Fault diagnosis method, electronic device, and storage medium

Abstract

The present application relates to, but is not limited to, the technical field of communications. Provided are a fault diagnosis method, an electronic device, and a storage medium. The fault diagnosis method comprises: constructing an operation and maintenance knowledge graph based on a fault mode; acquiring root cause alarms of a fault, and by means of the operation and maintenance knowledge graph, determining target fault modes corresponding to the root cause alarms; performing root cause diagnosis on the basis of the target fault modes, so as to obtain fault root causes corresponding to the root cause alarms; and then, performing fusion processing on the fault root causes corresponding to the root cause alarms, so as to obtain a target fault root cause. In the solutions in the embodiments of the present application, an operation and maintenance knowledge graph based on a fault mode is constructed, and target fault modes corresponding to root cause alarms of a fault can be determined using the operation and maintenance knowledge graph, and root cause diagnosis is then performed on the basis of the target fault modes, so as to obtain fault root causes. On the basis of the solutions in the embodiments of the present application, the fault diagnosis efficiency and the automation of intelligent operation and maintenance can be greatly improved.

Description

Fault diagnosis method, electronic device and storage medium

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application is based on the Chinese patent application with application number 202311370835.1 and application date October 20, 2023, and claims the priority of the Chinese patent application. The entire content of the Chinese patent application is hereby introduced into this application as a reference. Technical Field

[0003] The embodiments of the present application relate to the field of communication technology, and in particular to a fault diagnosis method, electronic device, and storage medium. Background Art

[0004] With the development of intelligent telecommunications network monitoring technology, the focus of network monitoring is shifting from alarms to faults. This is known as intelligent fault systems. When a network fault occurs, the system first aggregates the numerous alarms generated by the fault to generate a fault alarm. It then infers the root cause of the fault from these fault alarms and only addresses the root cause alarm, significantly reducing the number of dispatches. However, the same alarm may have multiple causes, and root cause alarms alone often cannot directly reveal the root cause. Network analysis is still required, and the efficiency of root cause location is heavily dependent on the operator's experience. Therefore, simply aggregating alarms into faults and recommending root cause alarms does not achieve comprehensive intelligent network operations and maintenance.

[0005] Summary of the Invention

[0006] The embodiments of the present application provide a fault diagnosis method, electronic device, and storage medium, which can quickly locate the root cause of the fault corresponding to the root cause alarm and improve the intelligence of network operation and maintenance.

[0007] In a first aspect, an embodiment of the present application provides a fault diagnosis method, including: constructing an operation and maintenance knowledge graph based on a fault mode; obtaining at least one root cause alarm corresponding to the fault, and determining a target fault mode corresponding to each of the root cause alarms through the operation and maintenance knowledge graph; for each of the root cause alarms, performing a root cause diagnosis according to the target fault mode corresponding to the root cause alarm to obtain the root cause of the fault corresponding to the root cause alarm; and performing a fusion process on the root causes of the faults corresponding to each of the root cause alarms to obtain the target root cause of the fault.

[0008] In a second aspect, an embodiment of the present application provides an electronic device comprising: one or more processors; a memory on which one or more programs are stored, and when the one or more programs are executed by the one or more processors, the one or more processors implement the fault diagnosis method described in the first aspect above.

[0009] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the fault diagnosis method as described in the first aspect above.

[0010] The fault diagnosis method, electronic device, and storage medium provided in the embodiments of the present application first construct an operation and maintenance knowledge graph based on fault modes. Using this operation and maintenance knowledge graph, the target fault mode corresponding to the root cause alarm of the fault can be determined. Root cause diagnosis is then performed based on the target fault mode to obtain the root cause of the fault corresponding to the root cause alarm. Furthermore, the root causes corresponding to the root cause alarms are fused to obtain the target root cause of the fault. The solutions of the embodiments of the present application can greatly improve fault diagnosis efficiency and the automation of intelligent operation and maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The accompanying drawings are used to provide a further understanding of the technical solution of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the technical solution of the present invention and do not constitute a limitation to the technical solution of the present invention.

[0012] FIG1 is a system architecture diagram provided by an embodiment of the present application;

[0013] FIG2 is a flow chart of a fault diagnosis method provided in an embodiment of the present application;

[0014] FIG3 is a schematic diagram of an operation and maintenance knowledge graph provided in an embodiment of the present application;

[0015] FIG4 is a schematic diagram of a process for constructing an operation and maintenance knowledge graph based on a failure mode according to an embodiment of the present application;

[0016] FIG5 is a schematic diagram of an alarm relationship included in a fault mode provided in an embodiment of the present application;

[0017] FIG6 is a schematic diagram of knowledge mining of an operation and maintenance knowledge graph provided by an embodiment of the present application;

[0018] FIG7 is a schematic diagram of a method for extracting operation and maintenance knowledge provided in an embodiment of the present application;

[0019] FIG8 is a schematic diagram of an example of an operation and maintenance knowledge graph provided in an embodiment of the present application;

[0020] FIG9 is a schematic diagram of a flow chart of determining a target failure mode according to an embodiment of the present application;

[0021] FIG10 is a schematic diagram of a flow chart of a root cause location operation according to an embodiment of the present application;

[0022] FIG11 is a schematic diagram of the device structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0024] It should be understood that in the description of the embodiments of the present application, if there is a description of "first", "second", etc., it is only for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the order of the indicated technical features. "At least one" means one or more, and "more" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent the existence of A alone, the existence of A and B at the same time, and the existence of B alone. Among them, A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any group of these items, including any group of single or plural items. For example, at least one of a, b and c can represent: a, b, c, a and b, a and c, b and c, or a, b and c, where a, b, c can be single or multiple.

[0025] In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0026] The fault diagnosis method provided in the embodiment of the present application can be applied to fault alarm monitoring and analysis scenarios of wireless communication networks, wherein the wireless communication networks include but are not limited to: Narrow Band-Internet of Things (NB-IoT), Global System for Mobile Communications (GSM), Enhanced Data rate for GSM Evolution (EDGE), Wideband Code Division Multiple Access (WCDMA), Code Division Multiple Access 2000 (CDMA2000), Time Division-Synchronization Code Division Multiple Access (TD-SCDMA), Long Term Evolution (LTE), fifth generation mobile communication technology (5G), sixth generation mobile communication technology (6G), and subsequent evolution communication systems, and can also be applied to other wireless communication networks.

[0027] Figure 1 is a system architecture diagram provided by an embodiment of the present application. The system includes a network system 1100, an alarm collection node 1200, and a fault diagnosis device 1300. The network system 1100 includes at least one network device, each of which may generate alarm data during operation. A network device can be any object that needs to be managed in the network system. A network device can be implemented using software, for example, a virtual machine, container, application, service, microservice, module, submodule, class, or function. The network device may be software running in one device or a collection of software running in multiple devices. The network device may also be implemented in hardware, for example, a server, a base station, a switch, a router, a relay, a bridge, a firewall, a mobile terminal, a personal computer, a laptop computer, a disk, a solid-state drive (SSD), a disk array (RAID), a storage area network (SAN), an Internet Protocol (IP) SAN, a Fiber Channel (FC) SAN, a network attached storage (NAS), a load balancer, a mobility management entity (MME), a home subscriber server (HSS), a serving-gateway (SGW), a packet data network gateway (PGW), a policy and charging rules function (PCRF) network element, an optical network terminal (ONT), an optical network unit (ONU), or a network element. Unit, ONU), optical splitter, IoT terminal, sensor, etc.; the network device can be implemented as a single independent hardware or multiple hardware connected via a wired or wireless network. This embodiment does not limit the specific form of the network device.

