CN114911654A

CN114911654A - Fault classification method, device and system

Info

Publication number: CN114911654A
Application number: CN202110180899.XA
Authority: CN
Inventors: 柳丹
Original assignee: Huawei Technologies Co Ltd
Current assignee: Huawei Technologies Co Ltd
Priority date: 2021-02-08
Filing date: 2021-02-08
Publication date: 2022-08-16

Abstract

The application provides a fault classification method, a device and a system, wherein a network management system acquires a plurality of pieces of alarm data corresponding to a target fault and a rule indicating an object relationship, wherein each piece of alarm data respectively indicates a corresponding first object, and the network management system determines a second object and an object relationship between the first object and the second object according to the alarm data and the rule indicating the object relationship. Then, the vector characteristics of each object are calculated according to the object relation between the first object and the second object. And finally, determining the fault type of the target fault according to the object relationship between the first object and the second object and the vector characteristics of each object. The fault classification method provided by the application can analyze the target fault by utilizing the alarm data and the rule indicating the object relation, can effectively solve the problem of delay in judgment by utilizing a plurality of rule matching in the prior art, and improves the efficiency of fault classification.

Description

Fault classification method, device and system

Technical Field

The present application relates to the field of communications technologies, and in particular, to a fault classification method, apparatus, and system.

Background

With the continuous expansion of the scale of the communication network, the network structure is more and more complex, the number of alarms reported to the network management system by the network element increases explosively, the alarms are used for prompting a fault (incident) on the network element, operation and maintenance personnel need to screen out effective alarms from a large number of alarms every day, and diagnose the fault prompted by the effective alarms to determine a fault root cause, so as to repair the fault according to the fault root cause.

Fig. 1 provides a schematic structural diagram of a network management system, where the network management system processes a fault of an operator network through a fault 1-3-5 flow, and the processing of the operator network fault is divided into three parts, namely, fault discovery, diagnosis and repair, which respectively occupy processing times of 1 minute, 3 minutes and 5 minutes. As shown in fig. 1, the network management system collects the alarms reported by the network element through the alarm acquisition module, and then stores the alarms after the noise reduction processing of the alarm noise reduction module. The alarms after the noise reduction processing are periodically pushed into an alarm aggregation module to be divided into different aggregation groups (incidents), namely faults, so that the fault discovery is completed. Before fault root cause analysis is performed on each fault, fault classification needs to be performed on each fault to determine a fault type corresponding to each fault, fault root cause analysis is performed on the fault type corresponding to the fault, and fault repair is performed according to the fault root cause of each fault.

The fault classification engine can be used for identifying fault types of faults, and is constructed by a large number of fault types and development rule codes corresponding to the fault type classification methods of operation and maintenance personnel, so that a large number of rule statements exist in the fault classification engine, and the classification essence of the fault classification engine is to determine the fault types of the faults by polling the rule statements for the faults. Therefore, the fault classification engine is adopted to identify the fault type of the fault, and a large amount of time is consumed in the process of polling the rule statement, so that the real-time performance of fault diagnosis cannot be ensured due to the fact that the follow-up analysis fault root exceeds the preset time.

Disclosure of Invention

The application provides a fault classification method, a fault classification device and a fault classification system, which are used for improving the efficiency of fault classification so as to ensure the real-time performance of fault diagnosis.

In a first aspect, the present application provides a fault classification method. The method comprises the following steps: the network management system acquires a plurality of alarm data corresponding to the target fault and a rule indicating an object relationship, wherein each alarm data in the plurality of alarm data respectively indicates a corresponding first object, and the object relationship refers to the relationship between the first object indicated by the alarm data and a second object related to the first object. The network management system determines a second object and an object relationship between the first object and the second object according to the alarm data and a rule indicating the object relationship.

The network management system determines the vector characteristics of each object according to the object relationship between the first object and the second object, wherein the objects comprise the first object and the second object.

The network management system determines the fault type of the target fault according to the object relationship between the first object and the second object and the vector characteristics of each object.

Therefore, the target fault can be analyzed by utilizing the alarm data and the prestored rules indicating the object relation without depending on expert experience, for example, the process of obtaining a fault type by expert analysis is not needed, namely, the fault type is judged without the rule generated according to the expert experience, the problem of delay in the conventional judgment by utilizing a plurality of rule matching is solved, and the fault classification efficiency is effectively improved.

In one implementation, the acquiring, by the network management system, alarm data corresponding to the target fault includes:

the network management system acquires the related information of the alarm corresponding to the target fault.

The network management system acquires the relevant parameters of the alarm according to the relevant information of the alarm.

The network management system determines alarm data, wherein the alarm data comprises alarm related information and alarm related parameters.

Therefore, information and parameters related to each alarm corresponding to the target fault can be deeply mined, and the accuracy of fault type judgment is improved.

In one implementation, the related information of the alarm includes an identifier, a name, a resource ID of a corresponding physical location, and/or a corresponding network element device name of the alarm. The relevant parameters of the alarm comprise network physical topology data, network element configuration data and/or key performance indicator data relevant to the network element.

Therefore, the type of the alarm data used for judging the type of the target fault can be flexibly adjusted according to actual requirements.

In one implementation, the acquiring, by the network management system, the rule indicating the object relationship includes:

the network management system obtains the corresponding rule indicating the object relation according to the relevant information of the alarm and the relevant parameters of the alarm.

In this way, the corresponding rules indicating object relationships can be accurately matched by data related to alarms.

In one implementation, the determining, by the network management system, the second object according to the alarm data and the rule indicating the object relationship, and the object relationship between the first object and the second object includes:

the network management system determines the related information of the alarm and the first object indicated by the related parameter of the alarm.

The network management system determines a second object corresponding to the first object according to a rule indicating the object relationship.

The network management system determines an object relationship between the first object and the second object, the object relationship being a relationship described in a rule indicating an object relationship.

In this way, the alarm data can be instantiated in the object relationship corresponding to the first object and the second object so as to accurately determine the object relationship of the first object and the second object in the actual scene, and therefore the accuracy of fault classification can be improved.

In one implementation, if there are a plurality of rules indicating object relationships, and each rule indicating object relationships corresponds to related information of an alarm or related parameters of an alarm, the network management system further includes, before determining a second object corresponding to the first object according to the rule indicating object relationships:

the network management system determines the rules indicating the object relationship corresponding to the relevant information of the alarm or the relevant parameters of the alarm.

