CN103929326B - Communication network transmission class alerts the device and method of united analysis - Google Patents

Abstract

The invention discloses the device and method that a kind of communication network transmission class alerts united analysis, it is related to the communications field, the device includes the display module, adaptation module, interface module, Preprocessing module, secondary analysis module and the static data read through model that are sequentially connected, adaptation module finishing service path, the delivery of alarm correlation analysis service and conversion, and communicated with display module；Interface module provides data, the result of outputting alarm correlation analysis for Preprocessing module；Preprocessing module realizes the Preprocessing of alarm correlation analysis；Secondary analysis module realizes the secondary analysis of alarm correlation analysis.The present invention realizes in form using software service technology in module, is easy to be reused in a binary fashion in different business analysis module；Pretreatment, asynchronous parallel treatment are taken, the efficiency of alert analysis can be effectively improved；Using secondary analysis mechanism, analysis result interference that may be present each other can be prevented effectively from.

Description

Communication network transmission class alerts the device and method of united analysis

Technical field

The present invention relates to the communications field, device and the side of a kind of communication network transmission class alarm united analysis are specifically related to Method.

Background technology

The tranmission techniques commonly used in transmission network equipment include SDH (Synchronous Digital Hierarchy, synchronization Digit sequence), WDM (Wavelength Division Multiplexing, wavelength-division multiplex), OTN (Optical Transport Network, optical transfer network) and PTN (Packet Transport Network, Packet Transport Network) etc., and It is, it is necessary to be configured using the method for meeting above-mentioned technical characteristic and activated the service during the day-to-day operation of specific equipment is safeguarded and right Business after opening carries out the monitoring of running quality by alarm and performance.With the expansion of transmission network construction scale, its Structure is increasingly complicated, and service path quantity is also increased therewith, it is necessary to the alarm of monitoring now, is leaned on entirely also in magnanimity growth trend It is unpractical that manual analysis goes out root alarm, and the analysis method of automation is imperative, and the suppression between any two alarm The judgement of relation is the basis of root alert analysis, and inhibition analysis is referred to as alerted in text.

The method of the alarm inhibition analysis of present existing automation is divided into two kinds：To using certain specific tranmission techniques The inhibition analysis between alarm produced by transmission equipment；Realize being produced by the transmission equipment of different manufacturers for same tranmission techniques The inhibition analysis after synthesis after raw alarm.But the method for above-mentioned alarm inhibition analysis is not across the specific of certain tranmission techniques Field, so as to cause to be that can not directly to bring be to apply it for the analysis restrainable algorithms of the exploitation of equipment using specific tranmission techniques The alarm inhibition analysis of the equipment of his tranmission techniques is used, when increasing a kind of equipment of certain specific tranmission techniques of application newly, again For the new identical in logic of the equipment development alerts inhibition analysis algorithm, waste is exploited natural resources.

In sum, there is problems with the realization of existing alert analysis now：

(1) source code of alert analysis function is embedded into the source code of certain service management module, causes alarm point Analysis function and business configuration Function Coupling are too high, are unfavorable for the reuse of the source code of alert analysis function；

(2) when an alarm is analyzed, existing solution is that potential all alarms are compared with it, is caused Algorithm complex is index rank, in face of the alarm of magnanimity, analyzes the less efficient of process；

(3) during traditional alarm correlation analysis, analysis result there may be interference each other.

The content of the invention

The invention aims to overcome the shortcomings of above-mentioned background technology, there is provided a kind of communication network transmission class alarm unification The device and method of analysis, realizes in form using software service technology in module, is easy in different business analysis module with two System mode is reused；Pretreatment, asynchronous parallel treatment, the secondary analysis mechanism of a series of alert analysis are taken, can be effective Improve the efficiency of alert analysis；Using directed acyclic diagram technology, analysis result can be prevented effectively from that may be present each other Interference.

The present invention provides a kind of communication network transmission class and alerts the device of united analysis, including be sequentially connected display module, Adaptation module, interface module, Preprocessing module, secondary analysis module and static data read through model,

The display module, is used for：Complete the display of analysis result；

The adaptation module, is used for：Finishing service path, the delivery of alarm correlation analysis service and conversion, and with it is aobvious Show that module is communicated, for display module provides analysis result；

The interface module, is used for：For Preprocessing module provides data, and outputting alarm correlation analysis knot Really, be alarm correlation analysis algorithm executable process carrier；

The Preprocessing module, is used for：Realize the Preprocessing of alarm correlation analysis；

The secondary analysis module, is used for：Interference between removal alarm correlation analysis result；

The static data read through model, is used for：Realize that warning code static data and alarm correlation analysis rule are quiet The unified encapsulation and access of state data；

After adaptation module, interface module reach Preprocessing module, foundation is in static data read through model for alarm In rule and preprocessing and scheduling strategy, carry out alarm pretreatment assign：When interface module is input into an alarm, carry out first Alarm verification, if in the warning code of input alarm regular collection not in static data read through model, do not located Reason, continues with next input alarm；When alarm is entered into Preprocessing module, alarm to be analyzed is initially entered Queue, taking-up is responsible for by assignment thread, alert the pretreatment in path；After assignment thread completes path pretreatment, foundation Thread selection algorithm, will alert and be delivered to the thread specified and be analyzed, and take out next alarm from queue again again, when In queue during no alarm, then dormancy wait is carried out；When correlation service stopping, top service notifies that Preprocessing module is stopped The only treatment of thread pool；

