CN115858796A

CN115858796A - Fault knowledge graph construction method and device

Info

Publication number: CN115858796A
Application number: CN202111123124.5A
Authority: CN
Inventors: 姜磊; 严浩; 徐代刚; 杜贤俊
Original assignee: ZTE Corp
Current assignee: ZTE Corp
Priority date: 2021-09-24
Filing date: 2021-09-24
Publication date: 2023-03-28
Also published as: WO2023045417A1

Abstract

The embodiment of the application provides a fault knowledge graph construction method and a device, wherein the method comprises the following steps: performing entity and relation extraction on the rule base to obtain a first candidate set comprising an alarm relation example and a work order dispatching example; performing entity and relation extraction on the real-time data to obtain a second candidate set of an alarm association relation and a work order dispatching relation; performing conflict detection according to the first candidate set and the second candidate set to obtain a target candidate set comprising an effective alarm association relation and work order dispatching knowledge; the target candidate set is fused into the fault knowledge map constructed according to the rule base to obtain an updated fault knowledge map, the problem that a new service new scene cannot be quickly adapted by means of mapping conversion of the rule base and the knowledge base in the related technology can be solved, and the fault knowledge map is updated through combination of real-time data and entity and relation extraction of the rule base, so that the fault knowledge map can be quickly adapted to the new service new scene.

Description

Fault knowledge graph construction method and device

Technical Field

The embodiment of the application relates to the field of communication, in particular to a fault knowledge graph construction method and device.

Background

In the process of building the fault knowledge graph, knowledge extraction is a necessary process, and the knowledge extraction is performed from data of different data sources and different structures to form a data structure understood by the fault knowledge graph, such as a Resource Description Framework (RDF) triple, and the data structure is finally fused into the fault knowledge graph.

For operation and maintenance support, it is not enough to extract knowledge from a rule base and a knowledge base, especially for a 5G scenario, the rules of a new scenario of many new services are not yet formed, and real-time operation and maintenance data, such as alarms, logs, work orders and other operation and maintenance data, need to be analyzed, so as to form rules through manual expert experience, and inject the rules into a telecommunication operation and maintenance fault knowledge map. Depending on the mapping conversion between the rule base and the knowledge base, the method cannot adapt to new scenes of new services quickly, and depending on manual knowledge extraction, the efficiency is relatively low, and the quality cannot be guaranteed.

Aiming at the problem that the mapping conversion of a rule base and a knowledge base in the related technology cannot be quickly adapted to a new scene of a new service, a solution is not provided.

Disclosure of Invention

The embodiment of the application provides a fault knowledge graph construction method and device, and aims to at least solve the problems that a new service new scene cannot be quickly adapted by means of mapping conversion of a rule base and a knowledge base in the related technology, the efficiency is relatively low and the quality cannot be guaranteed by means of manual knowledge extraction.

According to an embodiment of the present application, there is provided a fault knowledge graph construction method, including:

performing entity and relation extraction on the rule base to obtain a first candidate set comprising an alarm relation example and a work order dispatching example;

performing entity and relation extraction on the real-time data to obtain a second candidate set of the alarm association relation and the work order dispatching relation;

performing conflict detection according to the first candidate set and the second candidate set to obtain a target candidate set comprising an effective alarm association relation and work order dispatching knowledge;

and fusing the target candidate set into a fault knowledge graph constructed according to the rule base to obtain an updated fault knowledge graph.

According to another embodiment of the present application, there is also provided a failure knowledge graph constructing apparatus including:

the first extraction module is used for extracting the entity and the relation of the rule base to obtain a first candidate set comprising an alarm relation example and a work order dispatch example;

the second extraction module is used for extracting the entity and the relation of the real-time data to obtain a second candidate set of the alarm association relation and the work order dispatching relation;

the conflict detection module is used for carrying out conflict detection according to the first candidate set and the second candidate set to obtain a target candidate set comprising an effective alarm association relation and work order dispatching knowledge;

and the updating module is used for integrating the target candidate set into the fault knowledge graph constructed according to the rule base to obtain the updated fault knowledge graph.

According to a further embodiment of the application, there is also provided a computer-readable storage medium, in which a computer program is stored, wherein the computer program is arranged to perform the steps of any of the above-mentioned method embodiments when executed.

According to yet another embodiment of the present application, there is also provided an electronic device, comprising a memory in which a computer program is stored and a processor arranged to run the computer program to perform the steps of any of the above method embodiments.

According to the embodiment of the application, entity and relation extraction is carried out on the rule base, and a first candidate set comprising an alarm relation instance and a work order dispatching instance is obtained; performing entity and relation extraction on the real-time data to obtain a second candidate set of an alarm association relation and a work order dispatching relation; performing conflict detection according to the first candidate set and the second candidate set to obtain a target candidate set comprising an effective alarm association relation and work order dispatching knowledge; and the target candidate set is fused into the fault knowledge map constructed according to the rule base to obtain an updated fault knowledge map, so that the problem that the new service new scene cannot be quickly adapted by depending on mapping conversion of the rule base and the knowledge base in the related technology can be solved, and the fault knowledge map is updated by combining real-time data with entity and relation extraction of the rule base, so that the fault knowledge map can be quickly adapted to the new service new scene.

Drawings

Fig. 1 is a block diagram of a hardware structure of a mobile terminal of a failure knowledge graph construction method according to an embodiment of the present application;

FIG. 2 is a flow diagram of a fault knowledge graph construction method according to an embodiment of the present application;

FIG. 3 is a schematic diagram of a fault knowledge graph (RDF) according to an embodiment of the present application;

FIG. 4 is a schematic illustration of extraction of knowledge from a failure knowledge graph according to an embodiment of the present application;

FIG. 5 is a schematic diagram of an alarm association rule according to an embodiment of the application;

FIG. 6 is a schematic diagram of a work order dispatch rule according to an embodiment of the present application;

FIG. 7 is a schematic diagram of a real-time work order fault handling scenario in accordance with an embodiment of the present application (one);

FIG. 8 is a schematic diagram of a real-time work order fault handling scenario according to an embodiment of the present application (two);

FIG. 9 is a schematic diagram of knowledge entity vectorization according to an embodiment of the present application (one);

FIG. 10 is a schematic diagram of knowledge entity vectorization according to an embodiment of the present application (two);

FIG. 11 is a flow diagram of alarm association rule extraction according to an embodiment of the present application;

FIG. 12 is a flow diagram of real-time data extraction according to an embodiment of the present application;

FIG. 13 is a flow diagram of feature engineering according to an embodiment of the present application;

FIG. 14 is a flow diagram of collision detection according to an embodiment of the present application;

FIG. 15 is a block diagram of a fault knowledge map building apparatus according to another embodiment of the present application.