[0028] The alarm collection node 1200 is used to collect alarm data generated by network devices in the network system 1100. The alarm collection node 1200 is in communication with the network system 1100. When any network device in the network system 1100 generates alarm data, the network device can send the alarm data to the alarm collection node 1200. The alarm collection node 1200 can receive the alarm data sent by the network device and subsequently send the alarm data to the fault diagnosis device 1300. It should be understood that the alarm collection node has a storage function and can store large amounts of alarm data from the network system through its own or external storage media. For example, the alarm collection node can specifically be a database, a hard disk, a database hard disk, a database, a File Transfer Protocol (FTP) server, a disk, an SSD, a RAID, a SAN, an IPSAN, a FC SAN, a NAS, etc.

[0029] Fault diagnosis device 1300 is used to execute the method provided in the embodiments of the present application. Fault diagnosis device 1300 can be in communication with alarm collection node 1200. Alarm collection node 1200 can send alarm data collected from network system 1100 to fault diagnosis device 1300, and fault diagnosis device 1300 can receive alarm data sent by alarm collection node 1200. Fault diagnosis device 1300 determines the root cause alarm of the fault based on the received alarm data, and uses the constructed operation and maintenance knowledge graph based on the fault mode to determine the target fault mode corresponding to the root cause alarm of the fault, and then determines the root cause of the fault based on the target fault mode.

[0030] The executor of the fault diagnosis method of the embodiment of the present application can be a terminal device, which may include but is not limited to: a personal computer, a handheld device or a portable device, a tablet device, a multi-processor system, a microprocessor-based system, a set-top box, a programmable consumer electronic device, a network PC, a minicomputer, a mainframe computer, a distributed computing environment including any of the above systems or devices, etc.

[0031] The execution subject of the fault diagnosis method of the embodiment of the present application may also be a server. The server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. The embodiment of the present application does not limit the form of the subject of the execution method embodiment.

[0032] The methods provided in the embodiments of the present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0033] With the development of intelligent telecommunications network monitoring technology, the focus of network monitoring is shifting from alarms to faults. This is known as intelligent fault systems. When a network fault occurs, the system first aggregates the numerous alarms generated by the fault to generate a fault alarm. It then infers the root cause of the fault from these fault alarms and only addresses the root cause alarm, significantly reducing the number of dispatches. However, the same alarm may have multiple causes, and root cause alarms alone often cannot directly reveal the root cause. Network analysis is still required, and the efficiency of root cause location is heavily dependent on the operator's experience. Therefore, simply aggregating alarms into faults and recommending root cause alarms does not achieve comprehensive intelligent network operations and maintenance.

[0034] Based on this, the embodiments of the present application provide a fault diagnosis method, an electronic device, and a computer-readable storage medium, which can quickly locate the root cause of the fault corresponding to the root cause alarm, thereby improving the intelligence of network operation and maintenance. In the embodiments of the present application, a large amount of fault alarm data collected is aggregated through a fault diagnosis device, and typical fault scenarios, i.e., fault modes, are extracted therefrom. The root cause diagnosis method for the same fault mode is consistent; and a large amount of fault diagnosis knowledge accumulated in the field of operation and maintenance is constructed to construct an operation and maintenance knowledge graph based on the fault mode. By using this operation and maintenance knowledge graph, the target fault mode corresponding to the root cause alarm of the fault can be determined, and then the root cause diagnosis is performed according to the target fault mode to obtain the root cause of the fault, thereby greatly improving the efficiency of fault diagnosis and realizing the automation of intelligent operation and maintenance.

[0035] Figure 2 is a flow chart of a fault diagnosis method provided in an embodiment of the present application. As shown in Figure 2, the fault diagnosis method provided in an embodiment of the present application includes but is not limited to the following steps S100, S200, S300 and S400, each of which is described in turn below.

[0036] Step S100: Construct an operation and maintenance knowledge graph based on failure modes.

[0037] The failure modes described in the embodiments of the present application are typical failure scenarios extracted based on a large amount of fault alarm data. For example, the failure mode may be that the optical module receives light beyond the limit, the splitter port signal is abnormal, etc.

[0038] In an embodiment of the present application, an operation and maintenance knowledge graph is constructed with fault modes as nodes, and in the operation and maintenance knowledge graph, the fault mode node is used as the core node, and related nodes of the fault mode node are constructed around the fault mode node. These related nodes cover knowledge such as categories, phenomena, cases, diagnostic methods, causes, solutions, fault locations, etc. related to the fault mode, providing support for subsequent root cause diagnosis of the fault.

[0039] Figure 3 is a schematic diagram of the operation and maintenance knowledge graph provided by an embodiment of the present application. As shown in Figure 3, the operation and maintenance knowledge graph includes root cause alarm nodes and fault mode nodes, and the root cause alarm nodes and fault mode nodes are connected by an edge to indicate that they have a corresponding relationship. The fault diagnosis method of the embodiment of the present application uses the root cause alarm as the starting point for fault diagnosis, uses the operation and maintenance knowledge graph to determine the target fault mode corresponding to the root cause alarm, and then performs root cause diagnosis based on the target fault mode to obtain the root cause of the fault.

[0040] It should be noted that the number of root cause alarm nodes and failure mode nodes in Figure 3 is for reference only. The O&M knowledge graph can have multiple root cause alarm nodes and failure mode nodes. One root cause alarm node corresponds to multiple failure mode nodes, and similarly, one failure mode node can correspond to multiple root cause alarm nodes. The weight of the edge between a corresponding root cause alarm node and a failure mode node represents the matching probability between the corresponding root cause alarm and failure mode.

[0041] As shown in Figure 3, the operation and maintenance knowledge graph also includes at least one of the following nodes: an alarm analysis node, an event query node, an AI reasoning node, a silent fault node, a fault root cause node, a solution node, a fault location node, a faulty network element node, a fault category node, a fault phenomenon node, a similar case node, and a note node. The alarm analysis node, event query node, AI reasoning node, and silent fault node are diagnostic analysis nodes, used to indicate the mapping rules between fault mode nodes and fault root cause nodes.

[0042] In the embodiment of the present application, the construction of the operation and maintenance knowledge graph can be combined with the fault diagnosis scenario and the experience of business experts to confirm the graph nodes and edges. The application scenario of the embodiment of the present application is an intelligent fault scenario based on alarms. Therefore, based on the alarms of fault aggregation, it is possible to gradually analyze and find the root cause and solution of the fault. The graph ontology includes root cause alarm nodes and fault mode nodes, and includes nodes such as categories, phenomena, similar cases, alarm analysis, event query, AI reasoning, root causes of faults, solutions, and fault locations corresponding to the fault nodes.

[0043] Figure 4 is a flow chart of constructing an operation and maintenance knowledge graph based on a fault mode according to an embodiment of the present application. As shown in Figure 4, constructing an operation and maintenance knowledge graph based on a fault mode includes the following steps S101-S105:

[0044] Step S101: Acquire first historical alarm data of multiple historical faults;

[0045] For example, historical alarm data generated by the network system in a certain time period can be obtained, and then the above historical alarm data can be aggregated according to the spatiotemporal relationship or through an AI algorithm to obtain the first historical alarm data of multiple historical faults.

[0046] It should be noted that in a network system, the same type of fault may occur at different locations in the network, but the alarm types caused by the fault are often the same or similar. Therefore, these alarms can be aggregated into alarm data for one fault through business and time constraints.

[0047] Step S102: clustering and extracting the first historical alarm data of multiple historical faults to obtain multiple fault modes and second historical alarm data corresponding to each fault mode.

[0048] For example, based on the fault, an aggregation algorithm or a frequent itemset algorithm is used to calculate the similarity of the first historical alarm data of multiple historical faults to mine similar historical faults. Specifically, faults with similarity greater than a threshold are extracted, and then these faults with similarity greater than the threshold are summarized to obtain a fault pattern. By obtaining the first historical alarm data of historical faults belonging to the same fault pattern, the second historical alarm data corresponding to the fault pattern can be constructed.

[0049] Step S103 : For each fault mode, determine the root cause alarm and non-root major alarm corresponding to the fault mode according to the second historical alarm data corresponding to the fault mode, and determine the root cause of the fault corresponding to the fault mode.