Therefore, the corresponding relation between each rule indicating the object relation and each alarm data can be established, the rule indicating the object relation can be conveniently applied to the corresponding alarm data, and the accuracy of the instantiation process is ensured.

In one implementation manner, if there is one rule indicating an object relationship, and the rule indicating the object relationship corresponds to related information of an alarm and related parameters of the alarm, the network management system further includes, before determining a second object corresponding to the first object according to the rule indicating the object relationship:

the network management system determines the rule indicating the object relationship corresponding to the related information of the alarm or the related parameter of the alarm in the rule indicating the object relationship.

Therefore, the corresponding relation between each part of rules in the rules indicating the object relation and each kind of alarm data can be established, so that each rule indicating the object relation can be conveniently applied to the corresponding alarm data, and the accuracy of the instantiation process is ensured.

In one implementation, the network management system constructs a topology map including each object and a pointing relationship between the first object and the second object.

In this way, each object, and the relationships between objects, can be visualized for easy viewing by the relevant person.

In one implementation, the vector features of each object include an in-degree vector feature, an object type vector feature, and an alarm type vector feature.

Therefore, the characteristic of each object can be deeply excavated by excavating the vector characteristics of different types of each object related to the alarm, so that the accuracy of the basis for judging the target fault is ensured, and the accuracy of judging the type of the target fault is further improved.

In one way of realisation of the invention,

the network management system determines the vector characteristics of each object according to the object relationship between the first object and the second object, and comprises the following steps:

the network management system calculates the degree of each object, wherein the degree of the degree refers to the total number of pointed objects in all corresponding pointing relations of each object.

The network management system takes the degree of entry as a vector element and establishes the degree of entry vector characteristics of each object.

Therefore, the characteristics of each object in the object pointing relationship can be effectively mined, and the accuracy of judging the object relationship between each object and other objects is improved.

In one way of realisation of the invention,

the rule indicating the object relationship comprises an object type of each object, and the network management system determines the vector characteristics of each object according to the object relationship between the first object and the second object, wherein the method comprises the following steps:

the network management system obtains the object type corresponding to the first object and the second object in the determined object relationship.

The network management system determines the code corresponding to each object according to the corresponding relationship between the pre-stored object type and the code.

The network management system takes the code corresponding to each object as a vector element to establish the object type vector characteristics of each object.

Therefore, the characteristics of each object in the object type direction can be effectively mined, and the accuracy of judging the object type of each object is improved.

In one implementation, the determining, by the network management system, the vector feature of each object according to the object relationship between the first object and the second object includes:

the network management system determines the alarm type according to the alarm data.

The network management system determines the code corresponding to the alarm type according to the corresponding relationship between the pre-stored alarm type and the code.

The network management system takes the codes corresponding to the alarm types as vector elements to establish the alarm type vector characteristics of each object.

Therefore, the characteristics of each object in the direction of the alarm type can be effectively mined, and the alarm types of each object corresponding to the same alarm are effectively unified.

In one implementation, the calculating, by the network management system, the vector feature of each object according to the object relationship between the first object and the second object includes:

the network management system transversely splices each vector characteristic corresponding to each object to obtain the vector characteristic of each object.

In this way, the feature vectors corresponding to each object can be aggregated to facilitate analysis of the feature vectors of each object.

In a second aspect, the present application provides a fault classification device. The device comprises: the device comprises a receiving module and a processing module.

The receiving module is used for acquiring a plurality of alarm data corresponding to the target fault and a rule indicating an object relationship, wherein each alarm data in the plurality of alarm data indicates a corresponding first object, and the object relationship refers to a relationship between the first object indicated by the alarm data and a second object related to the first object.

The processing module is used for determining a second object and an object relationship between the first object and the second object according to the alarm data and a rule indicating the object relationship.

The processing module is further configured to determine a vector feature of each object according to an object relationship between the first object and the second object, where the objects include the first object and the second object.

The processing module is further used for determining the fault type of the target fault according to the object relation between the first object and the second object and the vector characteristics of each object.

In one implementation, the receiving module is further configured to obtain information related to an alarm corresponding to the target fault.

The receiving module is also used for acquiring relevant parameters of the alarm according to the relevant information of the alarm.

The processing module is further used for determining alarm data, and the alarm data comprises alarm related information and alarm related parameters.

In one implementation, the related information of the alarm includes an identifier and a name of the alarm, a resource ID corresponding to a physical location, a corresponding physical location, and/or a corresponding network element device name; the relevant parameters of the alarm comprise network physical topology data, network element configuration data and/or key performance indicator data relevant to the network element.

In an implementation manner, the receiving module is further configured to obtain a corresponding rule indicating an object relationship according to the related information of the alarm and the related parameter of the alarm.

In one implementation, the processing module is further configured to determine relevant information of the alarm and a first object indicated by relevant parameters of the alarm;

the processing module is further configured to determine a second object corresponding to the first object according to a rule indicating an object relationship;

the processing module is further configured to determine an object relationship between the first object and the second object, the object relationship being a relationship described in a rule indicating an object relationship.

In one implementation, if the rule indicating the object relationship is multiple, and each rule indicating the object relationship corresponds to the related information of the alarm or the related parameter of the alarm, the processing module is further configured to determine the rule indicating the object relationship corresponding to the related information of the alarm or the related parameter of the alarm before determining the second object corresponding to the first object according to the rule indicating the object relationship.

In one implementation, if the rule indicating the object relationship is one, and the rule indicating the object relationship corresponds to the related information of the alarm and the related parameter of the alarm, the processing module is further configured to determine the rule indicating the object relationship corresponding to the related information of the alarm or the related parameter of the alarm in the rule indicating the object relationship before determining the second object corresponding to the first object according to the rule indicating the object relationship.

In one implementation, the processing module is further configured to construct a topological graph that includes each object and a pointing relationship between the first object and the second object.

In this way, each object, and the relationships between objects, can be visualized for viewing by the relevant person.

Therefore, the characteristics of each object can be deeply excavated by excavating the vector characteristics of different types of each object related to the alarm, so that the accuracy of a basis for judging the target fault is ensured, and the accuracy of judging the type of the target fault is improved.

In one implementation, the processing module is further configured to calculate an in-degree of each object, where the in-degree refers to a total number of pointed objects in all corresponding pointing relationships of each object.