Detailed Description

Embodiments of the present application will be described in detail below with reference to the accompanying drawings in conjunction with embodiments.

It should be noted that the terms "first," "second," and the like in the description and claims of this application and in the drawings described above are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order.

The method embodiments provided in the embodiments of the present application may be executed in a mobile terminal, a computer terminal, or a similar computing device. Taking a mobile terminal as an example, fig. 1 is a hardware structure block diagram of a mobile terminal of the fault knowledge graph constructing method according to the embodiment of the present application, and as shown in fig. 1, the mobile terminal may include one or more processors 102 (only one is shown in fig. 1) (the processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA), and a memory 104 for storing data, where the mobile terminal may further include a transmission device 106 for communication function and an input/output device 108. It will be understood by those of ordinary skill in the art that the structure shown in fig. 1 is only an illustration and is not intended to limit the structure of the mobile terminal. For example, the mobile terminal may also include more or fewer components than shown in FIG. 1, or have a different configuration than shown in FIG. 1.

The memory 104 may be used to store a computer program, for example, a software program and a module of application software, such as a computer program corresponding to the failure knowledge graph constructing method in the embodiment of the present application, and the processor 102 executes various functional applications and service chain address pool slicing processing by running the computer program stored in the memory 104, thereby implementing the method described above. The memory 104 may include high speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include memory located remotely from the processor 102, which may be connected to the mobile terminal over a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The transmission device 106 is used for receiving or transmitting data via a network. Specific examples of the network described above may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a Network adapter (NIC), which can be connected to other Network devices through a base station so as to communicate with the internet. In one example, the transmission device 106 may be a Radio Frequency (RF) module, which is used for communicating with the internet in a wireless manner.

In this embodiment, a method for constructing a failure knowledge graph operating in the mobile terminal or the network architecture is provided, where the method is applied to a terminal, the terminal accesses a current Master Node (MN) cell and a current Secondary Node (SN) cell of a source region through Dual Connection (DC), and fig. 2 is a flowchart of a method for constructing a failure knowledge graph according to an embodiment of the present application, where as shown in fig. 2, the flowchart at least includes, but is not limited to, the following steps:

step S202, entity and relation extraction is carried out on a rule base to obtain a first candidate set comprising an alarm relation example and a work order dispatching example;

step S204, performing entity and relation extraction on the real-time data to obtain a second candidate set of the alarm association relation and the work order dispatching relation;

step S206, performing conflict detection according to the first candidate set and the second candidate set to obtain a target candidate set comprising an effective alarm association relation and work order dispatching knowledge;

and S208, fusing the target candidate set into a fault knowledge graph constructed according to the rule base to obtain an updated fault knowledge graph.

Through the steps S202 to S208, the problem that the related art cannot adapt to a new scene of a new service quickly depending on mapping conversion between the rule base and the knowledge base can be solved, and the failure knowledge graph is updated through combination of real-time data and entity and relationship extraction of the rule base, so that the failure knowledge graph can adapt to the new scene of the new service quickly.

In this embodiment of the application, the step S202 may specifically include:

extracting association relations among different alarms according to key fields for alarm association rules in the rule base to form an alarm relation example, and specifically extracting parent-child alarms and rule description contents according to a first key field; performing left-right word segmentation on the rule description content according to a second key field to obtain left words and right words; respectively carrying out large-class matching on the left participle and the right participle with parent-child alarms to form the alarm correlation example;

and extracting the incidence relation among different alarms in the dispatching condition through key fields for the work order dispatching rule in the rule base to form the work order dispatching instance.

In an alternative embodiment, before step S202, the semi-structured data in the rule base is converted into structured data.

In this embodiment of the application, the step S204 may specifically include: performing correlation mining on alarm data in the real-time data to obtain correlation alarms; extracting alarm content and fault processing content from the work order data in the real-time data according to key fields, wherein the fault processing content at least comprises fault processing conditions, preliminary fault reason judgment and fault processing suggestions; performing word segmentation processing on the alarm content and the fault processing content to obtain one or more reason alarms; determining alarm vectors of the one or more reason alarms according to the similarity; and matching the alarm vector with the correlation alarm to obtain the alarm association relation and the work order dispatching relation.

In this embodiment of the application, the step S208 may specifically include: executing the following operation on each alarm incidence relation and each work order dispatching relation in the second candidate set to obtain the target candidate set consisting of effective alarm incidence relation and work order dispatching knowledge, wherein the alarm incidence relation and the work order dispatching relation which are being executed are called as a current alarm incidence relation and a current work order dispatching relation: judging whether the current alarm association relationship exists in the first candidate set or not; determining that the current alarm association relationship is valid through machine learning under the condition that the judgment result is negative; if so, determining whether the data frequency of the current alarm association relationship is smaller than a preset threshold value or not when the current alarm association relationship is not matched with the alarm relationship instance in the first candidate set and no conflict exists, and if not, determining that the current alarm association relationship is the effective alarm association relationship through machine learning; judging whether the current work order dispatching relation exists in the work order dispatching instance of the first candidate set; and combining the current work order dispatching relation and related alarms into the work order dispatching knowledge under the condition that the judgment result is negative.

In another optional embodiment, before the step S208, summarizing the alarm association relations in the target candidate set according to the relevance; and summarizing the work order dispatching relation in the target candidate set according to the dispatching order.