When Preprocessing module is directed to alarm correlation analysis, the related alarm of business is for the alarm on same path Possesses correlation, the alarm of non-traffic class possesses correlation for the alarm in same network element：In concurrent processing, for non-traffic Alarm, the related alarm of business, similar alarm scheduling is processed in same thread；

The mode of the related alarm concurrent scheduling of business is：(1) service path is without service layer path：Treatment thread number=(accuse Path unique mark where alert) % (business relevant processing thread number), % represents modulo operation；(2) service path has service layer Path：Treatment thread number=(bottom service layer path unique mark in path where alarm) % (business relevant processing threads Number)；

The mode of the unrelated alarm concurrent scheduling of business：Treatment thread number=(network element unique mark where alarm) % (business Unrelated treatment Thread Count)；

Concurrently classification treatment：Based on the business related alarm alarm unrelated with business for possessing service path unique mark simultaneously There is the situation of scene intersection during hair treatment, concurrent processing is divided into two stages for the treatment of：The related alarm of first order processing business, without business The alarm of path unique mark then flows into the second level；For the alarm that the first order has drawn correlation results, second is no longer flow into Level；For the alarm for flowing into the second level, the network element unique mark selection treatment thread for occurring according to alarm again；

The alarm correlation Preprocessing flow of Preprocessing module is as follows：

Corresponding correlation analysis rule is obtained by the alarm of current input, a set for rule is obtained；By accusing Strategy is extracted in alert analysis, based on current input alarm, finds the alarm set of association；

The alarm set obtained by extraction, with the alarm in the alarm of current input and alarm set one by one using current Alarm regulation is analyzed, and checks whether matching, if it does not match, being calculated into next rule；If it does, then caching Present analysis result；

After strictly all rules matching is completed, there is analysis result if none of rule, then cache current alarm, exit Epicycle Preprocessing；Secondary analysis module is sent to if there is Preprocessing result, after merging, while caching this announcement It is alert, exit epicycle Preprocessing；

The extraction strategy of Preprocessing module institute foundation includes space constraint and time-constrain, and space constraint is that alarm exists The distribution relation produced on network and service path, time-constrain includes：Alarm time of origin is in alarm correspondence spatial dimension It is interior, centered on the alarm time of origin, respectively to analyze the limitation time as the time interval of positive and negative upper and lower limit；

The process that alarm correlation data are generated in Preprocessing module is as follows：

It is determined that after the alarm scope of constraint, the alarm set in restriction range is derived, as the mesh that current alarm is analyzed Mark is gathered, and pre-analysis process current will be input into all alarms alerted with goal set, corresponding according to currently input alarm Analysis rule, is judged, if there is correlation, then the correlation is submitted into secondary analysis module, if non-correlation, Do not process then, retain the data preparation subsequent analysis；

After generating preanalysis relation in preanalysis, regular unique mark, business are carried in preanalysis relation and is uniquely marked Knowledge, analysis time, as the foundation of secondary analysis；

The alarm of the correlation of Preprocessing result is stored as a directed acyclic graph DAG by secondary analysis module, should Directed acyclic graph DAG stores the relation between alarm, summit storage alarm unique mark and the announcement in directed acyclic graph The temporal information of alert addition graph of a relation, to alert unique mark as the foundation field of extreme saturation；

Relation between alarm represents that the starting point of arc represents Root alarm, the terminal of arc with the arc in directed acyclic graph DAG Derivative alarm is represented, the attribute on arc includes time, Root alarm unique mark, the unique mark of derivative alarm of the generation of this arc Knowledge, service path unique mark, regular unique mark, stable state field whether is reached；In the directed acyclic graph respectively by Different connected components is constituted, and each connected component is actually an alarm correlation group, for holding for alarm correlation Longization, reports output to be all based on the connected component；

Warning relation extreme saturation：Extreme saturation is regularly carried out in correlation DAG figures, is performed during extreme saturation Hereinafter operate：By judge each summit of the summit of current traversal in connected component associated in directed acyclic graph when Between whether exceed stabilization time threshold value and determine whether the relation between summit reaches stable state, reach stable state and then will The stable relation is delivered to and reports queue；Determine to whether there is merging relation between summit, if there is the relation of merging, then merge Summit；Determine whether the alarm correlation relation represented between summit can be cached in persistence module；If above-mentioned connection The time on all of summit is above stabilization time threshold value in component, then it is assumed that reach persistence standard, then by the connected component The alarm correlation relation perdurability represented between each summit；

There is the interim pretreatment relation produced by intermediateness, this part relations ginseng during alarm correlation analysis Following methods are examined to merge：

The adjustment of pretreatment correlation is based on root alert priority, type of service, treatment 4 bars of rule type and process time Part, suppresses priority packet by alarm first, and packet-priority is sorted by priority, and priority value is smaller, and priority is higher, choosing One group of relation of priority highest is selected, the low packet of other priority is abandoned, and the order of priority is as follows：

The packet of circuit unique mark is pressed first；

With in circuit unique mark group, selection rule prioritization highest is regular；If highest priority rule exists many Individual equal priority, then whether judgment rule is to support many rules, if single rule, selection time phase at most Closing property retains, other discardings, if many rules then retain corresponding result；

The second wheel exclusion is carried out by the alarm correlation relation that circuit unique mark packet transaction is calculated to the first round, Second wheel is excluded according to the regular priority corresponding to the alarm correlation relation in first round result, selects limit priority Alarm correlation relation corresponding to rule is retained, if there are multiple equal priorities in highest priority rule, that Whether judgment rule is to support many rules, if single rule, selection time correlation at most retains, and other are lost Abandon, if many rules, then retain corresponding result；

After the second wheel analysis, secondary analysis module reports the association knot after the completion of the analysis of the second wheel to interface module Really.

