] (4) Alarm relationship query and modification component, which is configured to respond to alarm relationship query and modification commands issued by the front end, query the database based on the command requirements, feedback the island alarm statistics, alarm correlation relationship and alarm propagation relationship, and modify it according to the user, and update the saved database based on the modified island alarm information, alarm correlation relationship and alarm propagation relationship.

[0070] (5) The alarm relationship mining task processing component is configured to execute the alarm relationship mining task according to the configured task parameters of the alarm relationship mining task and record the task execution results. It responds to the task configuration commands sent by the front end (including creating new tasks, modifying tasks, and deleting tasks), and updates the task configuration information and saves it persistently, such as saving it to a database. It responds to the commands sent by the front end to view task configuration, view task execution status, and view task execution history, and feedbacks the specific task configuration, task execution status, and task execution history information.

[0071] (6) A historical alarm query component is configured to query historical alarms according to query conditions, including querying alarms in a specified time period by alarm occurrence time, querying alarms in a specified time period by alarm disappearance time, sorting by alarm occurrence time, and sorting by alarm disappearance time.

[0072] (7) Alarm noise reduction component, which is configured to filter out noise alarms, such as flash alarms and oscillation alarms. This is because these alarms can interfere with the correct alarm correlation results. Flash alarms are defined as alarms whose duration is less than a set threshold, the default threshold being 1 minute. Oscillation alarms are alarms of the same type at the same location that recur repeatedly within a specified time period.

[0073] (8) The alarm relationship mining and backfilling component is responsible for backfilling the information required for alarm association into the alarm details in advance, so as to quickly determine whether there is a spatial resource dependency or association relationship between two alarms. The information that needs to be backfilled includes: the resource knowledge graph node information corresponding to the alarm, the upper-level business nodes affected by the alarm, the links affected by the alarm, the root node to which the alarm belongs, etc. The backfilled information is determined by the association scenario that needs to be mined.

[0074] (9) Alarm association statistical mining component, which is configured to statistically mine alarm association relationships, association time windows, and alarm propagation relationships based on the alarm association relationship mining algorithm and alarm propagation relationship judgment rules.

[0075] The PTN network is a packet transport network based on the Multiprotocol Label Switching-Transport Profile (MPLS-TP), providing Layer 2 Ethernet services, TDM services, etc. In the scenario where alarm relationship mining is performed on the PTN network to improve fault aggregation and fault analysis, an embodiment of the present disclosure provides a method for mining alarm relationships on the PTN network, which specifically includes the following steps:

[0076] Step 1: Build a resource knowledge graph based on the existing network element configuration and service configuration data corresponding to the PTN network.

[0077] Among them, the knowledge graph contains different types of nodes and edges. Different types of nodes represent different resources, and different types of edges represent the relationship between different resource nodes. For the PTN network, there are resource nodes of types such as network elements, boards, ports, links, TMS, tunnels, pseudo-wires, L2VPN, TDM, L3VPN, L3VPNPeer, and edges of types such as holds, belongedTrailTo, multiplex (multiplexing), memberOf, topologyForm, etc. As shown in Figure 4, it is a schematic diagram of the schema corresponding to a resource knowledge graph according to an embodiment of the present disclosure. The resource knowledge graph is automatically generated through a mapping script based on the existing network element configuration and service configuration data. When the resource nodes and relationships change, the corresponding resource knowledge graph will be updated synchronously to ensure the consistency of the resource knowledge graph with the existing network configuration data. In specific implementation, the resource knowledge graph is usually constructed, stored and applied using a graph database, including but not limited to the following graph databases, such as OrientDB, Neo4j, etc.

[0078] Step 2: Create a new alarm relationship mining task based on the business application scenario and configure related task parameters, including basic task parameters, alarm parameters, and algorithm parameters. Basic parameters include task name (task name is unique and cannot be repeated), enablement status (enabled by default), task cycle (daily, weekly, default is daily), scheduled execution time (default is 1:05 am the next day), task description, etc.; alarm parameters include alarm occurrence time window (default is 15 minutes), alarm disappearance time window (default is 1 minute), and associated scenarios (including same location, same link, same root node, same service path, time clock adjacent network elements, etc., which can be expanded according to business needs, default is all); algorithm parameters include support threshold (default is 0.005%) and confidence threshold (default is 5%).