In this embodiment of the application, the step S208 may specifically include: using keys to represent alarms, and searching corresponding nodes for the effective alarm association relation of the target candidate set and the work order dispatching knowledge in the fault knowledge graph through ontology mapping and entity mapping; when the corresponding node is found, performing content conflict detection to obtain a detection result; when the detection result indicates that no content conflict exists, hanging the effective alarm association relation and the work order dispatching knowledge on the corresponding node; and if the corresponding node is not in the fault knowledge map, establishing a father node in the fault knowledge map, and hanging the effective alarm association relation and the worksheet dispatching knowledge on the established father node.

Fig. 3 is a schematic diagram of a fault knowledge graph RDF according to an embodiment of the present application, as shown in fig. 3, for a fault knowledge graph such as operation and maintenance in the telecommunications industry, a simple RDF triplet cannot assist effective intelligent operation and maintenance, and the RDF of the base station-generation-alarm and base station-activation-cell service portion is only the occurrence of an alarm described briefly, and does not effectively instruct how to effectively process the alarm after the occurrence of the alarm, but needs to establish the RDF of the alarm-cause-alarm portion a, and indicates an alarm association relationship, so that the operation and maintenance can be effectively guided.

In this embodiment, the RDF of the fault knowledge graph is represented by triplets. Knowledge in the fault knowledge graph is represented as an RDF triple which can be represented by SPO (principal object), taking root cause correlation between alarms of the fault knowledge graph as an example, for example, a correlation root cause rule, 5 minutes alarm with machine room a generates alarm B, where a is S of SPO, P of SPO, B is O of SPO, location and time are attributes for 5 minutes, and a certain time period is an example when they occur.

Therefore, the extraction of knowledge from the fault knowledge graph mainly comprises the following steps:

entity extraction, which is also called named entity identification, extracts entities such as an alarm ID (identity), a title, a machine room network element where an alarm occurs, and the like, and alarm occurrence levels from a rule base, a knowledge base, alarm data and work order data;

extracting the relation, namely extracting the relation between the alarm A and the alarm B if the alarm A causes the alarm B, wherein the alarm B is an important alarm and needs to dispatch a work order, namely the relation between the alarm and the work order;

and event extraction, namely extracting alarm data and work order data in the running process, and obtaining the event, such as the occurrence time and the place of the alarm, such as attributes of a worker, processing time length, processing result suggestions and the like of the work order, so as to form related operation and maintenance knowledge.

In the embodiment, the rule base, the knowledge base and the fault specification of the operation and maintenance support of the operator and the equipment manufacturer are subjected to knowledge extraction on the real-time alarm information and the work order information of the operator and the equipment manufacturer, and the extraction result is merged into the operation and maintenance fault knowledge map. The rule base and the knowledge base are fault operation and maintenance knowledge, most fault solutions of fault specifications are written into the rule base and the knowledge base, and for convenience of explanation, the rule base and the knowledge base are collectively referred to in the application.

FIG. 4 is a schematic diagram of knowledge extraction in a failure knowledge graph, as shown in FIG. 4, divided into a design domain and an execution domain, wherein:

step S401, in the design domain, relevant design of knowledge extraction is carried out, including rule base extraction design, semi-structured template design, real-time data extraction design, vectorization design, machine learning design and threshold value design. The method specifically comprises the following steps:

1) Extracting and designing a rule base;

generally, the data of the rule base is structured data and partial semi-structured data, and fig. 5 is a schematic diagram of the alarm association rule according to the embodiment, such as the alarm association rule shown in fig. 5, which includes a rule name, an association manner, a rule description, an association location, a time window, a parent alarm and a child alarm.

The extraction of the rules, whether entity extraction or relationship extraction, mainly adopts a mapping method, that is, the key operation and maintenance fields are mainly required to be defined.

The following is an example of the alarm association rule.

For the alarm association rule, the key fields are association rule name, association mode, specialty and association position. Time window, father alarm, son alarm. For a field value, associating a rule name as the whole content; the association mode is three values including primary and secondary association, frequency association and threshold association; the professional value is wireless/transmission/power supply/core network, or cross-professional; the correlation positions are the same network element correlation, the same machine room or the same link; the time window represents the time difference range of the parent-child alarm; the value of the father alarm is the detailed description of each alarm, the alarm title, the alarm ID and the alarm level, and the son alarms are the same.

Similarly, for the dispatching rule, the corresponding extraction mode of the key fields and the values can be designed similarly. These key fields will be saved as a dictionary.

All key fields in the embodiment can be designed, so that the situation does not exist, for example, the fields are in an "association mode", and other words such as an "association method" are used for bypassing the patent. The latter key fields are all within this range.

2) Designing a semi-structured template;

the semi-structured data can be easily extracted as can be seen from the graph by the rule description and the worksheet rule shown in fig. 3, but the semi-structured data definition template can also be extracted.

Therefore, rule extraction templates are primarily definitions, fields and values for structured data, and fields and templates for semi-structured data.

As shown in fig. 5, the rule description can see that the template can be designed as follows:

XX by (optional) XX;

the relevant associated information can be easily extracted.

FIG. 6 is a schematic diagram of a work order dispatch rule according to an embodiment of the present application, as shown in FIG. 6, including name, whether enabled, rule type, and a dispatch condition, where the dispatch condition may be designed as:

alarm project status = XX or XX, alarm object device type = XX, alarm level = XX, alarm ID = XX;

the 'result', 'cause', 'alarm project state', 'alarm object equipment type', 'alarm level' and 'alarm ID' are template key fields, and after the design, the semi-structured data is converted into structured data.

3) Extracting and designing real-time data;

for real-time operation data, work orders and alarms, fig. 7 is a schematic diagram (one) of a real-time work order fault handling condition according to an embodiment of the present application, and as shown in fig. 7, the fault handling condition is: through network management inquiry, a base station service entrance examination exists, wherein: [ MOVING RING ]: checking the network management to have an alternating current input power failure alarm; [ Wireless ] are: verifying that the network management has a base station service quit alarm; [ TRANSMISSION ]: no related alarm is inquired; [ failed network element status ]: monitoring can be carried out, and the state of the network element is normal; [ preliminary judgment of failure cause ]: monitoring can be carried out, and the state of the network element is normal; [ network level where the faulty network element is located ]: ENODEB; [ preliminary judgment of failure cause ]: the initial judgment is caused by equipment power failure or AC input power failure; [ failure handling comments ]: checking the area power failure condition or checking the power supply condition of the moving ring; [ failure handling time ]: xxxx year xx month xx day xx: xx; [ trouble shooters ]: xxx; [ failure recovery case ]: the fault is cleared, and the clearing time is xxxx year xx month xx day xx: xx.