The processing module is further used for establishing the in-degree vector characteristics of each object by taking the in-degree as a vector element.

In one implementation, the rule indicating the object relationship includes an object type of each object, and the processing module is further configured to obtain an object type corresponding to the first object and the second object in the determined object relationship.

The processing module is also used for determining the code corresponding to each object according to the corresponding relationship between the pre-stored object type and the code.

The processing module is further configured to establish an object type vector feature of each object by using the code corresponding to each object as a vector element.

In one implementation, the processing module is further configured to determine an alarm type according to the alarm data.

The processing module is also used for determining the codes corresponding to the alarm types according to the corresponding relationship between the pre-stored alarm types and the codes.

The processing module is also used for establishing the alarm type vector characteristics of each object by taking the codes corresponding to the alarm types as vector elements.

In one implementation, the processing module is further configured to transversely splice the vector features corresponding to each object to obtain the vector feature of each object.

In a third aspect, the present application further provides a network management system. The network management system comprises a memory and a processor, wherein the memory is coupled with the processor. The memory is configured to store computer program code/instructions which, when executed by the processor, cause the processor to perform the method of the first aspect and its implementation above for fault classification of a target fault.

In a fourth aspect, the present application provides a network system. The network system comprises a network management system, a network card and at least one network element, wherein the at least one network element sends an alarm instruction to the network management system through the network card, and the network management system receives the alarm instruction and executes the method in the first aspect and the implementation mode thereof to perform fault classification on the target fault.

In a fifth aspect, the present application further provides a computer storage medium. The computer storage medium stores computer instructions that, when executed on a storage device, cause the storage device to perform the method of the first aspect and its implementation.

In a sixth aspect, the present application further provides a computer program product containing instructions which, when run on a computer, cause the computer to perform the method of the first aspect and its implementation manner.

In a seventh aspect, the present application further provides a chip system, which includes a processor, configured to support the apparatus or device to implement the functions referred to in the first aspect and the implementation manner thereof, for example, to generate or process information referred to in the method.

Drawings

In order to more clearly explain the technical solution of the present application, the drawings needed to be used in the embodiments will be briefly described below, and it is obvious to those skilled in the art that other drawings can be obtained according to the drawings without any creative effort.

Fig. 1 is a schematic structural diagram of a network management system provided in the present application;

fig. 2 is a schematic structural diagram of a network system according to an embodiment of the present application;

fig. 3 is a schematic structural diagram of a network management system according to an embodiment of the present application;

fig. 4 is a schematic data structure diagram of fault data provided in an embodiment of the present application;

fig. 5 is a schematic data structure diagram of an alarms field according to an embodiment of the present application;

fig. 6 is a schematic structural diagram of a fault classification module according to an embodiment of the present application;

fig. 7 is a schematic flowchart of a fault classification method according to an embodiment of the present application;

fig. 8 is a schematic diagram of a rule indicating an object relationship related to an attribute of an alarm itself according to an embodiment of the present application;

fig. 9 is a schematic diagram of a rule indicating an object relationship related to a local topology of a network element where an alarm is located according to an embodiment of the present application;

fig. 10 is a schematic diagram of a rule indicating an object relationship related to network element configuration corresponding to an alarm when the alarm occurs according to an embodiment of the present application;

fig. 11 is a schematic diagram of a rule indicating an object relationship related to a KPI corresponding to an alarm according to an embodiment of the present application;

FIG. 12 is a diagram of data related to attributes of alarms provided in an embodiment of the present application;

fig. 13 is data related to a local topology of a network element where an alarm is located according to an embodiment of the present application;

fig. 14 is data related to network element configuration corresponding to an alarm occurring according to an embodiment of the present application;

fig. 15 is data related to KPIs corresponding to alarms according to an embodiment of the present application;

FIG. 16 is a schematic diagram of a topology provided by an embodiment of the present application;

fig. 17 is a schematic software module diagram of a network management system according to an embodiment of the present application.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

Fig. 2 provides a schematic structural diagram of a network system, where the network system includes a network management system, a network card and at least one network element, and fig. 2 takes the case where the network system includes a network management system 1, a network card 2 and a network element 3 as an example. In a network system (a network environment deployed by an actual operator or an enterprise, including a physical link and network devices at different levels), when a network element 3 monitors a problem, it generates relevant information of an alarm (alarm) for the monitored problem, and reports the relevant information of the alarm to a network management system 1 through a gateway 2, where the network management system 1 refers to a set having a network management function, such as the structure of the network management system 1 shown in fig. 1, and the network management system 1 summarizes the relevant information of the received alarm through an alarm acquisition module 11, and performs noise reduction on the summarized relevant information of the alarm through an alarm noise reduction module 12, for example, removes relevant information of invalid alarms such as jitter, engineering state, and the like, and stores the relevant information of the alarm after noise reduction to a database.

Fig. 3 is a schematic structural diagram of a network management system according to an embodiment of the present application. The gateway system may be a network host, a server, or the like, and may monitor the alarm of each network element 3. The network management system 1 may include: at least one processor, at least one memory, and at least one interface unit. As an example, as shown in fig. 3, the network management system 1 may specifically include a processor 101, a memory 102, and an interface unit 103, where the processor 101, the memory 102, and the interface unit 103 are coupled. The memory 102 stores program instructions, and the processor 101 can call the program instructions in the memory 102 to enable the network management system 1 to execute relevant methods, such as data collection, data instantiation, vector feature extraction, fault classification, root cause analysis, fault repair, and the like. The interface unit 103 is configured to implement data exchange with the network card 2, and the interface unit 103 may include one or more optical fiber link interfaces, ethernet interfaces, microwave link interfaces, or copper wire interfaces.