On the basis of above-mentioned technical proposal, the data that the adaptation module is used include alarm, configuration data and business Path data, alarm includes location information, warning code, time of origin, and location information includes that single-deck unique mark, network element are unique Mark and port-mark；Configuration data includes network element data, single-deck data, port data；Service path data are 3 hierachy numbers According to combination：Circuit->Path->Connection, a subnet transposition circuit is combined into by operating path set with Protection path collection, work Make set of paths identical with the data structure of Protection path set, path essential information includes ID of trace route path, circuit identifier, work Work/protection, service path information.

On the basis of above-mentioned technical proposal, record has warning code, the temporal information of alarm generation, determines in the alarm Position information, alarm correlation analysis result, alarm correlation analysis result according to regular unique mark+root alarm unique mark+ The structure of derivative alarm unique mark is to upper layer transfers.

On the basis of above-mentioned technical proposal, the port-mark includes：(1) single-deck unique mark；(2) where port Level；(3) port-mark character string；Level where port include synchronized data generation function serial equipment transmission medium layer, Higher order path layer, low order channel layer, PDH pdh physical interface layer；The section of Packet Transport Network PTN serial equipments Layer, channel layer, circuit layer, operation layer；Optical transport layer OTS, optical multiplex layer OMS, the optical channel layers of wave division multiplexing WDM series OCH, client layer；Optical transfer network OTN series OTS layers, OMS layers, OCH layers, ODUk layers of light-path data cell, client layer, k= 0、1、2、3、4。

On the basis of above-mentioned technical proposal, the type of the port include physical terminal point PTP, floated terminal point FTP, Connection end points CTP, port-mark character string is identified according to the type of port, the set membership of port；Port-mark String table is shown as：[port type 1=port numbers 1] [/ port type 2=port numbers 2] [/ port type 3=port numbers 3] ... [/ port type n=port numbers n], n is natural number.

The present invention also provides the method that the communication network transmission class based on said apparatus alerts united analysis, including following step Suddenly：

S1, whether warning code is judged in static data read through model, if it is, going to step S2；Otherwise, tie Beam；

After adaptation module, interface module reach Preprocessing module, foundation is in the read-only mould of static data for S2, alarm Rule and preprocessing and scheduling strategy in block, carry out alarm pretreatment and assign：When interface module is input into an alarm, enter first Row alarm verification, if in the warning code of input alarm regular collection not in static data read through model, do not carried out Treatment, continues with next input alarm；When alarm is entered into Preprocessing module, alarm to be analyzed is initially entered Queue, taking-up is responsible for by assignment thread, carry out alert path pretreatment；After assignment thread completes path pretreatment, according to According to thread selection algorithm, will alert and be delivered to the thread specified and be analyzed, take out next alarm from queue again again, When no alarm in queue, then dormancy wait is carried out；When correlation service stopping, top service notifies Preprocessing module Stop the treatment of thread pool；

When Preprocessing module is directed to alarm correlation analysis, the related alarm of business is for the alarm on same path Possesses correlation, the alarm of non-traffic class possesses correlation for the alarm in same network element：In concurrent processing, for non-traffic Alarm, the related alarm of business, similar alarm scheduling is processed in same thread；

The mode of the related alarm concurrent scheduling of business is：(1) service path is without service layer path：Treatment thread number=(accuse Path unique mark where alert) % (business relevant processing thread number), % represents modulo operation；(2) service path has service layer Path：Treatment thread number=(bottom service layer path unique mark in path where alarm) % (business relevant processing threads Number)；

The mode of the unrelated alarm concurrent scheduling of business：Treatment thread number=(network element unique mark where alarm) % (business Unrelated treatment Thread Count)；

Concurrently classification treatment：Based on the business related alarm alarm unrelated with business for possessing service path unique mark simultaneously There is the situation of scene intersection during hair treatment, concurrent processing is divided into two stages for the treatment of：The related alarm of first order processing business, without business The alarm of path unique mark then flows into the second level；For the alarm that the first order has drawn correlation results, second is no longer flow into Level；For the alarm for flowing into the second level, the network element unique mark selection treatment thread for occurring according to alarm again；

S3, Preprocessing module alarm correlation Preprocessing flow it is as follows：

Corresponding correlation analysis rule is obtained by the alarm of current input, a set for rule is obtained；By accusing Strategy is extracted in alert analysis, based on current input alarm, finds the alarm set of association；

The alarm set obtained by extraction, with the alarm in the alarm of current input and alarm set one by one using current Alarm regulation is analyzed, and checks whether matching, if it does not match, being calculated into next rule；If it does, then caching Present analysis result；

After strictly all rules matching is completed, there is analysis result if none of rule, then cache current alarm, exit Epicycle Preprocessing；Secondary analysis module is sent to if there is Preprocessing result, after merging, while caching this announcement It is alert, exit epicycle Preprocessing；

The extraction strategy of Preprocessing module institute foundation includes space constraint and time-constrain, and space constraint is that alarm exists The distribution relation produced on network and service path, time-constrain includes：Alarm time of origin is in alarm correspondence spatial dimension It is interior, centered on the alarm time of origin, respectively to analyze the limitation time as the time interval of positive and negative upper and lower limit；

The process of Preprocessing module generation alarm correlation data is as follows：