Defining fields needing to be extracted, such as 'fault cause preliminary judgment', namely operation maintenance and protection fields, including work order subjects, alarm titles, network element names, fault equipment models, fault cities, alarm levels, alarm IDs, alarm occurrence time, alarm order dispatching time, fault processing conditions, fault causes, fault processing time lengths, fault handlers and other fields, and noting that the fields may be named differently but have the same meaning in different operators, designing and defining into a dictionary mode is needed, and contents corresponding to the fields are dynamically analyzed during extraction.

The contents of the initial judgment of the fault cause and the opinion of fault processing are unstructured data, and machine learning is needed for specific learning.

4) Vectorizing design;

in the extraction process, for the analysis of unstructured data in the content, such as the description of fault handling situations, word segmentation and vectorization representation are required to be used for similarity learning, and machine learning is carried out on possible associated parent-child relations (root relations), so that a model algorithm and evaluation indexes are required to be designed, and if supervised learning is available, a label is required to be defined.

And (4) segmenting the non-structural description information, wherein a standard Jieba (Chinese Jieba segmentation) is adopted as a segmentation model. The content of the field "failure cause preliminary judgment" in fig. 7 is preliminarily judged as being caused by equipment power failure or communication input power failure ", the segmentation obtains three words of" equipment power failure "," communication input power failure "and" cause ", the first two words are directly matched with the alarm title, fig. 8 is a schematic diagram (two) of the real-time work order failure handling situation according to an embodiment of the present application, as shown in fig. 8, but the content of the field" failure cause preliminary judgment "has no problem through and development and exchange analysis, 5G cell is judged to be a single mode version, it should be that the AAU version is abnormal to cause RRU abnormality, RRU abnormality causes 4G cell to quit service" — these words, some segmentations such as "cause AAU version abnormality", and "RRU abnormality", but others such as "5G cell abnormality", "4G cell quit service", and a standard spelling, "CU/DU cell abnormality", "cell quit service" is not the same, even different from human to change, some people become "service quit" and thus vector person can be subjected to learning similar language, thus it can perform learning algorithm based on the similarity of the model (nlf) and learning algorithm can be performed.

It should be noted here that the "LTE cell" or RRU is not separately embodied in the failure knowledge graph, and they exist in the resource knowledge graph, and the failure knowledge graph exists in the manner of the alarm and the related association relationship of "LTE cell quit service", and the corresponding work order assignment rule.

5) Machine learning design;

if the 'abnormal version of AAU' causes 'abnormal RRU' is not in the rule base, machine learning is needed to judge the association relation, and the 'abnormal RRU' causes 'service quit of LTE cells' and 'service quit of base stations' due to 'communication input power failure' are in the rule base, and conflict is avoided, so that no learning is needed.

Machine learning employs classification models, and algorithms such as logistic regression (sigmoid)/decision trees, and Support Vector Machines (SVMs) can be selected.

The learned tags may be learned as already defined in the rule base.

Meanwhile, the definition of the evaluation of the learning effect is needed, the classification learning is defined according to the standard Accuracy (Accuracy)/Precision (Precision)/Recall (Recall), specific values are defined, for example, the classification model can be obtained when the Accuracy reaches more than 80%, and the relearning is needed if the Accuracy is less than 80%.

The features of machine learning are as follows:

the characteristics are defined as follows:

-the topological relevance of the associated alarm, network element/board/port;

-the degree of business relationship of the associated alarm, such as the associated cell below the base station;

-the importance of the associated alarm, such as the alarm level;

-professional relationships of the associated alarms, such as interactions between dynamic ring-radio-transmission;

-support/certainty of the associated alarm;

-whether the alarm or the fault is clear (content of "fault recovery case" in fault handling case).

6) And (4) designing a threshold value.

Including the frequency of data mining and the number of associated alarm occurrences analyzed in work order processing.

The frequency of the data cannot be too low, for example, only 1 month of real-time data has single digit times, the number of samples is too small, and the extraction significance is not achieved.

The above is the content of the design domain.

In step S402, the rule extraction module extracts knowledge from the operation and maintenance rules.

The rules are extracted according to the dictionary defined in step S401.

For the alarm rule, extracting the alarm and alarm relation, and forming an alarm association rule by using RDF triples, wherein the following rules are used as examples:

alarm 1: the base station gives an alarm of service quit (secondary alarm, ID: 100-1111);

and (2) warning: AC input power failure alarm (three-level alarm, 500-0003);

RDF: alarm 2 causes alarm 1 (same machine room time window);

the alarms and their associations are merged into the alarm relationship example of the fault knowledge graph shown in fig. 3.

And extracting the alarm in the order dispatching condition according to the work order dispatching rule, namely the work order example can be merged into the fault knowledge map.

At this step, both the entities and the relationships are extracted.

For alarm association, the entities are alarm 1 and alarm 2, and the relationship is that alarm 2 can cause alarm 1;

for a work order assignment, the work order assignment is assigned with alarm 1 because of alarm 2.

Step S403, the real-time extraction module extracts real-time alarm and work order data.

The extraction of real-time data, such as alarm data and work order data, can assist in discovering knowledge that the rule base does not have, as illustrated by alarm A-cause-alarm B in FIG. 3.

The existing rules are generally mature knowledge, for example, in a 4G equipment room in a traditional network, a moving-loop (power environment) network element, a wireless network element and a transmission network element exist, and then the moving-loop network element has a fault, for example, a power failure or a power supply alarm caused by municipal power outage may cause a base station in the same room to fall back, and then a 4G cell falls back (LTE cell).

According to the priori knowledge, similar situations also exist after the 5G network is built, a 5G equipment room is provided with a moving loop (power environment) network element, a wireless network element and a transmission network element, and then the moving loop network element generates faults, such as power failure caused by municipal power failure or power supply alarm, the moving loop network element possibly returns to service with a 5G base station of the room, and then the moving loop network element returns to service in a 5G cell (CU/DU cell).