[0079] Step 3: Based on the configured alarm relationship mining task, the alarm relationship mining task is executed regularly, and the alarm relationship mining results are output. The alarm relationship mining results include: alarm statistics, alarm correlation information, and alarm propagation relationship. Among them, the alarm statistics include alarm type, alarm number, total alarm number, alarm proportion (%), and whether it is an isolated alarm; the alarm correlation information includes the associated scenario, alarm type, alarm number, associated alarm type, associated alarm number, support count, support, confidence, correlation degree, and associated time window (including minimum and maximum values); the alarm propagation relationship includes the root alarm type, root alarm number, derived alarm type, derived alarm number, support count, support, confidence, correlation degree, resource hierarchy relationship, alarm time sequence, etc. The specific steps are as follows:

[0080] Step 31: Divide the time period for mining alarms into small time periods for cyclic processing and statistics.

[0081] For example, if the processing cycle is one day, it can be divided into 24 hourly time periods for separate processing and statistics. This is because directly querying the data volume for one day is too large, and the associated statistical process will occupy too much memory resources. Therefore, dividing the query and processing into hourly periods can save memory resources.

[0082] Step 32: Query the historical alarm data generated within the specified time period and sort them in descending order according to the alarm occurrence time.

[0083] It should be noted that, in order to avoid missing statistical data, each time the alarm occurrence time is queried, the data of one more alarm occurrence time window is queried.

[0084] Step 33: Perform alarm noise reduction processing on the historical alarm data that occurred during the time period.

[0085] Alarm noise reduction includes filtering out flash alarms. Flash alarms refer to alarm durations, that is, the difference between the alarm disappearance time and the alarm occurrence time is less than the set threshold. The default threshold is 1 minute.

[0086] Step 34: Perform alarm relationship mining and backfilling processing on the alarm data generated within the time period after noise reduction.

[0087] It should be noted that backfilling is to obtain in advance the relevant information for judging the spatial constraints of various associated scenarios and add it to the detailed information of the alarm. The purpose is to speed up the judgment process of whether the spatial constraints are met during the alarm correlation statistics. The specific information that needs to be backfilled depends on the associated scenarios that need to be mined and the specific network type. For example: for bearer networks such as PTN and SPN, the information that needs to be backfilled includes the resource node information corresponding to the alarm, the business information affected by the alarm, the link information affected by the alarm, the root node information of the resource node corresponding to the alarm, etc., which can be expanded according to the needs of the associated scenarios.

[0088] Step 35: Perform cyclic correlation statistical processing on the backfilled alarm data in the order of the alarm occurrence time, count and record the number of times each alarm type occurs, find the associated alarms that meet both the time and space constraints, count and record the support count, as well as the alarm correlation time window (including maximum and minimum values), resource hierarchy relationship and alarm time sequence.

[0089] It should be noted that the support count is different from the association count. The association count is the number of times alarm types A and B meet both the time and space constraints, while the support count refers to the number of times alarm type A occurs when both alarm types A and B meet both the time and space constraints. Typically, the support count is less than or equal to the association count.

[0090] Step 36: Query the historical alarm data that disappeared within the specified time period, and sort them in descending order according to the alarm disappearance time.

[0091] To avoid missing statistical data, each time you query by alarm disappearance time, query data for one more alarm disappearance time window.

[0092] Step 37: Perform alarm noise reduction processing on the historical alarm data that disappeared within the time period.

[0093] Alarm noise reduction includes filtering out flash alarms. Flash alarms refer to alarm durations, that is, the difference between the alarm disappearance time and the alarm occurrence time is less than the set threshold. The default threshold is 1 minute.

[0094] Step 38: Perform alarm relationship mining and backfilling processing on the alarm data that disappears within the time period after noise reduction.

[0095] The specific information that needs to be backfilled is the same as the historical alarms queried by alarm occurrence time. In actual implementation, each backfilled alarm processed by alarm occurrence time can be cached to avoid repeated backfill processing and improve processing performance.

[0096] Step 39: Perform cyclic correlation statistical processing on the backfilled alarm data in the order of alarm disappearance time, count and record the number of times each alarm type occurs, find the associated alarms that meet both the time and space constraints, count and record the support count, as well as the alarm correlation time window (including maximum and minimum values), resource hierarchy relationship and alarm time sequence.

[0097] It should be noted that deduplication is required during statistics. Alarms and related alarms that have been processed according to the alarm occurrence time need to be deleted during statistics to avoid repeated statistics.