[0050] Exemplarily, alarms for a fault mode may only include root cause alarms and non-root cause critical alarms. Alarms that are not important for fault location can be pre-filtered. In step S103, for each fault mode, the second historical alarm data corresponding to the fault mode can be first filtered to retain only the critical alarms corresponding to the fault mode. Root cause alarms are then located based on the critical alarms corresponding to the fault mode to obtain the root cause alarms corresponding to the fault mode. Critical alarms other than root cause alarms are non-root cause critical alarms. The root cause alarms corresponding to the fault mode can be determined using an AI algorithm or alarm propagation relationships.

[0051] Exemplarily, the root cause of a fault corresponding to a fault mode can be determined using alarm relationships, network performance indicators, or AI algorithms. Each fault mode can correspond to multiple root causes of a fault.

[0052] After determining the root cause of the fault corresponding to the fault mode, a root cause node can be constructed in the operation and maintenance knowledge graph.

[0053] Figure 5 is a schematic diagram of the alarm relationships within a fault mode provided by an embodiment of the present application. The fault mode shown in Figure 5 is "Optical module light receiving limit exceeded," with the root cause alarm being "Ethernet interface input optical power exceeded." Non-root critical alarms include "Ethernet physical interface signal loss" and "Ethernet physical interface Ethernet" port disconnected. Based on the propagation relationships between the alarms within a fault mode, the alarm relationships within the fault mode can be derived.

[0054] Step S104: Take each fault mode as a fault mode node, take each root cause alarm as a root cause alarm node, and establish connecting edges between the corresponding fault mode nodes and root cause alarm nodes to obtain an operation and maintenance knowledge graph.

[0055] It should be noted that one fault mode node may have a corresponding relationship with multiple root cause alarm nodes, and similarly, one root cause alarm node may have a corresponding relationship with multiple fault mode nodes.

[0056] Step S105: Determine the weight corresponding to each edge according to the matching probability between the fault mode and the root cause alarm.

[0057] In this embodiment of the present application, the edge between the fault mode node and the root cause alarm node has a weight attribute, and the edge weight value represents the matching probability of the root cause alarm and the corresponding fault mode. For example, the fault modes corresponding to the root cause alarm "Loss of Signal Alarm" include Fault Mode 1, Fault Mode 2, and Fault Mode 3, with corresponding matching probabilities of 50%, 20%, and 15%. In other words, the weight of the edge between the root cause alarm node "Loss of Signal Alarm" and the Fault Mode 1 node is 50%, the weight of the edge between the root cause alarm node "Loss of Signal Alarm" and the Fault Mode 2 node is 20%, and the weight of the edge between the root cause alarm node "Loss of Signal Alarm" and the Fault Mode 3 node is 15%.

[0058] The matching probability between a root cause alarm and its corresponding fault mode can be determined by counting the fault types corresponding to the root cause alarms. For example, among the collected historical fault alarm data, the root cause alarms for 100 historical faults are all "Loss of Signal (LOS) alarms." Of these, 50 historical faults were previously clustered and classified into Fault Mode 1 in step S102. Therefore, the matching probability of the root cause alarm "Loss of Signal (LOS) alarm" corresponding to Fault Mode 1 is determined to be 50%.

[0059] It should be noted that the weight of the edge between the fault mode node and the root cause alarm node can also be manually labeled, and this application does not impose any restrictions on this.

[0060] In one example of the present application, constructing an operation and maintenance knowledge graph based on a failure mode further includes the following steps S106 and S107:

[0061] Step S106: Based on the root cause of the fault corresponding to the fault mode, a root cause node corresponding to the fault mode node is constructed in the operation and maintenance knowledge graph.

[0062] Step S107: construct a diagnostic analysis node between the fault mode node and the fault root cause node having a corresponding relationship, wherein the diagnostic analysis node includes at least one of the following: a silent fault node, an alarm analysis node, an event query node, and an artificial intelligence (AI) reasoning node.

[0063] It's important to note that in most cases, the root cause of a fault is related to the fault's alarm. However, in some scenarios, the root cause may not generate a directly related alarm. For example, if a single-board chip fails and there's no monitoring mechanism to generate an alarm, no product chip failure alarm will be generated. However, alarms will be generated for the ports and services associated with the board. This type of fault is called a "silent fault." The fault location for a silent fault cannot be determined by the location of the root cause alarm. Instead, the fault location is determined by using related alarms and querying the network topology to locate the convergence of related alarms.

[0064] In the process of building the operation and maintenance knowledge graph, if a fault mode is a silent fault, then the node of the fault mode is connected to a silent fault node through an edge. The silent fault node is used to indicate the mapping rule between the silent fault and the corresponding root cause of the fault. If the mapping rule indicated by the silent fault node can be satisfied, it can be determined that the root cause of the fault pointed to by the silent fault node is the root cause of the fault corresponding to the current fault.

[0065] The alarm analysis node indicates the mapping rule between fault alarm relationships and root causes. For example, if the root cause alarm is "Optical Module Failure Alarm (4203&138)" and the major alarm is "Ethernet Physical Interface Signal Loss (4203&8)," the relationship between the two is peer (4203&138-peer->4203&8). Through this alarm relationship analysis, the root cause can be determined to be "Optical Module Failure," and the solution is "Replace the Optical Module." Therefore, if the alarms for the current fault satisfy this alarm relationship, that is, the mapping rule indicated by the alarm analysis node is satisfied, the root cause can be determined to be "Optical Module Failure."

[0066] It's important to note that if the fault's alarm relationship alone doesn't reveal the root cause, you need to query other events and conduct a comprehensive analysis to determine the root cause and complete the diagnosis. For example, if the root cause alarm is "Ethernet physical interface signal loss (4203&8)" and there are no other critical alarms, you can query the input optical power performance value of the alarm port. If the optical power performance value is less than the optical module's worst-case receive sensitivity, the root cause can be determined to be "excessive link loss on the alarm port." The solution is to inspect the corresponding optical fiber and repair or replace it.

[0067] In an embodiment of the present application, in view of the situation where the root cause of the fault may not be obtained through the alarm analysis node, an event query node is constructed in the operation and maintenance knowledge graph, and the event query node is used to indicate the mapping rules of the associated event value of the fault and the root cause of the fault. For example, the root cause alarm of the current fault is "Ethernet physical interface signal loss (4203&8)", and there are no other important alarms, so the root cause of the fault may not be directly obtained through the alarm analysis node, and then based on the indication of the event query node, the associated event value of the current fault "input optical power performance value of the alarm port" is obtained. If the input optical power performance value of the alarm port is less than the worst receiving sensitivity of the optical module, the mapping rule indicated by the event query node is satisfied, and it can be determined that the root cause of the fault pointed to by the event query node is the root cause of the current fault, that is, "the link loss of the alarm port is too large".

[0068] It should be noted that locating the root cause of some faults requires inputting associated event values ​​into the AI ​​model. The root cause can only be inferred based on the AI ​​model's output. Therefore, AI inference nodes can be constructed within the O&M knowledge graph to process associated event values ​​and determine the corresponding root cause. For example, if the root cause alarm is "Ethernet physical interface signal loss (4203&8)," the optical power values ​​of the port at the alarm location before and after the alarm can be collected. Based on these collected optical power values, the AI ​​model can be used for inference to further infer the root cause of the fault. The root cause can include factors such as a loose or broken pigtail, or a problem with the optical cable.

[0069] In an example of the present application, constructing an operation and maintenance knowledge graph based on a failure mode further includes the following step S108:

[0070] Step S108: Construct a solution node and a fault location node corresponding to the fault root cause node in the operation and maintenance knowledge graph.

[0071] In this step, a solution node is constructed in the operation and maintenance knowledge graph to provide a solution corresponding to the root cause of the fault through the solution node. For example, the solution corresponding to the root cause of the fault "the link loss of the alarm port is too large" is "the corresponding optical fiber needs to be checked, repaired, or replaced."