In this case, even if the rule base has no corresponding knowledge, when similar alarms and work orders exist, operation and maintenance personnel can easily process faults according to the prior knowledge of the 4G network rule base and import the 5G operation and maintenance knowledge into the knowledge base.

Under the condition that most terminal users are not upgraded to 5G mobile phones, a 5G base station reversely opens 4G to provide 4G cell services, in this case, an AAU (Active Antenna Unit) of a 5G network element needs to support both a 5G cell and a 4G cell, i.e., a dual mode (if only the 5G cell is supported, the single mode), but there may be a time difference of software bug or software upgrade, or the single mode, and if the RRU communication with the 4G network element fails, the RRU is abnormal, which causes the 4G cell to be taken off the service, i.e., the relationship corresponding to the dotted line in fig. 3, and at this time, the 5G cell it serves is normal.

As shown in fig. 8, unless there is very rich research and development knowledge, it is very difficult for the operation and maintenance personnel to pre-define rules or discover failure causes in real time, even if a problem is discovered after the research and development personnel and the operation and maintenance personnel cooperate with each other, the problem is not immediately imported into the rule base, and similar problems need to be inferred through fusion of failure knowledge maps, so that operation and maintenance associated knowledge can be discovered more quickly and accurately by learning real-time operation and maintenance data and extracting knowledge.

Alarm correlations are conditional, such as correlation location and time window, and therefore the possibility of correlation is obtained by data mining first, noting that frequent set mining is not used because they occur infrequently, but rather correlation mining, such as pearson's coefficients, is used to obtain correlations.

Then, the following information is extracted according to the work order data:

the alarm of the work order dispatch, including the position of occurrence, is structured data;

similar field contents of 'preliminary judgment of fault cause' in the case of fault handling, which may be unstructured data;

"failure handling comments" in the case of failure handling are similar to the field contents, which may be unstructured data;

the 'failure recovery condition' in the failure processing condition is similar to the field content, and the content can be used for hard coding whether words such as 'clearing' or 'recovery' exist or not, and can be used for assisting a label for indicating whether the failure processing and the reason judgment are correct or not.

After extraction is finished, matching the information by using the mined correlation alarm, and if one or more pieces of correlation alarm exist, storing the extracted original information.

These raw information, two of which are unstructured data, need to be represented by NLP (natural language processing) for word segmentation and vectorization.

Fig. 9 is a schematic diagram (one) of knowledge entity vectorization according to an embodiment of the present application, and as shown in fig. 9, since there are not many words, the vectorization is encoded with a unique model, i.e., the word has its position in the vector as 1 and other positions as 0.

And (3) after vectorization, performing similarity learning, and learning by adopting a standard LSI or TFIDF model to obtain uniqueness, namely that the 'LTE cell out-of-service', the '4G cell out-of-service' and the 'LTE cell out-of-service' are entities, and then re-taking the unique value.

And the extracted data is used as an alarm correlation candidate and an assignment rule candidate.

Step S404, the conflict detection module performs conflict detection on the knowledge.

After the rule base extraction and the real-time data extraction are finished, collision detection is required to be carried out according to the following modes:

if the real-time data extraction and the rule base are completely matched in alarm and correlation, one is selected;

if the real-time data extraction and the rule base are matched with the alarm, but the correlation conflicts, judging whether the occurrence frequency of the work order correlation processing field and the reason field of the alarm is greater than a threshold value, if so, judging by using a machine learning algorithm model, otherwise, adopting the rule base;

and if the real-time data extraction is not in the rule base, extracting real-time data extraction information, and judging by using a machine learning algorithm model to obtain the correlation.

The conflict detection is carried out on an alarm association rule base and a work order dispatch rule base. Because a new alarm association may be discovered, if the previous dispatch rule base does not exist, a new piece of relevant knowledge may be added.

And after extraction, preparing a subsequent fault knowledge graph.

In steps S403 and S404, the entity is extracted, the relationship is also extracted, the alarm work order event is also extracted, and more information is fused to the failure knowledge graph.

And step S405, the summarizing module summarizes according to the knowledge correlation.

In order to more conveniently integrate into the fault knowledge map, the knowledge needs to be aggregated.

The summary is not simply queued up, but rather is summarized in two parts:

summarizing according to the correlation, summarizing according to the main alarm, wherein the main alarm is key, all the related alarms are collected as value, and summarizing is carried out through hash aggregation;

summarizing according to the dispatching orders, giving an alarm as key according to the dispatching orders, and summarizing the dispatching orders into value according to the dispatching order rule set.

Therefore, the fault knowledge graph is more conveniently merged in follow-up.

And step S406, fusing to enter a fault knowledge graph.

When a summary is obtained, it needs to be merged into the failure knowledge graph. Searching nodes in the fault knowledge graph through ontology mapping and entity mapping by using the key represented alarm, and if the nodes are found, performing content conflict detection to hang corresponding nodes without problems; and if the father node is not in the map, newly building a father node in the fault knowledge map.

In the embodiment, by extracting the rule base and the real-time operation and maintenance data, when the alarm of a new topology of a new type of new service is generated, the new type of new service is easily integrated into the fault knowledge map; by extracting and judging conflict detection in advance, the accuracy of integrating the fault knowledge graph later can be greatly facilitated; the method has a better reference function on the alarm root cause model of the 5G slice complex network and the service.

The data preparation in this embodiment is to rule base and real-time data, including operation and maintenance data such as work orders and alarms, and corresponding rule base.

The rule base is extracted firstly, which is mainly structured data and is relatively easy.

And extracting the real-time alarm and the real-time work order, and using data mining in the middle.

In the extraction process, word segmentation and vectorization are used, and the similarity learning makes the extracted knowledge unique.

After learning, collision detection is carried out, and a classification module is possibly needed to judge the newly extracted relation by machine learning in the collision detection.

And finally, the summarizing module summarizes the extracted knowledge in sequence to prepare for the fusion of the fault knowledge maps.

This is the operation flow of the whole system, as shown in fig. 4.