[0098] Step 310: Repeat steps 32 to 39 to complete the statistics of all historical alarms within the statistical period.

[0099] Step 311: Output the alarm relationship mining result.

[0100] The alarm relationship mining results include: all alarm statistics, alarm correlation information, and alarm propagation relationships. It should be noted that if an alarm is not associated with any alarm, it is determined to be an isolated alarm, which is reflected in the alarm statistics. The support of alarm type AB = the support count of alarm type AB / the number of all alarms. The confidence of alarm type AB = the support of alarm type AB = the support count of alarm type AB / the number of alarm type A. According to the size of the support and confidence, the correlation relationship is further divided into strong correlation, weak correlation, and no correlation according to the degree of correlation. Priority is given to judgment based on the resource hierarchy relationship, and the propagation relationship is propagated from the low level to the high level. For alarms at the same level, the alarm propagation relationship is mainly determined based on the chronological order of the alarm occurrence. In principle, the first alarm to occur is usually the root alarm.

[0101] Step 4: Present the island alarm information, alarm correlation information, and alarm propagation relationship to the user through the interface.

[0102] Isolation alarms require user confirmation before they take effect. For alarm correlation information, the correlation level is automatically output based on the set threshold. If the user believes the correlation level is inaccurate, they can manually modify it. The modified result is subject to the manual confirmation. Discovered alarm propagation relationships are not effective by default and require user confirmation before they take effect.

[0103] Step 5: When performing alarm aggregation, the association relationship between alarms and the corresponding association time window can be mined to determine whether to aggregate the alarms into a single fault, thereby avoiding the problem of insufficient or excessive aggregation of alarms caused by using a fixed aggregation time window. Specifically, the following situations will be handled when aggregating fault data:

[0104] 1) If two alarms are strongly correlated, and the time difference between the alarms is within the correlation time window, and the fault is within the aggregation window, the two alarms are aggregated into a single fault. If a fault has already been generated, but the time difference between the alarms is within the aggregation window, the later alarm is updated to the generated fault, and a fault message is sent to notify the fault analysis and processing. If they are not within the corresponding correlation time window, a different fault is generated;

[0105] 2) If there is a weak correlation between two alarms, and the difference in alarm occurrence time is within the correlation time window, and the fault is within the aggregation window, the two alarms are aggregated into one fault. If a fault has already been generated, the later alarm is not updated to the generated fault, and a different fault is generated;

[0106] 3) If it is found that there is no correlation between the two alarms, the two alarms are not aggregated into one fault;

[0107] 4) If an alarm is found to be an isolated alarm, a separate fault will be generated.

[0108] Step 6: When identifying the root alarm, you can use the alarm propagation relationship to make a judgment based on the relationship between the root alarm and the derived alarms to correctly identify the root alarm.

[0109] SPN slicing packet network is a key technology in 5G network slicing. Currently, China Mobile adopts SPN technology as the technology for 5G bearer transmission network. Another embodiment of the present disclosure is to conduct alarm relationship mining for SPN networks for improving fault aggregation and fault analysis scenarios, and provides a method for alarm relationship mining for SPN networks. Based on the technical solution provided by the embodiment of the present disclosure, alarm relationship mining for SPN networks is implemented. The specific technical solution is similar to the alarm relationship mining solution for the above-mentioned PTN network. The main difference is that the resource knowledge graph constructed is different. The SPN network has nodes of 5G slicing-related resource types such as FlexEGroup, FlexELSP, FlexEChannel, and FlexEEthCH. Figure 5 is a schematic diagram of the resource knowledge graph schema corresponding to an SPN network according to an embodiment of the present disclosure.

[0110] It is understandable that the disclosed embodiment fully utilizes the characteristic that alarms caused by the same fault in the network occur and disappear at similar times, and the mined alarm correlation relationships are richer and cover more comprehensive alarm types; not only can the alarm correlation relationships be mined, but also the alarm correlation time windows can be mined. Applying the mined alarm correlation relationships and correlation time windows to alarm aggregation avoids the problems of using fixed aggregation time windows, greatly improves the alarm aggregation results, and enhances the accuracy of fault aggregation; based on the mined alarm correlation relationships, the alarm propagation relationships are further mined. Applying the mined alarm propagation relationships to root alarm analysis improves the accuracy of root alarm identification.