[0072] In this step, a fault location node is constructed in the operation and maintenance knowledge graph. Specifically, the location of the root cause alarm can be queried through the network topology to locate the fault location.

[0073] In an example of the present application, constructing an operation and maintenance knowledge graph based on a failure mode further includes the following step S109:

[0074] Step S109: For each fault mode node, construct at least one of the following nodes corresponding to the fault mode node in the operation and maintenance knowledge graph: a fault phenomenon description node, a fault category description node, or a case description node.

[0075] For example, manual experience and document knowledge mining can be used to obtain information such as fault phenomena, categories, and cases corresponding to fault modes. For example, for structured documents (such as manual fault diagnosis experience), mapping is used to obtain knowledge; for semi-structured documents (such as work orders), formatted extraction is used to obtain knowledge; and for unstructured data (such as fault cases and manuals), AI methods such as large models are used to extract knowledge, gradually improving the knowledge graph.

[0076] In an example of the present application, constructing an operation and maintenance knowledge graph based on a failure mode further includes the following step S110:

[0077] Step S110: Determine the attributes of each fault mode node, wherein the attributes of the fault mode node include at least one of the following: a fault mode identifier, a fault mode name, a silent fault mode identifier, an urgency attribute, a processing priority attribute, a root cause alarm set, a non-root important alarm set, a network classification attribute, or an identifier of whether the fault can be repaired using the network management.

[0078] The properties contained in the failure mode node can be shown in the following table:

[0079] Figure 6 is a schematic diagram of knowledge mining for the operation and maintenance knowledge graph provided in an embodiment of the present application. To improve the knowledge of the operation and maintenance knowledge graph, various types of knowledge required to construct the operation and maintenance knowledge graph, including graph nodes and node attributes, can be mined from various fault-related operation and maintenance documents. For structured data, mapping or manual extraction is used; for semi-structured data, formatting is used; and for unstructured data, AI algorithms are used for extraction.

[0080] Generally speaking, after accumulating experience, a large number of experience documents have been accumulated in typical technical fields, among which structured data, whose structure is generally inconsistent with the knowledge graph structure, is generally more standardized in content and has clear semantics. Knowledge extraction can be performed in a rule-based manner, that is, the input structured data is mapped or converted to the target structure of the knowledge graph. This process is essentially a shallow data conversion. For semi-structured and unstructured text documents, AI can be used for knowledge extraction. For example, jieba word segmentation technology is used and supplemented by part-of-speech tagging to achieve fast and accurate word segmentation of the text. On this basis, the BERT-BiLSMT-CRF model is used for sequence annotation to achieve named entity recognition, and then the BERT-BiGRU-ATT model is used to achieve entity relationship extraction of the text. Figure 7 is a schematic diagram of the operation and maintenance knowledge extraction method provided in an embodiment of the present application.

[0081] In the embodiment of the present application, knowledge fusion is performed on the mined knowledge to construct an operation and maintenance knowledge graph. Because the sources of knowledge extraction are diverse, the knowledge obtained from different sources is not the same, which puts forward the demand for knowledge fusion. Knowledge fusion requires the completion of entity alignment and attribute fusion. Entity alignment is to identify the same entity from different sources. Attribute fusion is to identify different descriptions of the same attribute. Data values ​​from different sources usually have different formats, different units or different description forms, and need to be normalized to a unified format.

[0082] Entity alignment is the process of outputting unambiguous root cause entities from entity descriptions whose input is from different data sources, such as root cause entities extracted from work orders and manually entered root cause entities. This is because different statements may describe the same root cause in different data sources. Suppose we have two root cause descriptions: "cable break" and "fiber break". Both statements contain information that the root cause of the fault is "fiber break", but they use different vocabulary and grammar to describe them. We can use a similarity-based sentence alignment method to calculate their similarity. Using a pre-trained Chinese word vector model, we can obtain the following results:

[0083] Optical cable break: [(0.15,0.20),(0.34,0.46)];

[0084] Fiber disconnection: [(0.18,0.25),(0.38,0.52)];

[0085] Use cosine similarity to calculate the similarity between two entities. Multiply the vectors of the two entities separately, add the results, and then divide by the product of the moduli of the two entity vectors, that is:

[0086] cosine_similarity=(v1·v2) / (||v1||·||v2||);

[0087] Among them, v1 represents the entity vector of "cable break", and v2 represents the entity vector of "fiber disconnection".

[0088] According to the similarity between "cable break" and "fiber disconnection", a certain threshold is set. If the similarity is greater than the threshold, it can be considered that they describe the same entity and entity alignment can be performed.

[0089] Figure 8 is a schematic diagram of an example of the operation and maintenance knowledge graph provided by an embodiment of the present application. In the operation and maintenance knowledge graph shown in Figure 8, the fault mode nodes corresponding to fault modes 1-6, as well as the root cause alarm nodes "Port Not Connected Alarm" and "Signal Loss LOS Alarm" are shown. Among them, there is a connection edge between the root cause alarm node "Signal Loss LOS Alarm" and the nodes of fault modes 1, 2, 3, 5, and 6, and the probabilities marked on the edges represent the matching probabilities of the root cause alarm "Signal Loss LOS Alarm" relative to fault modes 1, 2, 3, 5, and 6, which are 50%, 20%, 15%, 10%, and 5% respectively. There is a connection edge between the root cause alarm node "Port Not Connected Alarm" and the nodes of fault modes 4 and 5, and the probabilities marked on the edges represent the matching probabilities of the root cause alarm relative to fault modes 4 and 5, which are 80% and 20% respectively.

[0090] In the operation and maintenance knowledge graph shown in Figure 8, the fault category description node and fault phenomenon description node corresponding to fault mode 1 are also shown. The fault category description node shows that the fault category of fault mode 1 is "status class"; the fault phenomenon description node shows that the fault phenomenon of fault mode 1 is "link terminal".

[0091] The operation and maintenance knowledge graph shown in Figure 8 also shows multiple diagnostic analysis nodes, namely: the alarm analysis node "LOS alarm at both ends of the optical fiber" connected to the fault mode 1 node, the event query node "Optical power query" connected to the fault mode 2 node, and the event query node "Opposite network element status query" connected to the fault mode 3 node; under the fault mode 2 node, it also includes an "AI reasoning" node connected to the "Optical power query" node.

[0092] The operation and maintenance knowledge graph shown in Figure 8 also shows multiple root cause nodes, namely: corresponding to the fault mode 1 node, the root cause node "fiber breakage" connected to the alarm analysis node "LOS alarm at both ends of the optical fiber"; corresponding to the fault mode 2 node, the root cause node "high link loss" connected to the event query node "optical power query", and the root cause node "loose pigtail" connected to the "AI reasoning" node; corresponding to the fault mode 3 node, the "opposite network element offline" node connected to the event query node "opposite network element status query".

[0093] The operation and maintenance knowledge graph shown in Figure 8 also shows the solution node "Replace optical fiber" connected to the root cause nodes of the fault "fiber break", "loose pigtail", and "high link loss" respectively, and the solution node "Check the opposite network element" connected to the root cause node of the fault "the opposite network element is offline".

[0094] The embodiment of the present application provides an operation and maintenance knowledge graph architecture based on fault modes, which can be applied to intelligent fault systems. Based on fault modes, it integrates knowledge related to fault diagnosis to construct an operation and maintenance knowledge graph, and realizes the automation of intelligent fault root cause location. The entity (i.e., node) types in the constructed operation and maintenance knowledge graph include alarms, fault modes, alarm analysis, event queries, AI reasoning, fault root causes, solutions, similar cases, etc.; wherein, the fault mode includes the root cause alarm type and important alarm type of the fault, which are used to characterize a certain type of fault. The relevant knowledge of the operation and maintenance knowledge graph comes from historical fault data and artificial experience data such as case libraries, wherein the fault mode is obtained by mining historical fault data through algorithms such as clustering, and the fault mode includes root cause alarms and important alarms of typical faults. In addition to specific edge types, the node relationship of the operation and maintenance knowledge graph also contains probability information, which is mainly based on historical faults and statistics on the probability of the corresponding node having occurred. During specific diagnosis, nodes with high probability can be preferred, thereby improving the efficiency of fault diagnosis.