In this embodiment, the related information of the alarm includes an identifier of the alarm, a name of the alarm, a time when the alarm occurs, a name of a network element device corresponding to the alarm occurs, a resource ID of a physical location corresponding to the alarm occurs, and/or a physical location corresponding to the alarm occurs, that is, the related information of the alarm may be a combination of one or more of the above data, or other information related to the alarm may be used according to an actual requirement, and is not expanded one by one here. The network management system 1 performs aggregation processing on the alarm data after noise reduction through the alarm aggregation module 13, and may aggregate the alarm data by synthesizing dimensions such as alarm occurrence time, alarm name, network element physical topology, and the like, so as to form different aggregation group (incedent) data, that is, fault data, as shown in fig. 4, fig. 4 is a data structure diagram of fault data provided in the embodiment of the present application, as shown in fig. 4, the fault data mainly includes a name field and an alarms field, the name field is used to describe a name of a fault, the alarms field is used to describe related information of all alarms associated with the fault, where, as shown in fig. 5, fig. 5 is a data structure diagram of an alarms field provided in the embodiment of the present application, as shown in fig. 5, the alarms field mainly includes a csn field, a name field, a neName field, a mocdn field, and a moi field, and the n field is used to describe a unique identifier of an alarm, the name field is used for describing the name of the alarm, the neName field is used for describing the name of the network element equipment corresponding to the alarm, the moDn field is used for describing the resource ID of the physical location corresponding to the alarm, and the moi field is used for describing the physical location corresponding to the alarm. A fault may comprise at least one alarm, i.e. information relating to at least one alarm. In order to analyze the fault root cause of the fault, the network management system 1 firstly classifies the fault of each fault through the fault classification module 14, and carries out targeted root cause analysis on the classified fault through the fault root cause analysis module 15, and finally repairs the corresponding fault through the fault repair module 16 according to the fault root cause.

In order to improve the fault classification efficiency, a fault classification module as shown in fig. 6 may be used to classify the fault, and fig. 6 is a schematic structural diagram of a fault classification module according to an embodiment of the present disclosure, where the fault classification module 14 includes a data obtaining module 141, a fault instantiation module 142, a feature extraction module 143, a model inference module 144, and a result output module 145. The fault classification module 14 classifies the target fault according to the fault classification method shown in fig. 7, and fig. 7 is a schematic flow diagram of a fault classification method provided in the embodiment of the present application, which is specifically as follows:

s1, acquiring a plurality of alarm data corresponding to the target fault and a rule indicating an object relationship, wherein each alarm data in the plurality of alarm data indicates a corresponding first object, and the object relationship refers to a pointing relationship between the first object indicated by the alarm data and a second object related to the first object.

S2, determining the second object and the object relationship between the first object and the second object according to the alarm data and the rule indicating the object relationship.

S3, determining the vector characteristics of each object according to the object relation between the first object and the second object, wherein the objects comprise the first object and the second object.

S4, determining the fault type of the target fault according to the object relation between the first object and the second object and the vector characteristics of each object.

In the embodiment of the present application, a fault that needs to be currently subjected to fault classification is referred to as a target fault, and in order to perform fault classification on the target fault, alarm data corresponding to the target fault needs to be acquired first. As can be seen from the above, the alarm aggregation module 13 stores the fault data in the database, so that the data acquisition module 141 can directly acquire the fault data corresponding to the target fault from the database, as shown in fig. 4, the fault data includes a name field, and thus the fault data corresponding to the target fault, that is, the alarms field, can be acquired from each fault data according to the name field. In this embodiment, for example, the alarms field includes only one alarm data, specifically, the csn field is "10000", the name field is "ETH _ LOS", the neName field is "net element a", the moDn field is "moDn-10000", and the moi field is "card-1-port-1". As can be seen, the alarms field indicates the relevant information of each alarm corresponding to the target fault.

The data obtaining module 141 collects relevant parameters of the alarm in real time according to the relevant information of the alarm, in this embodiment, the relevant parameters of the alarm include network topology data, network element configuration data, and/or Key Performance Indicator (KPI) data related to the network element. The network topology data may include physical link data, network element link information data, and network element information data, and may be regarded as static data within a period of time; the network element configuration data may include a routing cost table of the network element, a board configuration, an operating MODE of an OPTICAL MODULE (WORKING _ MODE), an OPTICAL MODULE CHANNEL (OPTICAL _ CHANNEL) (center wavelength), an OPTICAL MODULE rate (OPTICAL _ MODE _ SPEED), a PORT ENABLE state (PORT _ ENABLE _ STATUS), and the like; KPI data is index data configured for an alarm type and may include whether port light emission is too low, e.g., less than-10, i.e., low light emission (txpowerlown), whether port light emission is not, e.g., less than-30, i.e., no light emission (noTxPower), whether port light reception is too low, e.g., less than-17, i.e., low light reception (rxpowerlown), whether port light reception is not, e.g., less than-40, i.e., no light reception (noRxPower), and the like. In this embodiment, the related information of the alarm and the related parameter of the alarm are defined as alarm data.

After the alarm data of the target fault is obtained through the above process, the alarm data needs to be substituted into the pre-stored object relationship to instantiate the object relationship.

In this embodiment, the network management system 1 stores in advance a rule indicating an object relationship, where the object relationship refers to a pointing relationship between a first object and a second object related to the first object indicated by the alarm data, and it is seen that the second object corresponds to related information of the alarm and related parameters of the alarm. As can be seen from the above, the alarm data includes alarm related information, network topology data, network element configuration data, and KPI data. Therefore, if the rule indicating the object relationship is a summary of rules corresponding to the information related to the alarm, the network topology data, the network element configuration data, and the KPI data, the rule indicating the object relationship may be split into four parts according to the alarm data, including an indication rule corresponding to the information related to the alarm (as shown in fig. 8), an indication rule corresponding to the local topology of the network element where the alarm is located (as shown in fig. 9), an indication rule corresponding to the network element configuration corresponding to the alarm when the alarm occurs (as shown in fig. 10), and an indication rule corresponding to the KPI corresponding to the alarm (as shown in fig. 11), so as to determine the indication rules corresponding to the information related to the alarm, the network topology data, the network element configuration data, and the KPI data. If there are a plurality of rules indicating object relationships, and each rule indicating object relationship corresponds to related information of an alarm, network topology data, network element configuration data, or KPI data, at this time, the above four data may be directly corresponding to each rule indicating object relationship.

In some embodiments, the relevant parameters of the alarm may be increased or decreased as needed, and are not expanded here.

After the corresponding relationship between the alarm related information, the network topology data, the network element configuration data, and the KPI data and the rule indicating the object relationship is established, the fault instantiation module 142 may substitute the data into the corresponding indication relationship to instantiate the object relationship. As shown in fig. 8-11, the object relationship is usually in the form of "object-relationship-object", where the relationship represents the relationship between two objects. If an object located in the left column is referred to as a first object and an object located in the right column is referred to as a second object, the second object corresponding to the first object can be obtained through the relationships in fig. 8 to 11. For example, in fig. 9, the first object is "NetworkElement", the second object is "NetworkElement", and the relationship between the first object and the second object is "neNextToNe", that is, "all neighbor network elements of the current network element", that is, the first object is the current network element, and the second object is a neighbor network element of the first object.