[0111] This embodiment also provides an alarm aggregation device for implementing the above-mentioned embodiments and preferred implementations. Details already described will not be repeated. As used below, the term "module" may refer to a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation using hardware, or a combination of software and hardware, is also possible and contemplated.

[0112] FIG6 is a structural block diagram of an alarm aggregation device according to an embodiment of the present disclosure. As shown in FIG6 , the device includes:

[0113] A first determining module 62 is configured to determine whether there is a correlation between the multiple alarms according to their alarm types;

[0114] A second determining module 64 is configured to determine a correlation time window of the multiple alarms if the multiple alarms are correlated;

[0115] The third determination module 66 is configured to determine whether to aggregate the multiple alarms based on whether the multiple alarms meet a time constraint condition, wherein the time constraint condition is used to indicate that the difference between the alarm occurrence times of two alarms is less than the associated time window.

[0116] Through the above-mentioned device, it is determined whether there is a correlation relationship among the multiple alarms based on their alarm types; if there is a correlation relationship among the multiple alarms, the correlation time window of the multiple alarms is determined; and it is determined whether to aggregate the multiple alarms based on whether the multiple alarms meet the time constraint condition, wherein the time constraint condition is used to indicate that the difference between the alarm occurrence times of two alarms is less than the correlation time window. Through the present disclosure, the problem of inaccurate alarm aggregation due to the fixed correlation time window in the prior art is solved, thereby achieving the effect of flexibly determining the correlation relationship and correlation time window between different alarm types, and determining whether to aggregate based on the correlation relationship and correlation time window.

[0117] In an exemplary embodiment, the second determination module is further configured to: determine whether the multiple alarms meet the spatial constraint conditions, wherein the spatial constraint conditions are used to indicate: there are associated scenarios between the two alarms, and the associated scenarios include one of the following: the alarm locations are the same, the links corresponding to the alarms are the same, the service paths corresponding to the alarms are the same, and the root nodes of the resource nodes corresponding to the alarms are the same, and the resource nodes and the root nodes are nodes in the resource knowledge graph; when the multiple alarms meet the spatial constraint conditions, determine the associated scenarios corresponding to the multiple alarms; and determine the associated time window based on the associated scenarios corresponding to the multiple alarms and the alarm types of the multiple alarms.

[0118] In an exemplary embodiment, the device also includes: a fourth determination module, which determines the network element configuration and service configuration of the target network that generates the multiple alarms; and constructs the resource knowledge graph based on the network element configuration and the service configuration, wherein the resource knowledge graph includes: resource nodes and edges, the resource nodes are used to indicate the network transmission resources in the target network, and the edges are used to indicate the dependency relationships of the network transmission resources.

[0119] In an exemplary embodiment, the third determination module is further configured to: determine whether the multiple alarms are located in the aggregation time window when the multiple alarms meet the time constraint conditions, and determine whether to aggregate the multiple alarms based on whether the multiple alarms are located in the aggregation time window; and prohibit aggregating the multiple alarms when the multiple alarms do not meet the time constraint conditions.

[0120] In an exemplary embodiment, the third determination module further includes: a fifth determination module, which determines to aggregate the multiple alarms when the multiple alarms are located in the aggregation time window; determines to aggregate the multiple alarms when the multiple alarms are not located in the aggregation time window and the correlation relationship between the multiple alarms is a strong correlation relationship; and prohibits aggregating the multiple alarms when the multiple alarms are not located in the aggregation time window and the correlation relationship between the multiple alarms is a weak correlation relationship.

[0121] In an exemplary embodiment, the third determination module is further configured to: determine the alarm propagation relationship corresponding to the multiple alarms; determine the root cause alarms and derivative alarms corresponding to the multiple alarms based on the alarm propagation relationship corresponding to the multiple alarms, wherein the derivative alarms are used to indicate alarms generated due to the root cause alarms.

[0122] In an exemplary embodiment, the device also includes: a configuration module, configuring an alarm relationship mining task, wherein the task parameters of the alarm relationship mining task include one of the following: basic task parameters, alarm parameters and algorithm parameters; determining the alarm relationship mining results of historical alarms based on the alarm relationship mining task, wherein the alarm relationship mining results include: alarm correlation information and alarm propagation relationship.