[0095] Step S200: Obtain at least one root cause alarm corresponding to the fault, and determine the target fault mode corresponding to each root cause alarm through the operation and maintenance knowledge graph.

[0096] In this step, the root cause alarm of the fault is first located, and then the fault mode-based operation and maintenance knowledge graph is used to find the fault mode corresponding to the root cause alarm of the current fault, that is, the target fault mode. The root cause of the fault can be determined based on the target fault mode.

[0097] Exemplarily, in step S200, obtaining at least one root cause alarm corresponding to the fault may specifically include the following steps S210, S211, and S212:

[0098] Step S210, obtaining fault alarm data;

[0099] Step S211 , screening the alarm data of the fault to obtain at least one important alarm of a sub-fault, wherein an alarm propagation relationship exists between the important alarms of the sub-faults;

[0100] For example, in step S211, the alarm data of the fault is screened to obtain an important alarm of at least one sub-fault, which may specifically include the following steps S2111, S2112, and S2113:

[0101] Step S2111 : performing aggregate fault processing on the received alarms according to the temporal and spatial relationships to obtain alarm data of at least one fault.

[0102] For example, cluster analysis can be performed on the received alarm data based on the alarm time and the location of the alarm in the network topology to discover relevant alarms, and the relevant alarms can be clustered together as alarm data of a fault.

[0103] Step S2112: The aggregated alarm data is split according to the business dimension to obtain an alarm of at least one sub-fault, wherein an alarm propagation relationship exists between the alarms of the sub-faults.

[0104] In this step, alarms with an alarm propagation relationship can be classified as alarms of a sub-fault according to the alarm propagation relationship. If there is no alarm propagation relationship between two alarms, it is determined that the two alarms belong to alarms of different sub-faults.

[0105] Step S2113 : filtering the alarms of each sub-fault to obtain important alarms of the sub-fault.

[0106] This step is intended to filter out alarms that are irrelevant to fault root cause location and retain only alarms that are useful for fault root cause location, thereby improving the efficiency of fault root cause location.

[0107] For example, when there are a large number of alarms, the alarm set of the fault mode is used to filter out alarms that are not related to the root cause location of the fault. For example, the set of all alarms of the fault mode of the operation and maintenance speed map is S1, and the set of alarms included in the fault is S2. Then, only the alarms in the set S1 are retained for the fault, and other alarms are filtered out.

[0108] Optionally, after filtering the alarms of the sub-faults, the method of the embodiment of the present application further includes the following step: adding an alarm corresponding to the sub-fault according to the alarm propagation relationship.

[0109] For scenarios where many or few fault alarms are clustered, the alarm propagation relationship can be used to remove and add alarms. For example, the alarm propagation relationship is A->B->C, and there are only A and C in the fault. According to experience, if C appears, B must appear, so B is blocked or missed, and B needs to be added. The alarm B may be missed during fault aggregation due to the time window, or it may be blocked due to network management settings, resulting in the fault system not receiving this alarm.

[0110] Step S212: Classify the important alarm of each sub-fault into root cause alarms and non-root important alarms.

[0111] The operation and maintenance knowledge graph provided in the embodiment of the present application includes multiple root cause alarm nodes and multiple fault mode nodes, and edges are set between the corresponding root cause alarm nodes and fault mode nodes. The weight of the edge represents the matching probability between the corresponding root cause alarm nodes and fault mode nodes. Based on this, in step S200, the target fault mode corresponding to each root cause alarm is determined through the operation and maintenance knowledge graph. Specifically, for each root cause alarm, the following steps S220, S221, and S222 can be executed to obtain the target fault mode corresponding to each root cause alarm:

[0112] Step S220: determining at least one first candidate fault mode corresponding to the root cause alarm and a matching probability corresponding to each first candidate fault mode based on the operation and maintenance knowledge graph;

[0113] Step S221, performing matching operations on each first candidate fault mode in order from high to low matching probability, wherein the matching operation includes: determining a first matching degree between the root cause alarm and the first candidate fault mode; when the first matching degree meets a first threshold, determining a second matching degree between the non-root important alarm and the first candidate fault mode; when the second matching degree meets a second threshold, using the first candidate fault mode as the second candidate fault mode, or when the second matching degree meets a third threshold but does not meet the second threshold, using the first candidate fault mode as the third candidate fault mode, wherein the first threshold is greater than the third threshold, and the second threshold is greater than the third threshold.

[0114] Exemplarily, the attributes of each fault mode node include a root cause alarm set, and the first matching degree can be determined by the following steps: obtaining the root cause alarm set corresponding to the first candidate fault mode; intersecting the root cause alarm corresponding to the sub-fault with the root cause alarm set corresponding to the first candidate fault mode to obtain the first matching degree.

[0115] Specifically, the first matching degree is to match the root cause alarm set contained in the attributes of the fault pattern with the root cause alarm set of the fault to be diagnosed. Optionally, Jaccard is used to calculate the matching degree. The intersection of the root cause alarm set of the pattern and the root cause alarm set of the fault is divided by the root cause alarm set of the pattern to obtain the first matching degree. The following formula can be used as a reference:

[0116] First matching degree=num(root cause alarm set of pattern∩root cause alarm set of fault) / num(root cause alarm set of pattern).

[0117] Exemplarily, the attributes of each fault mode node include an important alarm set, and the second matching degree can be determined by the following steps: obtaining the important alarm set corresponding to the first candidate fault mode; intersecting the non-root important alarm corresponding to the sub-fault with the important alarm set corresponding to the first candidate fault mode to obtain the second matching degree.

[0118] Specifically, the first matching degree is to match the non-root important alarm set contained in the attributes of the fault pattern with the non-root important alarm set of the fault to be diagnosed. Optionally, Jaccard is used to calculate the matching degree. The intersection of the non-root important alarm set of the pattern and the non-root important alarm set of the fault is divided by the non-root important alarm set of the pattern to obtain the first matching degree. The following formula can be used as a reference:

[0119] Second matching degree=num(non-root important alarm set of the pattern∩non-root important root cause alarm set of the fault) / num(non-root important alarm set of the pattern).

[0120] Step S222: Determine a target failure mode corresponding to the root cause alarm from the second candidate failure mode or the third candidate failure mode.

[0121] Exemplarily, determining the target failure mode corresponding to the root cause alarm from the second candidate failure mode or the third candidate failure mode includes: when there is at least one second candidate failure mode, using each second candidate failure mode as the target failure mode corresponding to the root cause alarm; or, when there is no second candidate failure mode, using each third candidate failure mode as the target failure mode corresponding to the root cause alarm.

[0122] Exemplarily, the values ​​of the first threshold and the second threshold may both be 100%, and the value of the third threshold is a value lower than 100%, for example, 80%.

[0123] When both the first and second thresholds are 100%, that is, the root cause alarm and non-root critical alarm of the fault to be diagnosed match the second candidate fault mode at a 100% match rate, the second candidate fault mode can be considered a complete match mode. For the third candidate fault mode, if the match rate between the non-root critical alarm of the fault to be diagnosed and the third candidate fault mode is less than 100%, but still higher than a preset threshold (e.g., 80%), the third candidate fault mode can be included in the list of suspected match modes. In the process of determining the target fault mode, the second candidate fault mode is prioritized as the target fault mode. If the second candidate fault mode does not exist, the third candidate fault mode is selected as the target fault mode.

[0124] For example, the method provided in the embodiment of the present application may further include the following step S230:

[0125] Step S230: If the second candidate fault mode or the third candidate fault mode does not exist, add the root cause alarm to the list of remaining root cause alarms.