It is determined that after the alarm scope of constraint, the alarm set in restriction range is derived, as the mesh that current alarm is analyzed Mark is gathered, and pre-analysis process current will be input into all alarms alerted with goal set, corresponding according to currently input alarm Analysis rule, is judged, if there is correlation, then the correlation is submitted into secondary analysis module, if non-correlation, Do not process then, retain the data preparation subsequent analysis；

After generating preanalysis relation in preanalysis, regular unique mark, business are carried in preanalysis relation and is uniquely marked Knowledge, analysis time, as the foundation of secondary analysis；

S4, alarm correlation secondary analysis：Secondary analysis module stores the alarm of the correlation of Preprocessing result It is a directed acyclic graph DAG, directed acyclic graph DAG stores the relation between alarm, and the summit in directed acyclic graph is deposited Storage alarm unique mark and the alarm add the temporal information of graph of a relation, to alert unique mark as the foundation of extreme saturation Field；

Relation between alarm represents that the starting point of arc represents Root alarm, the terminal of arc with the arc in directed acyclic graph DAG Derivative alarm is represented, the attribute on arc includes time, Root alarm unique mark, the unique mark of derivative alarm of the generation of this arc Knowledge, service path unique mark, regular unique mark, stable state field whether is reached；In the directed acyclic graph respectively by Different connected components is constituted, and each connected component is actually an alarm correlation group, for holding for alarm correlation Longization, reports output to be all based on the connected component；

Warning relation extreme saturation：Extreme saturation is regularly carried out in correlation DAG figures, is performed during extreme saturation Hereinafter operate：By judge each summit of the summit of current traversal in connected component associated in directed acyclic graph when Between whether exceed stabilization time threshold value and determine whether the relation between summit reaches stable state, reach stable state and then will The stable relation is delivered to and reports queue；Determine to whether there is merging relation between summit, if there is the relation of merging, then merge Summit；Determine whether the alarm correlation relation represented between summit can be cached in persistence module；If above-mentioned connection The time on all of summit is above stabilization time threshold value in component, then it is assumed that reach persistence standard, and the connected component is each The alarm correlation relation perdurability represented between summit；

There is the interim pretreatment relation produced by intermediateness, this part relations ginseng during alarm correlation analysis Following methods are examined to merge：

The adjustment of pretreatment correlation is based on root alert priority, type of service, treatment 4 bars of rule type and process time Part, suppresses priority packet by alarm first, and packet-priority is sorted by priority, and priority value is smaller, and priority is higher, choosing One group of relation of priority highest is selected, the low packet of other priority is abandoned, and the order of priority is as follows：

The packet of circuit unique mark is pressed first；

With in circuit unique mark group, selection rule prioritization highest is regular；If highest priority rule, exist many Individual equal priority, then whether judgment rule is to support many rules, if single rule, selection time phase at most Closing property retains, other discardings, if many rules then retain corresponding result；

The second wheel exclusion is carried out by the alarm correlation relation that circuit unique mark packet transaction is calculated to the first round, Second wheel is excluded according to the regular priority corresponding to the alarm correlation relation in first round result, selects limit priority Alarm correlation relation corresponding to rule is retained, if there are multiple equal priorities in highest priority rule, that Whether judgment rule is to support many rules, if single rule, selection time correlation at most retains, and other are lost Abandon, if many rules, then retain corresponding result；

S5, second wheel analysis after, secondary analysis module to interface module report the second wheel analyze after the completion of association As a result, terminate.

On the basis of above-mentioned technical proposal, the data that the adaptation module is used include alarm, configuration data and business Path data, alarm includes location information, warning code, time of origin, and location information includes that single-deck unique mark, network element are unique Mark and port-mark；Configuration data includes network element data, single-deck data, port data；Service path data are 3 hierachy numbers According to combination：Circuit->Path->Connection, a subnet transposition circuit is combined into by operating path set with Protection path collection, work Make set of paths identical with the data structure of Protection path set, path essential information includes ID of trace route path, circuit identifier, work Work/protection, service path information.

On the basis of above-mentioned technical proposal, record has warning code, the temporal information of alarm generation, determines in the alarm Position information, alarm correlation analysis result, alarm correlation analysis result according to regular unique mark+root alarm unique mark+ The structure of derivative alarm unique mark is to upper layer transfers.

On the basis of above-mentioned technical proposal, the port-mark includes：(1) single-deck unique mark；(2) where port Level；(3) port-mark character string；Level where port include the transmission medium layer of SDH serial equipments, higher order path layer, Low order channel layer, PDH pdh physical interface layer；The section layer of PTN serial equipments, channel layer, circuit layer, business Layer；Optical transport layer OTS, optical multiplex layer OMS, optical channel layers OCH, the client layer of WDM series；OTS layers, OMS of OTN series Layer, OCH layers, ODUk layers of light-path data cell, client layer, k=0,1,2,3,4.

On the basis of above-mentioned technical proposal, the type of the port include physical terminal point PTP, floated terminal point FTP, Connection end points CTP, port-mark character string is identified according to the type of port, the set membership of port；Port-mark String table is shown as：[port type 1=port numbers 1] [/ port type 2=port numbers 2] [/ port type 3=port numbers 3] ... [/ port type n=port numbers n], n is natural number.

Compared with prior art, advantages of the present invention is as follows：

The present invention is realized in form using software service technology in module, is easy in different business analysis module with binary system Mode is reused；Pretreatment, the asynchronous parallel treatment of a series of alert analysis are taken, the effect of alert analysis can be effectively improved Rate；Using secondary analysis mechanism, analysis result interference that may be present each other can be prevented effectively from.