[0123] In an exemplary embodiment, the configuration module also includes: a sixth determination module, which determines the confidence and support between the alarm types of historical alarms; when the confidence is greater than or equal to the first preset threshold, and the support is greater than or equal to the second preset threshold, it is determined that the historical alarms have a strong correlation relationship; when the confidence is less than the first preset threshold and greater than the third preset threshold, and / or the support is less than the second preset threshold and greater than the third preset threshold, it is determined that the historical alarms have a weak correlation relationship; when the confidence is equal to the third preset threshold, and / or the support is equal to the third preset threshold, it is determined that the historical alarms do not have a correlation relationship.

[0124] In an exemplary embodiment, the configuration module also includes: a seventh determination module, which determines the first resource node corresponding to the historical alarm, and determines the resource hierarchical relationship of the first resource node in the resource indication map; and determines the alarm propagation relationship of the historical alarm based on the resource hierarchical relationship.

[0125] In an exemplary embodiment, the seventh determination module is further configured to: when the resource hierarchy relationship indicates that the second resource node is a low-level resource node and the third resource node is a high-level resource node, determine the first alarm propagation relationship of the historical alarm, wherein the first alarm propagation relationship indicates that the alarm corresponding to the second resource node is a root cause alarm, and the alarm corresponding to the third resource node is a derivative alarm, and the first resource node includes: the second resource node and the third resource node; when the resource hierarchy relationship indicates that the first resource node is a resource node at the same level, determine the alarm occurrence time of the historical alarm, and determine the second alarm propagation relationship of the historical alarm based on the alarm occurrence time, wherein the second alarm propagation relationship indicates that the alarm corresponding to the first alarm occurrence time is a root cause alarm, and the alarm corresponding to the second alarm occurrence time is a derivative alarm, and the first alarm occurrence time is earlier than the second alarm occurrence time.

[0126] It should be noted that the above modules can be implemented through software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0127] An embodiment of the present disclosure further provides a computer-readable storage medium, in which a computer program is stored. The computer program is configured to execute the steps of any one of the above method embodiments when run.

[0128] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0129] An embodiment of the present disclosure further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0130] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0131] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail here.

[0132] Obviously, those skilled in the art should understand that the modules or steps of the present disclosure described above can be implemented using a general-purpose computing device, they can be concentrated on a single computing device, or distributed across a network composed of multiple computing devices, they can be implemented using program code executable by the computing device, and thus, they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be performed in a different order than herein, or they can be fabricated into separate integrated circuit modules, or multiple modules or steps can be fabricated into a single integrated circuit module for implementation. Thus, the present disclosure is not limited to any particular combination of hardware and software.

[0133] The foregoing description is merely a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. Those skilled in the art will readily appreciate that various modifications and variations of the present disclosure are possible. Any modifications, equivalent substitutions, or improvements made within the principles of the present disclosure shall be included within the scope of protection of the present disclosure.

Claims

1. A method for aggregating alarms, comprising: Determining whether there is a correlation relationship among the multiple alarms according to the alarm types of the multiple alarms; In the case where the multiple alarms are associated with each other, determining the associated time windows of the multiple alarms; Whether to aggregate the multiple alarms is determined according to whether the multiple alarms meet a time constraint condition, wherein the time constraint condition is used to indicate that a difference in alarm occurrence time between two alarms is less than the associated time window.

2. The method according to claim 1, wherein: Determining the associated time windows of the multiple alarms includes: Determine whether the multiple alarms meet the spatial constraint condition, wherein the spatial constraint condition is used to indicate that: there is an associated scenario between the two alarms, and the associated scenario includes one of the following: the alarm locations are the same, the links corresponding to the alarms are the same, the service paths corresponding to the alarms are the same, and the root nodes of the resource nodes corresponding to the alarms are the same, and the resource nodes and the root node are nodes in the resource knowledge graph; In the case where the multiple alarms meet the spatial constraint condition, determining associated scenarios corresponding to the multiple alarms; The associated time window is determined according to the associated scenarios corresponding to the multiple alarms and the alarm types of the multiple alarms.

3. The method according to claim 2, wherein: Before determining the associated scenarios corresponding to the multiple alarms, the method further includes: Determining a network element configuration and a service configuration of a target network generating the plurality of alarms; The resource knowledge graph is constructed according to the network element configuration and the service configuration, wherein the resource knowledge graph includes: resource nodes and edges, the resource nodes are used to indicate the network transmission resources in the target network, and the edges are used to indicate the dependencies of the network transmission resources.