[0126] In this step, if there is no second candidate fault mode or third candidate fault mode, that is, the root cause alarm cannot be successfully matched with all fault modes, it is considered that the current fault mode is incomplete and does not include the currently diagnosed fault scenario, so this root cause alarm is included in the "legacy root cause alarm list".

[0127] FIG9 is a flow chart of determining a target failure mode according to an embodiment of the present application. In the example shown in FIG9 , determining a target failure mode includes the following steps:

[0128] Step S2401: Obtain the root cause alarm of the sub-fault;

[0129] Step S2402: Based on the operation and maintenance knowledge graph, determine a first candidate fault mode list corresponding to the root cause alarm, the first candidate fault mode list including at least one first candidate fault mode, and sort all the first candidate fault modes in descending order according to matching probability;

[0130] As shown in the example of Figure 9, based on the operation and maintenance knowledge graph, n first candidate fault modes corresponding to the root cause alarm are obtained, and then the n first candidate fault modes are sorted in descending order according to the matching probability. The sorted n first candidate fault modes are recorded as first candidate fault mode #1, first candidate fault mode #1, ..., first candidate fault mode #n, and subsequently matching operations are performed on first candidate fault mode #1, first candidate fault mode #1, ..., first candidate fault mode #n in order.

[0131] Step S2403: Obtain a root cause alarm set corresponding to the first candidate fault mode #1, calculate a matching degree between the root cause alarm set corresponding to the first candidate fault mode #1 and the root cause alarm of the sub-fault, and obtain a first matching degree;

[0132] Step S2404: Determine whether the first matching degree is 100%. If so, execute step S2405. Otherwise, terminate the matching operation on the first candidate fault mode #1 and jump to the first candidate fault mode #2 to perform the matching operation on the first candidate fault mode #2.

[0133] Step S2405: Obtain a non-root important alarm set corresponding to the first candidate fault mode #1, calculate a matching degree between the non-root important alarm set corresponding to the first candidate fault mode #1 and the non-root important alarm of the sub-fault, and obtain a second matching degree;

[0134] Step S2406: Determine whether the second matching degree is greater than a preset threshold. If so, execute step S2407; otherwise, terminate the matching operation on the first candidate fault mode #1 and jump to the first candidate fault mode #2 to perform a matching operation on the first candidate fault mode #2.

[0135] Step S2407: determine whether the second matching degree is 100%. If so, add the first candidate fault mode #1 to the second candidate fault mode list; otherwise, add the first candidate fault mode #1 to the third candidate fault mode list.

[0136] At this point, the matching operation on the first candidate fault mode #1 is completed, and then the process jumps to the first candidate fault mode #2 to perform a matching operation on the first candidate fault mode #2. The subsequent matching operations on the first candidate fault mode #2,..., and the first candidate fault mode #n are similar to the above steps S2403-S2407 and will not be repeated here.

[0137] After completing the matching operation on the n first candidate failure modes, outputting a final second candidate failure mode list and a final third candidate failure mode, and determining a final target failure mode based on the final second candidate failure mode list and the final third candidate failure mode list, specifically includes the following steps:

[0138] Step S2501: determine whether the second candidate failure mode list is empty. If not, use the failure mode in the second candidate failure mode list as the target failure mode. If not, execute step S2502.

[0139] Step S2502: determine whether the third candidate failure mode list is empty. If not, use the failure mode in the third candidate failure mode list as the target failure mode. If not, execute step S2503.

[0140] Step S2503: Add the root cause alarm of the sub-fault to the list of remaining root cause alarms.

[0141] In the embodiment of the present application, the target fault mode corresponding to the fault is determined by combining the root cause alarm and the non-root important alarm of the fault to ensure that the target fault mode has a high degree of match with the fault whose root cause is to be determined, thereby ensuring the accuracy of the subsequent use of the target fault mode to determine the root cause of the fault.

[0142] Step S300: For each root cause alarm, perform root cause diagnosis according to the target fault mode corresponding to the root cause alarm to obtain the root cause of the fault corresponding to the root cause alarm.

[0143] Exemplarily, the operation and maintenance knowledge graph also includes fault root cause nodes corresponding to fault mode nodes. The corresponding fault mode nodes and fault root cause nodes are connected via diagnostic analysis nodes, where the diagnostic analysis nodes include at least one of the following: alarm analysis nodes, event query nodes, and AI reasoning nodes. Based on this, in step S300, root cause diagnosis is performed based on the target fault mode corresponding to the root cause alarm to obtain the root cause of the fault corresponding to the root cause alarm. Specifically, step S310 may include the following:

[0144] Step S310: performing root cause location operations for each target fault mode in descending order of matching degree.

[0145] It should be noted that the matching degree described in step S310 can be determined based on the matching degree between the non-root major alarms of the sub-fault and the non-root major alarm set included in the attributes of the target fault mode, i.e., the second matching degree described in step S221 above. It is understood that the higher the matching degree, the higher the success rate of obtaining the root cause of the fault based on the corresponding fault mode. Therefore, in this embodiment of the application, the root cause location operation is performed for each target fault mode in descending order of matching degree.

[0146] Figure 10 is a flowchart of a root cause location operation provided by an embodiment of the present application. Based on the example shown in Figure 10, the root cause location operation of the embodiment of the present application may include the following steps S311, S312 and S313:

[0147] Step S311: Perform alarm analysis on the sub-fault using the alarm analysis node corresponding to the target fault mode in the operation and maintenance knowledge graph to find the root cause of the fault that matches the alarm propagation relationship of the sub-fault;

[0148] Step S312: If no root cause matching the alarm propagation relationship of the sub-fault is found, an event query analysis is performed on the sub-fault based on the event query node corresponding to the target fault mode in the operation and maintenance knowledge graph to determine the associated event value corresponding to the sub-fault, and the root cause corresponding to the sub-fault is determined based on the associated event value.

[0149] Step S313: If the root cause of the fault corresponding to the associated event value cannot be found, AI reasoning is performed on the associated event value based on the AI ​​reasoning node corresponding to the target fault mode in the operation and maintenance knowledge graph to obtain the root cause of the fault corresponding to the sub-fault.

[0150] Exemplarily, the diagnosis and analysis node also includes a silent fault node. Based on this, the root cause location operation may further include the following step S314:

[0151] Step S314: If there is a corresponding silent fault node for the target fault mode, search for the root cause of the fault corresponding to the sub-fault based on the silent fault node.

[0152] Exemplarily, if the fault mode is a "silent fault", the above-mentioned fault location acquisition no longer takes the root cause alarm location, but uses the fault-related alarms and the network topology to query the convergence location of the related alarms as the fault location. The "silent fault" mentioned above is a fault that does not generate an alarm that directly represents the fault. For example, the processing chip of the equipment board is abnormal. At this time, the equipment does not generate a chip abnormality alarm. For this scenario, although the board itself does not report a chip abnormality alarm, the ports carried by the board and related services will generate alarms. According to the fault mode, the root cause of the fault can be first located as a chip abnormality, and then the related alarms can be used to query the common carrier board of these alarms using the network topology, and this board can be used as the fault location.

[0153] For example, the method provided in the embodiment of the present application may further include the following step S320:

[0154] Step S320: When the root cause location operations corresponding to all target fault modes are completed and the root cause of the fault is not obtained, the root cause alarm is added to the remaining root cause alarm list.

[0155] Exemplarily, the operation and maintenance knowledge graph further includes a solution node corresponding to the root cause of the fault, and a fault location node corresponding to the solution node; after obtaining the root cause of the aggregated fault, the method provided in this application further includes the following steps:

[0156] Step S330: Determine a solution corresponding to the root cause of the aggregated fault based on the operation and maintenance knowledge graph, and determine the fault location according to the solution corresponding to the root cause of the aggregated fault.

[0157] The following is an illustrative description of the method embodiment of the present application in conjunction with the operation and maintenance knowledge graph shown in Figure 8.