Brief description of the drawings

Fig. 1 is the structured flowchart of the device of communication network transmission class alarm united analysis in the embodiment of the present invention.

Fig. 2 is the structural representation of service path data.

Fig. 3 is the flow chart of the method for communication network transmission class alarm united analysis in the embodiment of the present invention.

Fig. 4 is the multiple threads schematic diagram that pretreatment is alerted in the embodiment of the present invention.

Fig. 5 is the schematic diagram of the directed acyclic graph of alarm secondary analysis in the embodiment of the present invention.

Specific embodiment

Below in conjunction with the accompanying drawings and specific embodiment the present invention is described in further detail.

Shown in Figure 1, the embodiment of the present invention provides the device that a kind of communication network transmission class alerts united analysis, including suitable Secondary connected display module, adaptation module, interface module, Preprocessing module, secondary analysis module and static data are read-only Module, wherein：

Display module, is used for：Complete the display of analysis result；

Adaptation module, is used for：Finishing service path, alarm correlation analysis service delivery with conversion, and with display mould Block is communicated, for display module provides analysis result；

Interface module, is used for：For Preprocessing module provides data, and outputting alarm correlation analysis result, It is the carrier of the executable process of alarm correlation analysis algorithm；

Preprocessing module, is used for：Realize the Preprocessing of alarm correlation analysis；

Secondary analysis module, is used for：Interference between removal alarm correlation analysis result；

Static data read through model, is used for：Realize warning code static data and alarm correlation analysis rule static number According to unified encapsulation and access.

The data that adaptation module is used include alarm, configuration data and service path data, and alarm at least includes that positioning is believed The attribute items such as breath, warning code, time of origin, location information includes single-deck ID (Identifier, identifier), NE ID and end Mouth mark；Configuration data includes network element data, single-deck data, port data；Service path data are 3 groups of hierarchical data Close：Circuit->Path->Connection.Shown in Figure 2, a subnet transposition circuit is by operating path set and Protection path set Composition, operating path set is identical with the data structure of Protection path set, and path essential information at least includes ID of trace route path, electricity The information such as line, work/protection, service path, the set that connects in path, in the set of connection, each connection is again thin It is divided into source port, egress mouthful.

In alarm correlation analysis, in addition to service path statement position relationship spatially, also same disk, same to net First, same to physical port, with this kind of spatial relation of logic port, the location information in this kind of relationship alarm.In alarm Record has temporal information, location information, the alarm correlation analysis result that warning code, alarm occur.Alarm correlation analysis Result is according to the structure of rule ID+root Alarm ID+derivative Alarm ID to upper layer transfers.

Port-mark includes：(1) 64 integer single-deck ID；(2) level where port；(3) port-mark character string.

Level where port includes transmission medium layer, higher order path layer, low order channel layer, the PDH of SDH serial equipments (Plesiochronous Digital Hierarchy, PDH) physical interface layer；The section of PTN serial equipments Layer, channel layer, circuit layer, operation layer；The OTS (Optical Transmission Section, optical transport layer) of WDM series Layer, OMS (Optical Multiplex Section, optical multiplex layer) layer, OCH (Optical Channel, optical channel layers) Layer, CLIENT (client) layer；OTS layers, OMS layers, OCH layers, ODUk (Optical Channel Data Unit- of OTN series K, light-path data cell k, k=0,1,2,3,4) layer, CLIENT layer.

The type of port include PTP (Physical Terminal Point, physical terminal point, represent physical port), FTP (Float Terminal Point, floated terminal point represent the backboard port of single-deck), CTP (Connection TerminalPoint, connection end points represent logic port), port-mark character string is according to the type of port, the father of port Subrelation is identified.The string table of port-mark is shown as：[port type 1=port numbers 1] [/ port type 2=port numbers 2] [/ port type 3=port numbers 3] ... [/ port type n=port numbers n], n is natural number.

Shown in Figure 3, the embodiment of the present invention also provides a kind of communication network transmission class alarm unification based on said apparatus The method of analysis, comprises the following steps：

S1, whether warning code is judged in static data read through model, if it is, going to step S2；Otherwise, tie Beam；

After adaptation module, interface module reach Preprocessing module, foundation is in the read-only mould of static data for S2, alarm Rule and preprocessing and scheduling strategy in block, carry out alarm pretreatment and assign：In order to solve existing alert analysis in a treatment Queued up in thread the problem for the treatment of, the embodiment of the present invention introduces the concurrent mechanism of alarm pretreatment and analysis：Work as interface module During one alarm of input, alarm verification is carried out first, if the warning code of input alarm is not in static data read through model Regular collection in, then do not processed, continue with next input alarm.It is shown in Figure 4, when alarm enters into pre- place When in reason analysis module, the queue of alarm to be analyzed is initially entered, taking-up is responsible for by assignment thread, alert the pre- place in path Reason；Assign after thread completes path pretreatment, according to thread selection algorithm, will alert and be delivered to the thread specified and divided Analysis, takes out next alarm from queue again again, when no alarm in queue, then carries out dormancy wait；When correlation clothes When business stops, top service notifies that Preprocessing module stops the treatment of thread pool.

When Preprocessing module is directed to alarm correlation analysis, the related alarm of business is for the alarm on same path Possesses correlation, the alarm of non-traffic class possesses correlation for the alarm in same network element：In concurrent processing, it is necessary to be directed to non- Service alarm, the related alarm of business, similar alarm scheduling is processed in same thread.