Substituting the related information of the alarm into the rule indicating the object relationship corresponding to the related information of the alarm can obtain the first object, the second object, and the pointing relationship between the first object and the second object as shown in fig. 12. For example, "NetworkElement" shown in fig. 8 is "network element a," and query content corresponding to "sendAlarm" is "all alarms occurring at the current network element. Therefore, "Alarm" having a "sendarlarm" relationship with "NetworkElement" is "10000".

The network topology data is substituted into the object relationship related to the local topology of the network element where the alarm is located, so as to obtain the topology relationship data as shown in fig. 13. For example, "NetworkElement" shown in fig. 9 is "network element a", and "nettexttonene" corresponds to query contents of "all neighbor network elements of the current network element", and thus "NetworkElement" having a relationship of "nettexttonene" with "NetworkElement" is "network element B", "network element C", and "network element D", respectively.

The network element configuration data is substituted into the object relationship related to the network element configuration corresponding to the alarm occurrence, so as to obtain the data related to the network element configuration shown in fig. 14, for example, as shown in fig. 10, the "Port" is "network element a-card-1-Port-1", the query content corresponding to "workmode" is "the working mode of the optical module of the Port reporting the Port type alarm and the Port at the opposite end", in this embodiment, as can be seen from fig. 7, the alarm type of the Port is "ETH _ LOS", that is, the query content is "the working mode of the optical module of the Port reporting the ETH _ LOS type alarm and the Port at the opposite end", and therefore, the "String" having a "workmode" relationship with the "Port" is "working mode 1".

The KPI data is substituted into the object relationship related to the KPI corresponding to the alarm, so as to obtain the KPI related data shown in fig. 15, for example, the query content corresponding to "Port" shown in fig. 11 is "network element a-card-1-Port-1" and "noRxPower" is "the light receiving rate condition of the Port reporting the Port type alarm and the Port at the opposite end", in this embodiment, as can be seen from fig. 7, the alarm type of the Port is "ETH _ LOS", that is, the query content is "the light receiving rate condition of the Port reporting the ETH _ LOS type alarm and the Port at the opposite end", and therefore, the "Boolean" having a "noRxPower" relationship with "Port" is "TRUE".

Further, the tables in fig. 12-15 may be aggregated into a table (not shown) for ease of management and analysis.

After the second object corresponding to the first object and the pointing relationship between the first object and the second object are determined through the above steps, a topological graph can be further constructed according to the objects (including the first object and the second object) and the pointing relationship between the first object and the second object. Specifically, each of the first object and the second object is taken as a node, and the pointing relationship between the first object and the second object is taken as a connection line, where the connection line has directivity, that is, according to the pointing relationship between the first object and the second object, the object initiating pointing points to the pointed object, thereby constructing the topological graph. For example, the first object is "10000", the second object having a "has Type" relationship with it is "ETH _ LOS", then "10000" and "ETH _ LOS" are two nodes, the connection line between the two nodes points to "ETH _ LOS" from "10000", and the pointing relationship of the connection line is determined by the relationship "has Type". As another example, the first object is "network element a", and the second objects having a relationship of "nexexttonene" with the first object are "network element B", "network element C", and "network element D", then "network element a", "network element B", "network element C", and "network element D" are four nodes, wherein the connecting lines between "network element a" and "network element B", "network element a" and "network element C", "network element a" and "network element D" are all pointed to by "network element a" to another object, and the pointing relationship of the connecting lines is determined by the relationship of "nexxttonene".

As shown in fig. 16, fig. 16 is a schematic diagram of a topology provided in the embodiment of the present application, where nodes and connecting lines on the topology correspond to the relationship between the first object and the second object in fig. 12 to 15.

After the second object and the indication relationship between the first object and the second object are obtained, the feature extraction module 143 may perform vector feature extraction on each object, in this embodiment, the vector feature to be extracted by each object includes an in-degree vector feature, an object type vector feature, and an alarm type vector feature, and the extraction process specifically includes the following steps:

in degree (in degree) is one of the important concepts in graph theory algorithm, and generally refers to the sum of the times that a certain node in a Directed graph (Directed graphs) is used as the end point of a connecting line in the graph, and an in degree vector feature refers to a vector feature constructed by using the in degree as an element.

When the in-degree vector feature of each object is obtained, firstly, the in-degree of each object needs to be calculated, and then the in-degree vector feature of each object is determined by taking the in-degree of each object as a vector element. For example, according to the pointing relationship between each first object and the second object, it is known that "network element E" is only used as the second object of "network element a", "network element B", "network element C", and "network element D", and has a "has Gate way" relationship with "network element a", "network element B", "network element C", and "network element D", respectively, and it is known that "network element a", "network element B", "network element C", and "network element D" all point to "network element E", that is, the number of pointed objects in the pointing relationship of "network element E" is 4, if corresponding to the topological graph, the number of times that "network element E" is used as the end point of the connecting line in the topological graph is 4, therefore, the degree of the "network element E" is 4, and the degree of the "E" can be constructed by using 4 as a vector element [4 ]. For another example, according to the pointing relationship between each first object and each second object, it can be known that "ETH _ LOS" is only used as the second object of "10000" and has a "hasName" relationship with "10000", and it can be known that "10000" points to "ETH _ LOS", that is, the number of pointed objects in the "ETH _ LOS" as the pointing relationship is 1, if the pointed objects are mapped to the topology map, as shown in 16, the number of times that "ETH _ LOS" is used as the end point of the connection line in the topology map is 1, so the degree of entry of "ETH _ LOS" is 1, and 1 is used as the vector element, and the degree of entry vector feature [1] of "ETH _ LOS" can be constructed.

As can be seen from fig. 8 to 11, in the rule indicating the object relationship established in advance, a total of 8 object types are defined, that is, a network element (NetworkElement), an Alarm identifier (Alarm), a single board (Card), a Port (Port), an Alarm type (AlarmType), a Boolean value (Boolean), a String (String), and a floating point (Float), and data indicating the types may be represented in a numeric format by one-hot coding. For example, according to the sequence of "NetworkElement, Alarm, Card, Port, AlarmType, Boolean, String, and Float", the object type corresponding to each object is defined as 1, and the remaining object types are defined as 0, and the object type corresponding to each object is encoded, for example, the object type corresponding to the object is "NetworkElement", and the encoding corresponding to the object is "10000000".