[0158] For example, if the root cause alarm for a fault is a "loss of signal (LOS) alarm," and the target fault modes for this root cause alarm are determined to include fault mode 1, fault mode 2, and fault mode 3, and the matching order is from highest to lowest: fault mode 1, fault mode 2, and fault mode 3. The process of determining the root cause of the fault based on the target fault mode may include the following steps:

[0159] Step S3101: Based on the alarm analysis node corresponding to fault mode 1 and the alarm of the current fault, determine whether there are LOS alarms at both ends of the optical fiber. If so, it can be determined that the root cause of the fault is "fiber break" and the corresponding solution is "replace the optical fiber";

[0160] In step S3102, if the condition for adding the root cause alarm to the legacy root cause alarm list is not met, then the optical power performance value of the alarm port is obtained based on the event query node corresponding to fault mode 2. If the optical power performance value is less than the worst receiving sensitivity of the optical module, the root cause of the fault can be determined to be "excessive link loss at the alarm port" and the corresponding solution is "replace the optical fiber."

[0161] In step S3103, if the optical power performance value of the alarm port is greater than the worst receiving sensitivity of the module, the optical power values ​​of the alarm port before and after the alarm are obtained. Based on the optical power values ​​before and after the alarm, the AI ​​model is used for reasoning. According to the AI ​​reasoning results, the root cause of the fault is determined to be "loose pigtail", and the corresponding solution is "replace the optical fiber".

[0162] In step S3104, if the root cause of the fault still cannot be determined based on AI reasoning, the event query node corresponding to fault mode 3 is used to obtain the status of the peer network element. If the peer network element status is the preset status, the root cause of the fault is determined to be "the peer network element is offline" and the corresponding solution is "check the peer network element";

[0163] Step S3105: If the root cause of the fault still cannot be obtained based on fault mode 3, the root cause alarm is added to the list of remaining root cause alarms.

[0164] S400 : Perform fusion processing on the fault root causes corresponding to the root cause alarms to obtain the target fault root cause.

[0165] Specifically, step S400 includes: fusing root causes of faults corresponding to multiple sub-faults to obtain a target root cause of the fault.

[0166] The operation and maintenance knowledge graph of the embodiment of the present application also includes a solution node corresponding to the root cause of the fault, and a fault location node corresponding to the solution node; based on this, after obtaining the target root cause of the fault, the following steps can also be included: based on the operation and maintenance knowledge graph, determine the solution corresponding to the target root cause of the fault, and determine the fault location according to the solution corresponding to the target root cause of the fault.

[0167] After determining the root cause of the fault corresponding to the root cause alarm, the embodiment of the present application also performs fusion processing based on the root causes of the fault corresponding to each root cause alarm to obtain the final target root cause of the fault, so that the operation and maintenance personnel can troubleshoot the target root cause of the fault and improve the operation and maintenance efficiency.

[0168] The embodiment of the present application proposes a fault diagnosis method based on knowledge graph to make full use of fault modes and operation and maintenance experience, build an operation and maintenance knowledge graph for intelligent faults, solve the problem of fault demarcation and positioning difficulties, and improve fault diagnosis efficiency.

[0169] The embodiment of the present application provides an operation and maintenance knowledge graph architecture based on fault modes, which is applied to intelligent fault systems. Based on fault modes, it integrates knowledge related to fault diagnosis, constructs an operation and maintenance knowledge graph, and realizes the automation of intelligent fault root cause location.

[0170] The embodiment of the present application constructs an operation and maintenance knowledge graph ontology based on intelligent fault scenarios. The ontology is composed of graph-related entities, edges, and attributes of entities and edges. The graph ontology is suitable for fault diagnosis of intelligent faults. Entity types include alarms, fault modes, alarm analysis, event queries, AI reasoning, root causes of faults, solutions, similar cases, etc. The fault modes include root cause alarm types and important alarm types, which are used to characterize a certain type of fault.

[0171] Secondly, the embodiment of the present application obtains relevant knowledge of the operation and maintenance knowledge graph. The knowledge comes from historical fault data and manual experience data such as case libraries. Among them, the fault mode is obtained by mining the historical fault data through algorithms such as clustering. The fault mode includes root cause alarms and important alarms of typical faults. The case library and other data are used to match fault modes, supplemented by manual annotation, to improve the entities and side information of the knowledge graph, including alarm relationships, event queries, AI reasoning, root causes of faults, solutions, similar cases, etc.

[0172] In addition, the node relationship of the operation and maintenance knowledge graph in the embodiment of the present application, in addition to the specific edge type, also contains probability information, which is mainly based on the statistical probability of the corresponding node occurring based on historical failures. During specific diagnosis, nodes with high probabilities are preferred to improve diagnostic efficiency.

[0173] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0174] It is further understood that although operations are described in a particular order in the drawings in the embodiments of the present disclosure, this should not be construed as requiring that the operations be performed in the particular order shown or in a serial order, or that all of the operations shown be performed to obtain the desired results. In certain circumstances, multitasking and parallel processing may be advantageous.

[0175] An embodiment of the present application also provides an electronic device, as shown in Figure 11, the electronic device 1400 includes: one or more processors 1410; a memory 1420, on which one or more programs are stored. When the one or more programs are executed by the one or more processors 1410, the one or more processors 1410 implement the fault diagnosis method described in any of the above embodiments.

[0176] The memory 1420 is a non-transient network system that can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory 1420 may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory 1420 may optionally include a memory 1420 remotely located relative to the processor 1410, and these remote memories 1420 may be connected to the processor 1410 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0177] The memory 1420 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1420 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1420 and is called by the processor 1410 to execute the methods of the embodiments of this application.

[0178] The processor 1410 can be implemented using a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0179] In some embodiments, the electronic device also includes: an input / output interface for realizing information input and output; a communication interface for realizing communication interaction between the device and other devices, which can be realized through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.); a bus for transmitting information between the various components of the device (such as processor 1410, memory 1420, input / output interface and communication interface); wherein the processor 1410, memory 1420, input / output interface and communication interface can realize communication connection with each other within the device through the bus.

[0180] An embodiment of the present application further provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the fault diagnosis method described in any one of the above embodiments.

[0181] An embodiment of the present application also provides a computer program product, including a computer program or computer instructions, which are stored in a computer-readable storage medium. A processor of a computer device reads the computer program or computer instructions from the computer-readable storage medium, and the processor executes the computer program or computer instructions, so that the computer device executes the fault diagnosis method described in any of the above embodiments.

[0182] The system architecture and application scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of the system architecture and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are equally applicable to similar technical problems.

[0183] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0184] Those skilled in the art will appreciate that all or some of the steps and systems in the method disclosed above can be implemented as software, firmware, hardware, and appropriate combinations thereof. Some physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, and the computer-readable medium can include computer storage media (or non-transitory media) and communication media (or temporary media). As known to those skilled in the art, the term computer storage media is included in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data) and is volatile and non-volatile, removable, and non-removable. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory, or other memory technology, CD-ROM, digital versatile disks (DVD), or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage, or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, as is well known to those skilled in the art, communication media typically embodies computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0185] The above description of some embodiments of the present application with reference to the accompanying drawings does not limit the scope of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present invention shall be within the scope of the present application.

Claims

1. A fault diagnosis method, comprising: Build an operation and maintenance knowledge graph based on failure modes; Obtain at least one root cause alarm corresponding to the fault, and determine the target fault mode corresponding to each of the root cause alarms through the operation and maintenance knowledge graph; For each of the root cause alarms, performing root cause diagnosis according to the target fault mode corresponding to the root cause alarm to obtain the root cause of the fault corresponding to the root cause alarm; The root causes of the faults corresponding to the root cause alarms are fused to obtain the target root cause of the faults.