The mode of the related alarm concurrent scheduling of business is：

(1) service path is without service layer path：Treatment thread number=(path ID where alarm) % (business relevant treatment lines Number of passes), % represents modulo operation；

(2) service path has service layer path：The treatment thread number=(bottom service layer path in path where alarm ID) % (business relevant processing thread number).

The mode of the unrelated alarm concurrent scheduling of business：Treatment thread number=(NE ID where alarm) % (unrelated places of business Reason Thread Count).

Concurrent hierarchical processing method：Based on possess service path ID the related alarm alarm unrelated with business of business (same to disk, With PTP etc.) there is the situation that scene is intersected in concurrent processing, concurrent processing needs to be divided into two stages for the treatment of：The first order processes industry The related alarm of business (alarm without service path ID then flows into the second level)；For the alarm that the first order has drawn correlation results, It is no longer flow into the second level；For the alarm for flowing into the second level, the NE ID selection treatment thread for occurring according to alarm again.

S3, Preprocessing module alarm correlation Preprocessing flow it is as follows：

Corresponding correlation analysis rule is obtained by the alarm of current input, a set for rule is obtained；Due to every Individual correlation analysis rule has specific alert analysis to extract strategy, and strategy is extracted by alert analysis, based on current input Alarm, finds the alarm set of association；

The alarm set obtained by extraction, with the alarm in the alarm of current input and alarm set one by one using current Alarm regulation is analyzed, and checks whether matching, if it does not match, being calculated into next rule；If it does, then caching Present analysis result；

After strictly all rules matching is completed, there is analysis result if none of rule, then cache current alarm, exit Epicycle Preprocessing；Secondary analysis module is sent to if there is Preprocessing result, after merging, while caching this announcement It is alert, exit epicycle Preprocessing.

The extraction strategy of Preprocessing module institute foundation includes space constraint and time-constrain.Space constraint was both exactly The distribution relation produced on network and service path is alerted, is very ripe technology, time-constrain includes：Alarm time of origin In alarm correspondence spatial dimension, centered on the alarm time of origin, respectively to analyze the limitation time as positive and negative upper and lower The time interval of limit.It is the alert analysis scope of its generation when increment is alerted and reached, the invalid analysis of appearance can be prevented effectively from Situation.

The process of Preprocessing module generation alarm correlation data is as follows：

After the alarm scope that constraint is determined, the alarm set in restriction range is derived, analyzed as current alarm Goal set.Pre-analysis process is by all alarms in current input alarm and goal set, and it is right to be alerted according to current input The analysis rule answered, is judged, if there is correlation, then the correlation is submitted into secondary analysis module, if without phase Guan Xing, then do not process, and retains the data preparation subsequent analysis.

After generating preanalysis relation in preanalysis, rule ID, traffic ID, analysis time are carried in preanalysis relation, As the foundation of secondary analysis.

In the result that alarm correlation preanalysis is obtained, generally there is interference problem, in the analysis result that there is interference, These interference results are presumable because alarm concussion causes, and what is had is probably the effect generation because alarm cascading triggering, Causing the root of same alarm may have multiple, be that finally positioning Root alarm causes difficulty.The embodiment of the present invention introduces DAG The reason for (Directed Acyclic Graph, directed acyclic graph) is：DAG characteristics in itself can very easily solve correlation Property analysis in disturb data queueing problem：(1) do not exist closed loop in DAG, therefore result can be excluded by the characteristic of itself In the relation that interdepends；(2) there is DAG efficient data to remove, and insert ability, save analysis time；(3) DAG is by can be with Multiple connected subgraphs are divided into, these connected subgraphs just represent an alarm correlation set.

S4, alarm correlation secondary analysis：

The DAG figures of warning relation are shown in Figure 5, and secondary analysis module is by the alarm of the correlation of Preprocessing result A directed acyclic graph DAG is stored as, directed acyclic graph DAG is responsible for the relation between storage alarm, in directed acyclic graph Summit stores the temporal information that Alarm ID and the alarm add graph of a relation, using Alarm ID as DFS (Deep First Search, extreme saturation) traversal foundation field.

Relation between alarm represents that the starting point of arc represents Root alarm, arc with the arc of directed acyclic graph DAG in Fig. 5 Terminal represents derivative alarm.Attribute on arc includes time, Root alarm ID, derivative Alarm ID, the business road of the generation of this arc Footpath ID, rule ID, the fields such as stable state whether are reached and have represented.

Because alarm is based on network element and service path, it may be determined that the figure is a sparse graph, select adjacent in storage Connect table.It is made up of different connected components respectively in the directed acyclic graph, each connected component is actually an alarm phase Closing property group.For the persistence of alarm correlation, output is reported to be all based on the connected component.

Warning relation DFS traversal：Regularly carry out DFS traversal in correlation DAG figures, performed during DFS traversal with Lower operation：The time on each summit in the connected component associated in the directed acyclic graph by judging the summit of current traversal Whether exceed stabilization time threshold value to determine whether the relation between summit reaches stable state, reach stable state and then should Stable relation is delivered to and reports queue；Determine to whether there is merging relation between summit, if there is the relation of merging, then merge top Point；Determine whether the alarm correlation relation represented between summit can be cached in persistence module；If above-mentioned connection point The time on all of summit is above stabilization time threshold value in amount, then it is assumed that reach persistence standard, and the connected component is respectively pushed up The alarm correlation relation perdurability represented between point.

Exist due to the interim pretreatment relation that intermediateness is produced, this part relations during alarm correlation analysis Merged with reference to following methods.

