Alarm Log Compression via Time-Window Segmentation and Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing methods for alarm log compression are inefficient due to low association rule mining efficiency and high time costs, particularly when dealing with large quantities of historical alarm logs, and often result in the loss of valid alarm information or distortion of alarm events.
Innovation Solution
The proposed method involves dividing historical alarm logs into subsets based on generation timestamps to establish temporal correlations, determining correspondence between alarm types and subsets, and performing clustering to generate association rules, which reduces the need for multiple traversals of historical logs and minimizes the number of association rules, thereby improving efficiency and accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If automatic frequent itemset mining method is used to establish association rules, then comprehensive association rules for different alarm types can be obtained, but mining efficiency is low and time costs are high
Solution Approach 1:
The patent segments the alarm log dataset by dividing it into multiple subsets based on time windows. Instead of processing all alarm logs together, the method processes each time window subset separately to generate association rules, then aggregates the results. This segmentation reduces the computational complexity and time required for mining while maintaining comprehensive coverage of different alarm type relationships.
2Reliability
If support degree of frequent itemset is set low to cover rare alarm types, then comprehensiveness of association rules improves, but quantity of association rules increases leading to higher time costs
Solution Approach 1:
The patent applies local quality by setting different minimum support thresholds for different alarm types based on their occurrence frequencies. Common alarm types use higher support thresholds to reduce noise, while rare alarm types use lower thresholds to ensure coverage. This differentiated approach maintains comprehensiveness for rare events while reducing the overall quantity of association rules that require manual verification.
Solution Approach 2:
The method dynamically adjusts the support degree parameter based on alarm type characteristics and time window context. By changing this parameter adaptively rather than using a fixed low threshold, the system achieves comprehensive coverage of rare alarm types while controlling the quantity of generated association rules, thereby reducing time costs for accuracy determination and root cause identification.
3Loss of information
If all alarm logs are presented to network monitoring engineer, then no valid alarm information is lost, but analysis workload is heavy and work efficiency is low
Solution Approach 1:
The patent extracts and presents only the essential alarm information to the network monitoring engineer by identifying root cause alarm types from the generated association rules. Instead of displaying all alarm logs including redundant minor alarm types, the system extracts only the critical root cause alarms that require attention, thereby maintaining information completeness for decision-making while significantly reducing the analysis workload and improving work efficiency.
Data Source
AI summary
An alarm log compression method, apparatus, system, and a storage medium are provided. The method includes: obtaining a historical alarm log set generated by a first network device; dividing the historical alarm log set into a plurality of historical alarm log subsets based on a generation time stamp of a historical alarm log in the historical alarm log set, where all historical alarm logs in each historical alarm log subset are consecutive in a time sequence; determining a correspondence between an alarm type in the historical alarm log set and the plurality of historical alarm log subsets; performing clustering processing on the alarm types in the historical alarm log set based on the correspondence, to generate at least one association rule; and compressing to-be-processed alarm logs based on the at least one association rule, to obtain an alarm log whose alarm type is a root cause alarm type.