4. The method according to claim 1, wherein: Determining whether to aggregate the multiple alarms according to whether the multiple alarms meet the time constraint condition includes: If the multiple alarms meet the time constraint condition, determine whether the multiple alarms are located in an aggregation time window, and determine whether to aggregate the multiple alarms according to whether the multiple alarms are located in the aggregation time window; If the multiple alarms do not meet the time constraint condition, aggregating the multiple alarms is prohibited.

5. The method according to claim 4, wherein: Determining whether to aggregate the multiple alarms according to whether the multiple alarms are located in the aggregation time window includes: In a case where the multiple alarms are located in the aggregation time window, determining to aggregate the multiple alarms; When the multiple alarms are not located in the aggregation time window and the correlation relationship between the multiple alarms is a strong correlation relationship, determine to aggregate the multiple alarms; When the multiple alarms are not located in the aggregation time window and the association relationship between the multiple alarms is a weak association relationship, aggregating the multiple alarms is prohibited.

6. The method according to claim 1, wherein: After determining whether to aggregate the multiple alarms according to whether the multiple alarms meet the time constraint condition, the method further includes: Determining an alarm propagation relationship corresponding to the multiple alarms; The root cause alarms and derived alarms corresponding to the multiple alarms are determined according to the alarm propagation relationships corresponding to the multiple alarms, wherein the derived alarms are used to indicate alarms generated due to the root cause alarms.

7. The method according to claim 1, wherein: Before determining whether the multiple alarms have a correlation relationship according to the alarm types of the multiple alarms, the method further includes: Configuring an alarm relationship mining task, wherein the task parameters of the alarm relationship mining task include one of the following: basic task parameters, alarm parameters, and algorithm parameters; The alarm relationship mining result of the historical alarms is determined according to the alarm relationship mining task, wherein the alarm relationship mining result includes: alarm correlation information and alarm propagation relationship.

8. The method according to claim 7, wherein: Determining alarm correlation information of historical alarms according to the alarm relationship mining task includes: Determine the confidence and support between alarm types of historical alarms; When the confidence is greater than or equal to a first preset threshold, and the support is greater than or equal to a second preset threshold, determining that the historical alarms have a strong correlation relationship; When the confidence is less than the first preset threshold and greater than the third preset threshold, and / or the support is less than the second preset threshold and greater than the third preset threshold, it is determined that the historical alarms have a weak correlation relationship; When the confidence is equal to the third preset threshold, and / or the support is equal to the third preset threshold, it is determined that there is no association relationship between the historical alarms.

9. The method according to claim 7, wherein: Determining the alarm propagation relationship of the historical alarms according to the alarm relationship mining task includes: Determine a first resource node corresponding to the historical alarm, and determine a resource hierarchy relationship of the first resource node in a resource indication map; The alarm propagation relationship of the historical alarm is determined according to the resource hierarchical relationship.

10. The method according to claim 9, wherein: Determining the alarm propagation relationship of the historical alarm according to the resource hierarchical relationship includes: In the case where the resource hierarchy relationship indicates that the second resource node is a low-level resource node and the third resource node is a high-level resource node, determining a first alarm propagation relationship of the historical alarm, wherein the first alarm propagation relationship indicates that the alarm corresponding to the second resource node is a root cause alarm, and the alarm corresponding to the third resource node is a derivative alarm, and the first resource node includes: the second resource node and the third resource node; In the case where the resource hierarchy relationship indicates that the first resource node is a resource node at the same level, the alarm occurrence time of the historical alarm is determined, and the second alarm propagation relationship of the historical alarm is determined according to the alarm occurrence time, wherein the second alarm propagation relationship indicates that the alarm corresponding to the first alarm occurrence time is the root cause alarm, and the second alarm occurrence time is the root cause alarm. The alarm corresponding to the time is a derived alarm, and the occurrence time of the first alarm is earlier than the occurrence time of the second alarm.

11. An alarm aggregation device, comprising: A first determination module is configured to determine whether there is a correlation relationship between the multiple alarms according to the alarm types of the multiple alarms; A second determination module is configured to determine a correlation time window of the multiple alarms when the multiple alarms are correlated; The third determination module is configured to determine whether to aggregate the multiple alarms according to whether the multiple alarms meet a time constraint condition, wherein the time constraint condition is used to indicate that a difference in alarm occurrence time between two alarms is less than the associated time window.

12. A computer-readable storage medium having a computer program stored therein, wherein: When the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 10 are implemented.

13. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method described in any one of claims 1 to 10 when executing the computer program.

Images