2. The method according to claim 1, wherein: The construction of the operation and maintenance knowledge graph based on the failure mode includes: Obtaining first historical alarm data of multiple historical faults; Clustering and extracting the first historical alarm data of the plurality of historical faults to obtain a plurality of fault modes and second historical alarm data corresponding to each of the fault modes; For each of the fault modes, determining the root cause alarm and non-root important alarm corresponding to the fault mode according to the second historical alarm data corresponding to the fault mode, and determining the root cause of the fault corresponding to the fault mode; Each fault mode is taken as a fault mode node, each root cause alarm is taken as a root cause alarm node, and an edge connecting the fault mode nodes and the root cause alarm nodes having a corresponding relationship is established to obtain the operation and maintenance knowledge graph; The weight corresponding to each edge is determined according to the matching probability between the fault mode and the root cause alarm.

3. The method according to claim 2, wherein: The construction of the operation and maintenance knowledge graph based on the failure mode also includes: According to the root cause of the fault corresponding to the fault mode, construct a root cause node corresponding to the fault mode node in the operation and maintenance knowledge graph; A diagnosis and analysis node is constructed between the fault mode node and the fault root cause node having a corresponding relationship, wherein the diagnosis and analysis node includes at least one of the following: a silent fault node, an alarm analysis node, an event query node, and an artificial intelligence AI reasoning node.

4. The method according to claim 3, wherein: The construction of the operation and maintenance knowledge graph based on the failure mode also includes: A solution node and a fault location node corresponding to the fault root cause node are constructed in the operation and maintenance knowledge graph.

5. The method according to claim 2, wherein: The construction of the operation and maintenance knowledge graph based on the failure mode also includes: For each of the fault mode nodes, at least one of the following nodes corresponding to the fault mode node is constructed in the operation and maintenance knowledge graph: a fault phenomenon description node, a fault category description node, or a case description node.

6. The method according to claim 2, wherein: The construction of the operation and maintenance knowledge graph based on the failure mode also includes: Determine the attributes of each of the fault mode nodes, wherein the attributes of the fault mode nodes include at least one of the following: a fault mode identifier, a fault mode name, a silent fault mode identifier, an urgency attribute, a processing priority attribute, a root cause alarm set, a non-root important alarm set, a network classification attribute, or an identifier of whether the fault can be repaired using a network manager.

7. The method according to claim 1, wherein: The obtaining of at least one root cause alarm of a fault includes: Obtaining alarm data of the fault; Screening the alarm data of the fault to obtain at least one important alarm of a sub-fault, wherein an alarm propagation relationship exists between the important alarms of the sub-faults; The important alarm of each sub-fault is divided into a root cause alarm and a non-root important alarm.

8. The method according to claim 7, wherein: The operation and maintenance knowledge graph includes a plurality of root cause alarm nodes and a plurality of fault mode nodes, an edge is provided between the root cause alarm nodes and the fault mode nodes having a corresponding relationship, and the weight of the edge represents the matching probability between the root cause alarm nodes and the fault mode nodes having a corresponding relationship; Determining the target failure mode corresponding to each of the root cause alarms through the operation and maintenance knowledge graph includes: Based on the operation and maintenance knowledge graph, determining at least one first candidate failure mode corresponding to the root cause alarm and a matching probability corresponding to each first candidate failure mode; According to the order of matching probability from high to low, matching operations are performed on each first candidate fault mode in turn, the matching operation comprising: determining a first matching degree between the root cause alarm and the first candidate fault mode; when the first matching degree satisfies a first threshold, determining a second matching degree between the non-root important alarm and the first candidate fault mode; when the second matching degree satisfies a second threshold, taking the first candidate fault mode as the second candidate fault mode, or when the second matching degree satisfies a third threshold but does not satisfy the second threshold, taking the first candidate fault mode as the third candidate fault mode, wherein the first threshold is greater than the third threshold, and the second threshold is greater than the third threshold; A target failure mode corresponding to the root cause alarm is determined from the second candidate failure mode or the third candidate failure mode.

9. The method according to claim 8, wherein: The determining a target failure mode corresponding to the root cause alarm from the second candidate failure mode or the third candidate failure mode includes: In the case where there is at least one of the second candidate failure modes, taking each of the second candidate failure modes as a target failure mode corresponding to the root cause alarm; or, In the case that the second candidate failure mode does not exist, each of the third candidate failure modes is used as a target failure mode corresponding to the root cause alarm.

10. The method according to claim 8, wherein: The attributes of each of the fault mode nodes include a root cause alarm set, and the first matching degree is determined by the following steps: Obtaining a root cause alarm set corresponding to the first candidate failure mode; The root cause alarm corresponding to the sub-fault is intersected with the root cause alarm set corresponding to the first candidate fault mode to obtain the first matching degree.

11. The method according to claim 8, wherein: The attributes of each of the fault mode nodes include an important alarm set, and the second matching degree is determined by the following steps: Obtaining an important alarm set corresponding to the first candidate failure mode; The non-root important alarm corresponding to the sub-fault is intersected with the important alarm set corresponding to the first candidate fault mode to obtain the second matching degree.

12. The method according to claim 8, further comprising: In the absence of the second candidate failure mode or the third candidate failure mode, the root cause alarm is added to a list of legacy root cause alarms.

13. The method according to claim 8, wherein: The operation and maintenance knowledge graph also includes a fault root cause node corresponding to the fault mode node, and the fault mode node and the fault root cause node having a corresponding relationship are connected through a diagnosis analysis node, wherein the diagnosis analysis node includes at least one of the following: an alarm analysis node, an event query node, and an AI reasoning node; The performing root cause diagnosis according to the target fault mode to obtain the root cause of the fault includes: In order of the matching degree from high to low, root cause location operations are performed on each of the target fault modes in turn; The root cause location operation includes: Finding the root cause of the fault that matches the alarm propagation relationship of the sub-fault through the alarm analysis node corresponding to the target fault mode in the operation and maintenance knowledge graph; In the case that the root cause of the fault that matches the alarm propagation relationship of the sub-fault cannot be found, based on the event query node corresponding to the target fault mode in the operation and maintenance knowledge graph, the associated event value corresponding to the sub-fault is determined, and the root cause of the fault corresponding to the sub-fault is determined according to the associated event value; When the root cause of the fault corresponding to the associated event value cannot be found, AI reasoning is performed on the associated event value based on the AI ​​reasoning node corresponding to the target fault mode in the operation and maintenance knowledge graph to obtain the root cause of the fault corresponding to the sub-fault.

14. The method according to claim 13, wherein: The diagnostic analysis node also includes a silent fault node; the root cause location operation also includes: In the case that there is a corresponding silent fault node for the target fault mode, the root cause of the fault corresponding to the sub-fault is searched based on the silent fault node.

15. The method according to claim 13 or 14, further comprising: When the root cause locating operations corresponding to all target fault modes are completed and the root cause of the fault is not obtained, the root cause alarm is added to a list of remaining root cause alarms.

16. The method according to claim 13 or 14, wherein: The step of fusing the root causes of the faults corresponding to the root cause alarms to obtain the target root cause of the faults includes: The root causes of the faults corresponding to the multiple sub-faults are fused to obtain the target root cause of the fault.

17. The method according to claim 16, wherein: The operation and maintenance knowledge graph also includes a solution node corresponding to the root cause of the fault, and a fault location node corresponding to the solution node; After obtaining the target fault root cause, the method further includes: Based on the operation and maintenance knowledge graph, a solution corresponding to the target fault root cause is determined, and the fault location is determined according to the solution corresponding to the target fault root cause.

18. The method according to claim 7, wherein: The screening of the alarm data of the fault to obtain an important alarm of at least one sub-fault includes: Performing aggregate fault processing on the received alarms according to the temporal and spatial relationship to obtain alarm data of at least one fault; Splitting the alarm data of the fault according to the business dimension to obtain an alarm of at least one sub-fault, wherein an alarm propagation relationship exists between the alarms of the sub-faults; For each sub-fault alarm, the sub-fault alarm is filtered to obtain an important alarm of the sub-fault.

19. An electronic device comprising: one or more processors; A memory having one or more programs stored thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the fault diagnosis method as described in any one of claims 1-18.

20. A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the fault diagnosis method according to any one of claims 1 to 18.

Images