The adjustment of pretreatment correlation is based on root alert priority, type of service, treatment 4 bars of rule type and process time Part, suppresses priority packet by alarm first, and packet-priority sorts by priority (priority value is smaller, and priority is higher), One group of relation of highest priority is selected, the low packet of other priority is abandoned, and the order of priority is described as follows：

It is grouped by circuit I D first；

With in circuit I D groups, selection rule prioritization highest is regular；If highest priority rule, exist multiple identical Priority, then whether judgment rule is to support many rules, if single rule, selection time correlation at most is protected Stay, other discardings, if many rules then retain corresponding result；

The second wheel exclusion is carried out by the alarm correlation relation that circuit unique mark packet transaction is calculated to the first round, Second wheel is excluded according to the regular priority corresponding to the alarm correlation relation in first round result, selects limit priority Alarm correlation relation corresponding to rule is retained, if there are multiple equal priorities in highest priority rule, that Whether judgment rule is to support many rules, if single rule, selection time correlation at most retains, and other are lost Abandon, if many rules, then retain corresponding result；

S5, second wheel analysis after, secondary analysis module to interface module report the second wheel analyze after the completion of association As a result, terminate.

It is described in detail below by specific example.

It is assumed that 2 alarms of currently input：First alarm A1, the second alarm A2, there is currently 2 circuits：First circuit C1, The port of second circuit C2, the first alarm A1 is P1, and the port that the second alarm A2 occurs is P2.The path of the first circuit C1 is { (Pa1, Pz1), (Pa2, Pz2) .. (Pan, Pzn) }, the path of second circuit C2 for (Pa1', Pz1'), (Pa2', Pz2') .. (Pan', Pzn') }, Pan represents n-th source port of connection in the operating path of the first circuit C1, and Pzn represents the N-th egress of connection mouthful in the operating path of one circuit C1, n is natural number.Pan' represents the operating path of second circuit C2 In n-th source port of connection, Pzn' represents n-th egress of connection mouthful in the operating path of second circuit C2.

Step 101, when first alarm A1 be input into after, first determine whether whether the first alarm A1 meets alarm correlation rule, If the first alarm A1 warning codes are unsatisfactory for the warning code of existing rule definition, no longer it is analyzed.It is assumed here that First alarm A1 is alerted by Preprocessing without correlation, then the first alarm A1 is stored in pretreatment alarm cache tree.

Below complete explanation is carried out by taking the second alarm A2 as an example.

Step 102, now input second alert A2, and the warning code of the second alarm A2 such as meets corresponding alarm correlation Rule, then determine whether the second alarm A2 with the presence or absence of related circuit, if there is corresponding circuits, then by circuit I D by pre- Treatment Thread Count modulus, is assigned on correspondence pretreatment thread (assume to be configured with 2 pretreatment threads in inside), second accuses here Alert A2 corresponds to the first circuit C1 (the last connectivity port of the first circuit C1 is consistent with the port of the second alarm A2), in the second alarm Upper circuit code name C1 is marked in the alarm of A2.Second alarm A2 is delivered in the corresponding pretreatment thread T1 of the first circuit C1. If the alarm in actual treatment corresponds to a plurality of circuit, also need to for alarm to copy as many parts accordingly, then respectively It is delivered in alignment processing thread.

Note：Assuming that the second alarm A2 can correspond to a plurality of circuit, then also copy as accordingly the second alarm A2 Many parts, then be assigned to corresponding pretreatment thread.If there is no related circuit, then the second alarm A2 is pressed the network element at place ID modulus, is delivered to corresponding pretreatment thread and is analyzed.If the second alarm A2 NE ID modulus is different, can be delivered to Different treatment thread, the alarm unrelated for business, is commonly done in same network element, therefore the unrelated alarm of business is logical Often processed in same pretreatment thread.Here to remark additionally a bit, if opening maximization analysis switch, even if in the presence of Corresponding circuits, alarm equally can be delivered to Preprocessing treatment thread and calculate once by NE ID modulus.

Step 103, after the second alarm A2 reaches pretreatment thread T1, according to warning code, obtain corresponding correlation Policy object list is extracted in alarm, and is traveled through one by one by policy object list is extracted, and is obtained and be there is potentially relevant property with alarm Alarm set.The first alarm A1 alarms that the second alarm A2 will can be input into before herein search out, (the related alarm of search When, the alarm time of origin to searching for is restricted, and the second alarm A2 and first alerts A1 time of origins no more than limit value, this It is the time-constrain of correlation analysis).

Step 104, in corresponding alert analysis list of rules, with the above-mentioned alarm of traversal of rule one by one in list of rules Set, the alarm of only one of which first A1 in current alarm set, then rule judgment current alarm (second alarm A2) and the one by one The correlation of one alarm A1.Do not exist correlation such as, then skip over, otherwise there is correlation, then into step 105.

Step 105, the warning relation R1 [R2, R3 ... Rn] that there will be correlation, n is natural number, is delivered to secondary analysis Module.Deliver secondary analysis when, filter repeat relation, and itself correlation relation.

Step 106, in secondary analysis module, extreme saturation alarm correlation composition directed acyclic graph, traversed Cheng Zhong, each node is checked into arc with go out arc, according to precipitation algorithm get rid of invalid arc, remained in last digraph Be exactly suitable correlation.

Step 107, in traversal every time, check and checked to exceed apart from last time and report the subgraph of time threshold, when in subgraph When the time of each node meets sedimentation time requirement, then show that the relation of the subgraph has been stablized, then report the subgraph In all of corresponding relation.The subgraph is deleted in directed acyclic graph simultaneously, to save space.