Fig. 10 is a schematic diagram (two) of knowledge entity vectorization according to an embodiment of the present application, where as shown in fig. 10, entity alarms are vectorized by one-hot coding, vectorization is performed on all possible associated alarms, and one-hot-only coding is adopted, that is, in an n-dimensional vector, only one of itself is 1, and the others are 0. Although the one-hot coding has sparsity, the alarm types per se are not much, so that the memory consumption is not considered too much.

And extracting entities and relations from the rule base, and analyzing the rule base after the rule base and the keyword dictionary are prepared. The following takes an alarm association rule base as an example for explanation. Fig. 11 is a flowchart of extracting an alarm association relationship rule according to an embodiment of the present application, and as shown in fig. 11, the flowchart includes:

step S1101, preparing an alarm association rule base and a keyword dictionary;

step S1102, acquiring an alarm association rule;

step S1103, acquiring the content of the keywords 'association mode' and 'professional';

step S1104, acquiring the content of the keywords 'associated position' and 'time window';

step S1105, obtaining the content of the keywords 'father alarm' and 'son alarm';

step S1106, acquiring the content of the keyword 'rule description';

step S1107, performing left-right word segmentation on the ' rule description content ' caused by the keyword ' and the like;

step S1108, the left word is matched with parent-child alarms in a large category;

step S1109, using the right word to match with the father and son alarms in a large class;

step S1110, forming an alarm associated RDF;

step S1111, extracting the rule is finished and the next rule is continued.

Related contents such as an association mode and a specialty are obtained through keywords, namely column names, and the contents of the related contents are only extracted and used in the fusion of the subsequent fault knowledge graphs.

The associated position and the time window are extracted, so that the subsequent fault knowledge graph fusion can be used, and the data mining verification can be possibly used in the extraction process.

And then, taking out the parent-child alarm, namely the alarm entity, but the association needing the main parent-child relationship does not necessarily clarify the root cause, namely, the parent does not necessarily lead to the child, and the child does not necessarily lead to the parent. The parent and the child are taken, except for alarm combination, important 'parent alarm' is often dispatched in the dispatching process, and the 'child alarm' has reference value as a possible reason in the work order dispatching.

Therefore, the parent and the child cannot be described by root cause RDF, and the rule description needs to be re-analyzed.

After the rule content is extracted, a keyword "cause" is used for word segmentation (note that the keyword "cause" is only an example, and the keyword can also be other defined words such as "cause" and the like), the word on the left of "cause" is a root cause, and the word on the right is a triggered alarm.

The left and right words are matched with parent-child alarms in a large category. The large-class matching means that the parent-child alarm entity may be only a subclass of the left and right words, for example, the base station fallback includes 4G base station fallback and 5G base station fallback, and the large-class matching is required because the power failure of the moving loop can include a mains supply power failure, an alternating current input power failure alarm, an output voltage too low alarm, and the like.

After matching, the root cause RDF, i.e. the left alarm causes the right alarm, can be formed.

Similarly, for the work order rule base, the examples and the relationships may also be extracted, as shown in fig. 6, the content of the keyword "name" and "dispatching condition" is extracted to obtain the specific alarm, and then the work order RDF, that is, the XX alarm dispatching XX work order, may be obtained.

Generally, the entities and relationships extracted from the rule base are accurate and can be used as tags for learning.

In this embodiment, the entities and relationships are extracted from the real-time data, and the real-time data is analyzed after preparing the alarm data and the work order data. Fig. 12 is a flowchart of real-time data extraction according to an embodiment of the present application, as shown in fig. 12, including:

step S1201, preparing alarm and work order data;

step S1202, performing correlation mining on the alarm;

step S1203, extracting alarm related content of the work order through the key fields, wherein the alarm related content comprises occurrence time, position and the like;

step S1204, extract the content of the trouble handling situation of the work order through the key field;

step S1205, extracting 'preliminary judgment of fault reasons', 'fault treatment opinions';

step S1206, segmenting words to obtain one or more reason alarms;

step S1207, calculating the similarity to obtain a corresponding alarm vector;

step S1208, matching the relevant alarm mined out;

and step S1209, obtaining the alarm association relation and the work order dispatching relation.

The alarms are mined by a correlation mining algorithm, such as the pearson coefficient, and frequent set mining is not adopted, because the alarms may be important but not frequent, and the associated alarms may occur rarely, as shown in fig. 8.

And storing the alarm association relation after obtaining the alarm association relation, and then extracting the work order data.

And acquiring alarm content in the work order data according to key fields, such as alarm, alarm occurrence time, occurrence position, alarm ID, alarm level and the like.

According to the principle of dispatching the work order, the alarm after association is found in the early alarm processing may be merged and dispatched into one order, or a single alarm may be adopted, and in any case, whether the real association root cause alarm exists or not needs to be analyzed in the work order dispatching processing.

Therefore, the contents of 'failure cause preliminary judgment' and 'failure treatment suggestion' in the key field 'failure treatment condition' are extracted to obtain the correlation alarm, which may be the root cause alarm and may be more than one.

Since the writing is manual and may not be an accurate language, NLP is needed to perform word segmentation and similarity learning to obtain a unique identifier of the relevant alarm.

And matching with related alarms mined in the prior art, and if the matching is successful, obtaining preliminary RDF candidates, such as alarm association relation and work order RDF.

These candidate sets are subjected to collision detection later.

The feature engineering process, which is exemplified by the above-mentioned features, includes the network element topology relationship, business relationship, professional relationship, alarm level, certainty factor of frequent set, associated alarm occurrence interval, and associated alarm similarity among alarms, and of course, the features are not limited to these features. Fig. 13 is a flow chart of feature engineering according to an embodiment of the present application, as shown in fig. 13, including:

step S1301, preparing an alarm association set;

step S1302, acquiring a current pair of alarms;

step S1303, obtaining the topological relation of the devices where the devices are located;

step S1304, acquiring the service relationship of the equipment where the equipment is located;

step S1305, acquiring the professional relationship, and selecting six-dimensional wireless/data/transmission/core/dynamic ring/cross-network;

step S1306, acquiring the alarm levels of the users according to four levels of 1/2/3/4;

step 1307, obtain the "failure recovery situation" content of the "failure handling situation" in their work orders;

step S1308, segmenting words, calculating the similarity whether an alarm is cleared or not, and obtaining the dimension value 1/0 according to the existence or not;

in step S1309, the normalization process obtains all the features.