When the object type vector characteristics corresponding to each object are determined, firstly, the object type corresponding to each object in the object relationship needs to be obtained, then, the code corresponding to each object is determined according to the corresponding relationship between the pre-stored object type and the code, and finally, the object type vector characteristics of each object are determined by taking the code corresponding to each object as a vector element.

For example, the object type of the object "network element E" corresponding to the object relationship is "NetworkElement", so that according to the corresponding relationship between the object type and the code, it can be determined that the code corresponding to "network element E" is "10000000", and "10000000" is used as a vector element. The object type vector of the object "element E" is therefore characterized as [10000000 ]. For another example, the object type of the object "ETH _ LOS" corresponding to the object relationship is "alarmttype", and therefore, according to the corresponding relationship between the object type and the code, it can be determined that the code corresponding to "alarmttype" is "00001000", and "00001000" is used as the vector element. The object type vector for the object "ETH LOS" is therefore characterized as [00001000 ].

In this embodiment, some alarm types are predefined and stored in the database of the network management system 1. Each alarm type is configured with a parameter (such as an index) for identifying the alarm type. And further, converting the data indicating the alarm type into a digital format in a one-hot coding mode. For example, the alarm types are sorted in sequence, taking the alarm type "ETH _ LOS" arranged at the first position as an example, the alarm type corresponding to the current alarm displays an index, and the remaining alarm types are 0, which are used as the alarm type corresponding to the current alarm to encode, if the alarm type corresponding to the current alarm is "ETH _ LOS", the corresponding index is 1, then the code corresponding to the "ETH _ LOS" is "10 … 0", where the number of 0 is 84.

When the alarm type vector characteristics corresponding to each object are determined, the alarm type is determined according to the alarm data, then the codes corresponding to the alarm types are determined according to the pre-stored corresponding relationship between the alarm types and the codes, and finally the codes corresponding to the alarm types are used as the alarm type vector characteristics of each object.

For example, in the present embodiment, only one alarm type, i.e., "ETH _ LOS", is included in the alarm data. According to the pre-stored corresponding relation between the alarm type and the code, the index corresponding to the ETH _ LOS is 1, the codes corresponding to the other alarm types are 0, the code corresponding to the ETH _ LOS is 10 … 0, and the number of 0 is 84. In some embodiments, another alarm type is further included in the alarm data, where the alarm "a" is used as an example, where "a" is ranked second in the specified order of the alarms, and the pre-stored correspondence relationship between the alarm type and the index is that "a" corresponds to an index of 1, and codes corresponding to alarm types other than "ETH _ LOS" and "a" are 0, then the codes corresponding to these alarm types are "110 … 0", where the number of 0 is 83. With the codes corresponding to the alarm types as vector elements, alarm type vector features [10 … 0] corresponding to "ETH _ LOS" can be constructed, where the number of 0 is 84, and alarm type vector features [110 … 0] corresponding to "ETH _ LOS" and "a" are constructed, where the number of 0 is 83. In this embodiment, the alarm type vector feature belongs to a global feature, that is, all objects have the same alarm type vector feature at the same time.

After various vector features of each object are obtained through the above process, the vector features and the directional relationship between the first object and the second object may be used as parameters by the model inference module 144, and input into a Graph Convolutional neural Network (GCN) classification model for fault classification calculation.

In this embodiment, first, various vector features on each object are transversely spliced to obtain a final vector feature, where, for example, a node "network element E" is used as an example, an entry vector feature of "network element E" is [4], "object type vector feature of" network element E "is [10000000]," alarm type vector feature of "network element E" is [10 … 0], where the number of 0 is 84, and the three vector features are transversely spliced to obtain a vector feature [4100000010 … 0] of "network element E", where the number of 0 of the omitted portion is 84.

And inputting the vector characteristics of each first object and each second object and the directional relation between the first object and the second object as parameters into a GCN classification model to classify the target fault. In this embodiment, the GCN classification model is a classification model trained in advance, which may be obtained by training fault data of a known fault type, and the fault type of the target fault may be obtained quickly through the GCN classification model. After the fault type of the target fault is output, the GCN classification model may be trained reversely using the training data and the training result of the target fault, that is, the fault data and the fault type of the target fault as sample data, to improve the GCN classification model, and the result output module 145 may output the classification result.

After the fault type of the target fault is obtained, the fault root cause of the target fault can be analyzed by the fault root cause analysis module 15 according to the topological graph and the fault type of the target fault, and further, the target fault can be repaired in a targeted manner by combining fault data of the target fault, such as a network element device name, a physical location resource ID, a physical location and the like, according to the fault root cause through the fault repairing module 16.

In the embodiments provided in the present application, the various aspects of the flow table uploading method provided in the present application are introduced from the perspective of interaction between the devices themselves and between the devices, respectively. It is understood that each device, such as the network device and the storage device, for implementing the functions, includes a corresponding hardware structure and/or software module for executing each function. Those of skill in the art will readily appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as hardware or combinations of hardware and computer software. Whether a function is performed in hardware or computer software drives hardware depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.

For example, the above-mentioned devices implement the corresponding functions by means of software modules.

In one embodiment, as shown in fig. 17, the fault classification apparatus for implementing the function of the behavior of the network management system 1 includes: a receiving module 001 and a processing module 002.

The receiving module 001 is configured to obtain multiple pieces of alarm data corresponding to a target fault and a rule indicating an object relationship, where each piece of alarm data in the multiple pieces of alarm data indicates a corresponding first object, and the object relationship refers to a relationship between a first object indicated by the alarm data and a second object related to the first object;

the processing module 002 is configured to determine the second object and the object relationship between the first object and the second object according to the alarm data and the rule indicating the object relationship;

the processing module 002 is further configured to determine a vector feature of each object according to an object relationship between the first object and the second object, the objects including the first object and the second object;

the processing module 002 is further configured to determine a fault type of the target fault according to an object relationship between the first object and the second object and the vector feature of each object.

