Fault Root Cause Analysis Using Alarm Feature Vectors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The accuracy of fault root cause identification in network systems is low due to the large number of alarms generated by network devices, leading to inefficient troubleshooting and increased operational costs.
Innovation Solution
A fault root cause analysis method and apparatus that extracts feature vectors from alarm events and uses a classification model to determine whether an alarm event is a root cause, improving accuracy through machine learning and aggregation based on time correlation, topology correlation, and text similarity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional alarm analysis methods are used to determine root cause alarm events, then the system can process alarm events, but the accuracy of fault root cause identification is low
Solution Approach 1:
The patent transforms the alarm event analysis from traditional single-dimension type matching to multi-dimensional feature space analysis. By extracting features including alarm event type, alarm source, alarm time, and topology relationship, and representing them as feature vectors, the system analyzes alarms from multiple dimensions simultaneously, significantly improving root cause identification accuracy
Solution Approach 2:
The patent changes the analysis parameters from simple alarm type names to comprehensive feature vectors containing multiple attributes. The classification model processes these transformed parameters (feature vectors with alarm event type, alarm source, alarm time, topology relationship) to determine root cause status, achieving higher accuracy through parameter transformation
2Measurement precision
If all alarm events are analyzed individually to identify root causes, then identification accuracy may improve, but the processing time and operational costs increase due to massive quantity of alarms
Solution Approach 1:
The patent performs preliminary actions by pre-extracting features from alarm events and pre-building topology relationships before classification. The system pre-processes alarm data to create feature vectors including alarm event type, alarm source, alarm time, and topology relationship, so that when root cause identification is needed, the classification model can quickly process pre-prepared feature vectors rather than analyzing raw alarm data from scratch
Solution Approach 2:
The patent creates simplified copies of alarm events in the form of feature vectors that capture essential characteristics without containing all the complexity of original alarm data. The classification model operates on these feature vector copies, which preserve the necessary information for root cause identification while enabling faster processing compared to analyzing complete alarm event details
3Measurement precision
If more alarm data is processed to improve root cause identification, then accuracy improves, but the quantity of alarms requiring attention increases, overwhelming O&M engineers
Solution Approach 1:
The patent extracts only the essential features from alarm events that are relevant to root cause identification. Instead of processing all alarm data, the system extracts specific features including alarm event type, alarm source, alarm time, and topology relationship into feature vectors. This selective extraction reduces the effective quantity of data requiring analysis while maintaining the information necessary for accurate root cause identification
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
A fault root cause analysis method and apparatus are provided, to resolve a problem in the prior art that accuracy of fault root cause identification is low. The method includes: obtaining, by the fault root cause analysis apparatus, a first alarm event set, where the first alarm event set includes a plurality of alarm events; for a first alarm event in the first alarm event set, extracting a feature vector of the first alarm event, where a part of or all features of the feature vector are used to represent a relationship between the first alarm event and another alarm event in the first alarm event set; and determining, based on the feature vector of the first alarm event, whether the first alarm event is a root cause alarm event. In this application, whether the first alarm event is the root cause alarm event is determined based on a feature vector of the relationship between the first alarm event and the another alarm event, and the accuracy of fault root cause identification is improved.