All data except the alarm level are normalized, and the normalization is to process the data of each dimension into 1 and 0.

The alarm level is a dimension, and the value is filled according to the alarm level, generally speaking, the higher the alarm level is, the more prominent the alarm root factor tree model is.

For example, if a pair of alarms a and B occur in the BBU and the base station, respectively, the topological relationship between them has two dimensions, where the topological relationship a is the parent of B, and the topological relationship B is not the parent of a, where the first dimension fills in 0 and the second dimension fills in 1, and if there is no topological hierarchical relationship between the two, both the two fills in 0, and the service relationship is handled in the same way.

Professional relations are processed according to six dimensions of wireless/data/transmission/core/moving ring/cross-network, for example, wireless, then the wireless dimension fills in 1, and other dimensions fill in 0.

For the dimension of the correlation data mining, the certainty factor is adopted.

Each work order has corresponding "failure recovery condition" content, which is in the field "failure processing condition", and its partial degree represents whether the reason judgment is correct (as shown in fig. 7 and 8), but the content is unstructured data, after word segmentation is needed, similarity training is used to train whether the result is similar to "alarm clearing" or "alarm recovery", if so, the result is 1, otherwise, the result is 0. Note that this field is not a label for the root in the association, but can be used to train as a feature.

The machine learning knowledge base obtains an SPO classification model, and the classification model of the SPO (principal and guest) is learned through machine learning, so that the weight values of all dimensions of the characteristics are obtained. The supervised learning classification learning algorithm is adopted, and a logistic regression decision tree random forest and the like can be adopted. The process is not complex and is mature, for example, logistic regression has a mature model algorithm library.

Fig. 14 is a flowchart of collision detection according to an embodiment of the present application, as shown in fig. 14, including:

step 1401, preparing a candidate set;

step S1402, obtaining a current candidate RDF;

step S1403, determining whether the candidate RDF is in the rule base, and if yes, executing step S1404, and if no, executing step S1408;

step S1404, matching with a rule base;

step S1405, determining whether the two are matched, if yes, executing step S1402, and if no, executing step S1406;

a step S1406 of determining whether or not there is a conflict, and if yes, executing a step S1407, and if no, executing a step S1402;

step S1407 of determining whether the candidate has a low frequency, and if yes, executing step S1402, and if no, executing step S1408;

step S1408, determining that the candidate is valid through machine learning;

in step S1409, all candidates are summarized for preparation.

And comparing the newly extracted association relation, namely the 5G alarm or the alarm generated by the 3G/4G/5G mixed networking, with the rule base to determine whether conflict exists.

Checking whether the alarm in the candidate set exists or not, if not, judging the association relationship by machine learning to obtain a new association relationship.

If the alarm exists, the alarm is checked to be completely matched with the rule base, and then the next alarm is continued.

If the link relation is changed, the rule base is not required to be correct, and the situation is rarely considered, such as the change of the possible networking, the change of the link relation and the like.

Firstly, judging whether the occurrence frequency is low frequency rarely, if not, the low probability event is not considered, otherwise, machine learning is used for judging again.

Note that, after matching, it is also determined whether there is a conflict, because the alarm association is a relatively complex process, and there may be multiple layers of associations.

Similarly, the same work order as the work order needs to be detected, the work order rule is relatively simpler, whether the work order rule base does not exist or not is mainly checked, and if no relevant alarm exists, the work order rule base is combined into a work order, and then a work order assignment knowledge can be created.

After the conflict detection is finished, the data can be summarized and then a fault knowledge graph is prepared to be merged.

There is also provided a failure knowledge graph constructing apparatus according to another embodiment of the present application, and fig. 15 is a block diagram of the failure knowledge graph constructing apparatus according to another embodiment of the present application, as shown in fig. 15, including:

a first extraction module 152, configured to perform entity and relationship extraction on the rule base, to obtain a first candidate set including an alarm relationship instance and a work order dispatch instance;

a second extraction module 154, configured to perform entity and relationship extraction on the real-time data to obtain a second candidate set of an alarm association relationship and a work order dispatching relationship;

a conflict detection module 156, configured to perform conflict detection according to the first candidate set and the second candidate set, to obtain a target candidate set including an effective alarm association relationship and work order dispatch knowledge;

and an updating module 158, configured to merge the target candidate set into the failure knowledge graph constructed according to the rule base, so as to obtain an updated failure knowledge graph.

In an exemplary embodiment, the first extraction module 152 includes:

the first extraction submodule is used for extracting association relations among different alarms according to key fields for the alarm association rules in the rule base to form the alarm relation example;

and the second extraction submodule is used for extracting the incidence relation among different alarms in the dispatching condition through the key field for the work order dispatching rule in the rule base to form the work order dispatching example.

In an exemplary embodiment, the first extraction submodule is further configured to

Extracting parent-child alarms and rule description contents according to the first key field;

performing left-right word segmentation on the rule description content according to a second key field to obtain left words and right words;

and respectively carrying out large-class matching on the left participle and the right participle and parent-child alarms to form the alarm correlation example.

In an exemplary embodiment, the apparatus further comprises:

and the conversion module is used for converting the semi-structured data in the rule base into structured data.

In an exemplary embodiment, the second extraction module 154 is further configured to extract

Performing correlation mining on alarm data in the real-time data to obtain correlation alarms;

extracting alarm content and fault processing content from the work order data in the real-time data according to key fields, wherein the fault processing content at least comprises fault processing conditions, preliminary fault reason judgment and fault processing suggestions;

performing word segmentation processing on the alarm content and the fault processing content to obtain one or more reason alarms;

determining alarm vectors of the one or more reason alarms according to the similarity;

and matching the alarm vector with the correlation alarm to obtain the alarm association relation and the work order dispatching relation.