In an implementation manner, the receiving module 001 is further configured to obtain information related to an alarm corresponding to the target fault;

the receiving module 001 is further configured to obtain relevant parameters of the alarm according to the relevant information of the alarm;

the processing module 002 is further configured to determine alarm data, where the alarm data includes information related to the alarm and parameters related to the alarm.

In one implementation, the related information of the alarm includes an identifier, a name, a resource ID of a corresponding physical location, and/or a corresponding network element device name of the alarm; the related parameters of the alarm comprise network physical topology data, network element configuration data and/or key performance index data related to the network element.

In an implementation manner, the receiving module 001 is further configured to obtain a corresponding rule indicating an object relationship according to the relevant information of the alarm and the relevant parameter of the alarm.

In one implementation, the processing module 002 is further configured to determine the related information of the alarm and the first object indicated by the related parameter of the alarm;

the processing module 002 is further configured to determine a second object corresponding to the first object according to the rule indicating the object relationship;

the processing module 002 is further configured to determine an object relationship between the first object and the second object, where the object relationship is a directional relationship described in the rule indicating the object relationship.

In one implementation, if there are a plurality of rules indicating object relationships, and each rule indicating object relationships corresponds to the related information of the alarm or the related parameter of the alarm, the processing module 002 is further configured to determine the rule indicating object relationships corresponding to the related information of the alarm or the related parameter of the alarm before determining the second object corresponding to the first object according to the rule indicating object relationships.

In one implementation, if the rule indicating the object relationship is one, and the rule indicating the object relationship corresponds to the related information of the alarm and the related parameter of the alarm, the processing module 002 is further configured to determine the rule indicating the object relationship corresponding to the related information of the alarm or the related parameter of the alarm in the rule indicating the object relationship before determining the second object corresponding to the first object according to the rule indicating the object relationship.

In one implementation, the processing module 002 is further configured to construct a topological map indicating the each object and the directional relationship between the first object and the second object.

In one implementation, the vector feature of each object includes an in-degree vector feature, an object type vector feature, and an alarm type vector feature.

In one implementation, the processing module 002 is further configured to calculate an in-degree of each object, where the in-degree refers to a total number of pointed objects in all corresponding pointing relationships of each object;

the processing module 002 is further configured to establish an in-degree vector feature of each object by using the in-degree as a vector element.

In one implementation, the rule indicating the object relationship includes an object type of each object, and the processing module 002 is further configured to obtain an object type corresponding to each object in the determined object relationship;

the processing module 002 is further configured to determine a code corresponding to each object according to a pre-stored correspondence between the object type and the code;

the processing module 002 is further configured to establish an object type vector feature of each object by using the corresponding code of each object as a vector element.

In one implementation, the processing module 002 is further configured to determine an alarm type according to the alarm data;

the processing module 002 is further configured to determine a code corresponding to the alarm type according to a pre-stored correspondence between the alarm type and the code;

the processing module 002 is further configured to establish an alarm type vector feature of each object by using the code corresponding to the alarm type as a vector element.

In one implementation, the processing module 002 is further configured to transversely splice the vector features corresponding to each object to obtain the vector feature of each object.

Embodiments of the present application also provide a computer storage medium having computer instructions stored therein, which when run on a computer, cause the computer to perform the methods of the above aspects.

Embodiments of the present application also provide a computer program product containing instructions, which when executed on a computer, cause the computer to perform the method of the above aspects.

The application also provides a chip system. The system on chip comprises a processor for enabling the above apparatus or device to perform the functions recited in the above aspects, for example, generating or processing information recited in the above methods. In one possible design, the system-on-chip further includes a memory for storing necessary program instructions and data for the above-described apparatus or device. The chip system may be formed by a chip, or may include a chip and other discrete devices.

The above embodiments are only for illustrating the embodiments of the present invention and are not to be construed as limiting the scope of the present invention, and any modifications, equivalent substitutions, improvements and the like made on the basis of the embodiments of the present invention shall be included in the scope of the present invention.

Claims

1. A method of fault classification, the method comprising:

the network management system acquires a plurality of alarm data corresponding to a target fault and a rule indicating an object relationship, wherein each alarm data in the plurality of alarm data respectively indicates a corresponding first object, and the object relationship refers to a relationship between the first object indicated by the alarm data and a second object related to the first object;

the network management system determines the second object and the object relationship between the first object and the second object according to the alarm data and the rule indicating the object relationship;

the network management system determines the vector characteristics of each object according to the object relationship between the first object and the second object, wherein the objects comprise the first object and the second object;

and the network management system determines the fault type of the target fault according to the object relationship between the first object and the second object and the vector characteristics of each object.

2. The method of claim 1, wherein the acquiring, by the network management system, the alarm data corresponding to the target fault comprises:

the network management system acquires relevant information of an alarm corresponding to the target fault;

the network management system acquires the relevant parameters of the alarm according to the relevant information of the alarm;

the network management system determines alarm data, wherein the alarm data comprises the relevant information of the alarm and the relevant parameters of the alarm.

3. The method according to claim 2, wherein the information related to the alarm comprises an identifier, a name, a resource ID of a corresponding physical location, and/or a corresponding network element device name of the alarm; the related parameters of the alarm comprise network physical topology data, network element configuration data and/or key performance index data related to the network element.

4. The method according to claim 2 or 3, wherein the acquiring, by the network management system, the rule indicating the object relationship comprises:

and the network management system acquires a corresponding rule indicating the object relationship according to the relevant information of the alarm and the relevant parameters of the alarm.

5. The method according to any of claims 2-4, wherein the network management system determining the second object and the object relationship between the first object and the second object according to the alarm data and the rule indicating the object relationship comprises:

the network management system determines the related information of the alarm and a first object indicated by the related parameter of the alarm;

the network management system determines a second object corresponding to the first object according to the rule indicating the object relationship;

and the network management system determines an object relationship between the first object and the second object, wherein the object relationship is a pointing relationship described in the rule indicating the object relationship.

6. The method according to claim 5, wherein if there are a plurality of rules indicating object relationships, and each rule indicating object relationship corresponds to the related information of the alarm or the related parameter of the alarm, the network management system further comprises, before determining the second object corresponding to the first object according to the rule indicating object relationship:

and the network management system determines the rule of the indication object relation corresponding to the relevant information of the alarm or the relevant parameter of the alarm.