In an exemplary embodiment, the collision detection module 156 is further configured to

Executing the following operations on each alarm association relation and each work order dispatching relation in the second candidate set to obtain the target candidate set consisting of effective alarm association relations and work order dispatching knowledge, wherein the executed alarm association relations and work order dispatching relations are called as the current alarm association relations and the current work order dispatching relations:

judging whether the current alarm association relation exists in the first candidate set or not; if the judgment result is negative, determining that the current alarm association relationship is valid through machine learning; if so, determining whether the data frequency of the current alarm association relationship is smaller than a preset threshold value or not when the current alarm association relationship is not matched with the alarm relationship instance in the first candidate set and no conflict exists, and if not, determining that the current alarm association relationship is the effective alarm association relationship through machine learning;

judging whether the current work order dispatching relation exists in the work order dispatching instance of the first candidate set; and under the condition that the judgment result is negative, combining the current work order dispatching relation and related alarms into the work order dispatching knowledge.

In an exemplary embodiment, the apparatus further comprises:

the first summarizing module is used for summarizing the alarm association relation in the target candidate set according to the correlation;

and the second summarizing module is used for summarizing the work order dispatching relation in the target candidate set according to the dispatching order.

In an exemplary embodiment, the update module 158 is further configured to

Using keys to represent alarms, and searching corresponding nodes for the effective alarm association relation of the target candidate set and the work order dispatching knowledge in the fault knowledge graph through ontology mapping and entity mapping;

when the corresponding node is found, performing content conflict detection to obtain a detection result;

when the detection result indicates that no content conflict exists, hanging the effective alarm association relation and the work order dispatching knowledge on the corresponding node;

and when the corresponding node is not in the fault knowledge map, establishing a father node in the fault knowledge map, and hanging the effective alarm association relation and the worksheet dispatching knowledge on the established father node.

Embodiments of the present application further provide a computer-readable storage medium having a computer program stored therein, wherein the computer program is configured to perform the steps in any of the above method embodiments when executed.

In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to: various media capable of storing computer programs, such as a usb disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic disk, or an optical disk.

Embodiments of the present application further provide an electronic device comprising a memory having a computer program stored therein and a processor configured to execute the computer program to perform the steps of any of the above method embodiments.

In an exemplary embodiment, the electronic apparatus may further include a transmission device and an input/output device, wherein the transmission device is connected to the processor, and the input/output device is connected to the processor.

For specific examples in this embodiment, reference may be made to the examples described in the foregoing embodiments and exemplary implementations, and details of this embodiment are not repeated herein.

It will be apparent to those skilled in the art that the various modules or steps of the present application described above may be implemented using a general purpose computing device, they may be centralized on a single computing device or distributed across a network of multiple computing devices, and they may be implemented using program code executable by the computing devices, such that they may be stored in a memory device and executed by the computing devices, and in some cases, the steps shown or described may be performed in an order different than that described herein, or they may be separately fabricated into separate integrated circuit modules, or multiple ones of them may be fabricated into a single integrated circuit module. Thus, the present application is not limited to any specific combination of hardware and software.

The above description is only a preferred embodiment of the present application and is not intended to limit the present application, and various modifications and changes may be made to the present application by those skilled in the art. Any modification, equivalent replacement, improvement and the like made within the principle of the present application shall be included in the protection scope of the present application.

Claims

1. A fault knowledge graph construction method is characterized by comprising the following steps:

2. The method of claim 1, wherein performing entity and relationship extraction on the rule base to obtain a first candidate set comprising an alarm relationship instance and a work order worksheet instance comprises:

extracting association relations among different alarms according to the alarm association rules in the rule base through key fields to form an alarm relation example;

3. The method of claim 2, wherein for the alarm rules in the rule base, extracting the association relationship between different alarms through key fields, and composing an alarm relationship instance comprises:

performing left-right word segmentation on the rule description content according to a second key field to obtain a left word segmentation and a right word segmentation;

4. The method of claim 2, wherein prior to performing entity and relationship extraction on the rule base to obtain the first candidate set comprising the alarm relationship instance and the work order worksheet instance, the method further comprises:

and converting the semi-structured data in the rule base into structured data.

5. The method of claim 1, wherein performing entity-to-relationship extraction on real-time data to obtain a second candidate set of alarm association relationship and work order dispatch relationship comprises:

6. The method of claim 1, wherein performing collision detection on the first candidate set and the second candidate set to obtain the target candidate set comprising valid alarm association and work order worksheet knowledge comprises:

judging whether the current alarm association relationship exists in the first candidate set or not; determining that the current alarm association relationship is valid through machine learning under the condition that the judgment result is negative; if so, determining whether the data frequency of the current alarm association relationship is smaller than a preset threshold value or not when the current alarm association relationship is not matched with the alarm relationship instance in the first candidate set and no conflict exists, and if not, determining that the current alarm association relationship is the effective alarm association relationship through machine learning;

judging whether the current work order dispatching relation exists in the work order dispatching instance of the first candidate set or not; and under the condition that the judgment result is negative, combining the current work order dispatching relation and related alarms into the work order dispatching knowledge.

7. The method according to any one of claims 1 to 6, wherein before fusing the target candidate set to a failure knowledge graph constructed according to the rule base, resulting in an updated failure knowledge graph, the method further comprises:

summarizing the alarm association relation in the target candidate set according to the correlation;

and summarizing the work order dispatching relation in the target candidate set according to the dispatching order.

8. The method of any one of claims 1 to 6, wherein fusing the target candidate sets into a failure knowledge graph constructed from the rule base, and obtaining an updated failure knowledge graph comprises:

using keys to represent alarms, and searching corresponding nodes for the effective alarm association relation and the work order dispatching knowledge of the target candidate set in the fault knowledge graph through ontology mapping and entity mapping;

and when the corresponding node is not in the fault knowledge graph, establishing a father node in the fault knowledge graph, and hanging the effective alarm association relation and the work order dispatch knowledge on the newly established father node.

9. A fault knowledge graph building apparatus, comprising:

and the updating module is used for fusing the target candidate set into the fault knowledge graph constructed according to the rule base to obtain an updated fault knowledge graph.

10. A computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to carry out the method of any one of claims 1 to 8 when executed.

11. An electronic device comprising a memory and a processor, wherein the memory has stored therein a computer program, and wherein the processor is arranged to execute the computer program to perform the method of any of claims 1 to 8.