7. The method according to claim 5, wherein if there is one rule indicating object relationship, and the rule indicating object relationship corresponds to the related information of the alarm and the related parameter of the alarm, the network management system further comprises, before determining the second object corresponding to the first object according to the rule indicating object relationship:

and the network management system determines the rule indicating the object relationship corresponding to the related information of the alarm or the related parameter of the alarm in the rule indicating the object relationship.

8. The method according to any one of claims 1-7, further comprising:

the network management system constructs a topological graph, and the topological graph indicates each object and the pointing relation between the first object and the second object.

9. The method of any one of claims 1-8, wherein the vector features of each object include an in-degree vector feature, an object type vector feature, and an alarm type vector feature.

10. The method of claim 9, wherein the network management system determining the vector characteristics of each object according to the object relationship between the first object and the second object comprises:

the network management system calculates the degree of entrance of each object, wherein the degree of entrance refers to the total number of pointed objects in all corresponding pointing relations of each object;

and the network management system establishes the entry vector characteristics of each object by taking the entry as a vector element.

11. The method according to claim 9 or 10, wherein the rule indicating the object relationship comprises an object type of each object, and the determining, by the network management system, the vector feature of each object according to the object relationship between the first object and the second object comprises:

the network management system acquires the corresponding object type of each object in the determined object relation;

the network management system determines the code corresponding to each object according to the corresponding relation between the pre-stored object type and the code;

and the network management system takes the code corresponding to each object as a vector element to establish the object type vector characteristics of each object.

12. The method according to any of claims 9-11, wherein the network management system determining the vector characteristics of each object according to the object relationship between the first object and the second object comprises:

the network management system determines the alarm type according to the alarm data;

the network management system determines a code corresponding to the alarm type according to a corresponding relation between a pre-stored alarm type and the code;

and the network management system establishes the alarm type vector characteristics of each object by taking the codes corresponding to the alarm types as vector elements.

13. The method according to any of claims 9-12, wherein the network management system determining the vector characteristics of each object according to the object relationship between the first object and the second object comprises:

and the network management system transversely splices the vector characteristics corresponding to each object to obtain the vector characteristics of each object.

14. A fault classification device, characterized in that the device comprises: the device comprises a receiving module and a processing module;

the receiving module is used for acquiring a plurality of alarm data corresponding to a target fault and a rule indicating an object relationship, wherein each alarm data in the plurality of alarm data indicates a corresponding first object, and the object relationship refers to a relationship between the first object indicated by the alarm data and a second object related to the first object;

the processing module is used for determining the second object and the object relationship between the first object and the second object according to the alarm data and the rule indicating the object relationship;

the processing module is further configured to determine a vector feature of each object according to an object relationship between the first object and the second object, where the objects include the first object and the second object;

the processing module is further configured to determine a fault type of the target fault according to an object relationship between the first object and the second object and the vector feature of each object.

15. The apparatus of claim 14,

the receiving module is further used for acquiring related information of an alarm corresponding to the target fault;

the receiving module is further used for acquiring relevant parameters of the alarm according to the relevant information of the alarm;

the processing module is further configured to determine alarm data, where the alarm data includes information related to the alarm and parameters related to the alarm.

16. The apparatus according to claim 15, wherein the information related to the alarm comprises an identifier, a name of the alarm, a resource ID of a corresponding physical location, a corresponding physical location and/or a corresponding network element device name; the related parameters of the alarm comprise network physical topology data, network element configuration data and/or key performance index data related to the network element.

17. The apparatus of claim 15 or 16,

the receiving module is further configured to obtain a corresponding rule indicating an object relationship according to the relevant information of the alarm and the relevant parameters of the alarm.

18. The apparatus of any one of claims 15-17,

the processing module is further used for determining related information of the alarm and a first object indicated by related parameters of the alarm;

the processing module is further used for determining a second object corresponding to the first object according to the rule indicating the object relation;

the processing module is further configured to determine an object relationship between the first object and the second object, where the object relationship is a pointing relationship described in the rule indicating an object relationship.

19. The apparatus of claim 18, wherein if there are a plurality of rules indicating object relationships, and each of the rules indicating object relationships corresponds to the related information of the alarm or the related parameter of the alarm, the processing module is further configured to determine the rule indicating object relationship corresponding to the related information of the alarm or the related parameter of the alarm before determining the second object corresponding to the first object according to the rules indicating object relationships.

20. The apparatus of claim 18, wherein if there is one rule indicating object relationship and the rule indicating object relationship corresponds to the related information of the alarm and the related parameter of the alarm, the processing module is further configured to determine the rule indicating object relationship corresponding to the related information of the alarm or the related parameter of the alarm in the rule indicating object relationship before determining the second object corresponding to the first object according to the rule indicating object relationship.

21. The apparatus of any one of claims 14-20,

the processing module is further configured to construct a topological graph, where the topological graph indicates each object and a directional relationship between the first object and the second object.

22. The apparatus of any one of claims 14-21, wherein the vector features of each object include an in-degree vector feature, an object type vector feature, and an alarm type vector feature.

23. The apparatus of claim 22,

the processing module is further configured to calculate an in-degree of each object, where the in-degree refers to a total number of pointed objects in all corresponding pointing relationships of each object;

the processing module is further configured to establish an in-degree vector feature of each object by using the in-degree as a vector element.

24. The apparatus according to claim 22 or 23, wherein the rule indicating object relationships comprises an object type of each object,

the processing module is further configured to obtain an object type corresponding to each object in the determined object relationship;

the processing module is further used for determining the code corresponding to each object according to the corresponding relation between the pre-stored object type and the code;

25. The apparatus of any one of claims 22-24,

the processing module is also used for determining the alarm type according to the alarm data;

the processing module is also used for determining a code corresponding to the alarm type according to the corresponding relation between the pre-stored alarm type and the code;

the processing module is further configured to establish an alarm type vector feature of each object by using the code corresponding to the alarm type as a vector element.

26. The apparatus of any one of claims 14-25,

the processing module is further configured to transversely splice the vector features corresponding to each object to obtain the vector feature of each object.

27. A network management system, comprising a memory and a processor, the memory coupled to the processor; the memory for storing computer program code/instructions; the computer program code/instructions, when executed by the processor, cause the processor to perform the method of any of claims 1-13.

28. A network system, characterized in that the network system comprises a network management system, a network card and at least one network element, wherein the at least one network element sends an alarm instruction to the network management system through the network card, and the network management system receives the alarm instruction and classifies a target fault according to the method of any one of claims 1 to 13.