Step 108, the correlation analysis result that acquisition needs are reported in alarm correlation analysis service, it is total by message Line, issues to outside.Alarm correlation analysis adaptation services receive corresponding analysis result, are then reported to client, at interface Upper display analysis result.

Those skilled in the art can carry out various modifications and variations to the embodiment of the present invention, if these modifications and change Within the scope of the claims in the present invention and its equivalent technologies, then these modifications and modification are also in protection scope of the present invention for type Within.

In the prior art that the content not described in detail in specification is known to the skilled person.

Claims (10)

1. a kind of communication network transmission class alerts the device of united analysis, including display module, adaptation module, the interface being sequentially connected Module, Preprocessing module, secondary analysis module and static data read through model, it is characterised in that：

The display module, is used for：Complete the display of analysis result；

The adaptation module, is used for：Finishing service path, alarm correlation analysis service delivery with conversion, and with display mould Block is communicated, for display module provides analysis result；

The interface module, is used for：For Preprocessing module provides data, and outputting alarm correlation analysis result, It is the carrier of the executable process of alarm correlation analysis algorithm；

The Preprocessing module, is used for：Realize the Preprocessing of alarm correlation analysis；

The secondary analysis module, is used for：Interference between removal alarm correlation analysis result；

The static data read through model, is used for：Realize warning code static data and alarm correlation analysis rule static number According to unified encapsulation and access；

After adaptation module, interface module reach Preprocessing module, foundation is in static data read through model for alarm Rule and preprocessing and scheduling strategy, carry out alarm pretreatment and assign：When interface module is input into an alarm, alerted first Verification, if in the warning code of input alarm regular collection not in static data read through model, do not processed, after Next input alarm of continuous treatment；When alarm is entered into Preprocessing module, the queue of alarm to be analyzed is initially entered, Taking-up is responsible for by assignment thread, alert the pretreatment in path；After assignment thread completes path pretreatment, according to thread choosing Algorithm is selected, will be alerted and be delivered to the thread specified and be analyzed, next alarm is taken out from queue again again, when in queue During no alarm, then dormancy wait is carried out；When correlation service stopping, top service notifies that Preprocessing module stops thread The treatment in pond；

When Preprocessing module is directed to alarm correlation analysis, the related alarm of business possesses for the alarm on same path Correlation, non-traffic class alarm possesses correlation for the alarm in same network element：In concurrent processing, accused for non-traffic The related alarm of alert, business, similar alarm scheduling is processed in same thread；

The mode of the related alarm concurrent scheduling of business is：(1) service path is without service layer path：Treatment thread number=(alarm institute In path unique mark) % (business relevant processing thread number), % represents modulo operation；(2) service path has service layer path： Treatment thread number=(bottom service layer path unique mark in path where alarm) % (business relevant processing thread number)；

The mode of the unrelated alarm concurrent scheduling of business：Treatment thread number=(network element unique mark where alarm) (business is unrelated for % Treatment Thread Count)；

Concurrently classification treatment：Concurrently located based on the business related alarm alarm unrelated with business for possessing service path unique mark There is the situation of scene intersection during reason, concurrent processing is divided into two stages for the treatment of：The related alarm of first order processing business, without service path The alarm of unique mark then flows into the second level；For the alarm that the first order has drawn correlation results, the second level is no longer flow into；It is right In the alarm for flowing into the second level, the network element unique mark selection treatment thread for occurring according to alarm again；

The alarm correlation Preprocessing flow of Preprocessing module is as follows：

Corresponding correlation analysis rule is obtained by the alarm of current input, a set for rule is obtained；By alarm point Strategy is extracted in analysis, based on current input alarm, finds the alarm set of association；

The alarm set obtained by extraction, current alarm is used with the alarm of current input one by one with the alarm in alarm set Rule is analyzed, and checks whether matching, if it does not match, being calculated into next rule；If it does, then caching is current Analysis result；

After strictly all rules matching is completed, there is analysis result if none of rule, then cache current alarm, exit epicycle Preprocessing；Secondary analysis module is sent to if there is Preprocessing result, after merging, while this alarm is cached, Exit epicycle Preprocessing；

The extraction strategy of Preprocessing module institute foundation includes space constraint and time-constrain, and space constraint is alarm in network And the distribution relation produced on service path, time-constrain includes：Alarm time of origin is corresponded in spatial dimension in the alarm, with Centered on the alarm time of origin, respectively to analyze the limitation time as the time interval of positive and negative upper and lower limit；

The process that alarm correlation data are generated in Preprocessing module is as follows：

It is determined that after the alarm scope of constraint, the alarm set in restriction range is derived, as the object set that current alarm is analyzed Close, all alarms in current input alarm and goal set are alerted corresponding analysis by pre-analysis process according to current input Rule, is judged, if there is correlation, then the correlation is submitted into secondary analysis module, if non-correlation, no Process, retain the data preparation subsequent analysis；

After generating preanalysis relation in preanalysis, regular unique mark, business unique mark are carried in preanalysis relation, is divided The analysis time, as the foundation of secondary analysis；

The alarm of the correlation of Preprocessing result is stored as a directed acyclic graph DAG by secondary analysis module, and this is oriented Acyclic figure DAG stores the relation between alarm, and the summit storage alarm unique mark and the alarm in directed acyclic graph add Enter the temporal information of graph of a relation, to alert unique mark as the foundation field of extreme saturation；

Relation between alarm represents that the starting point of arc represents Root alarm, and the terminal of arc is represented with the arc in directed acyclic graph DAG Derivative alarm, the attribute on arc includes time, Root alarm unique mark, derivative alarm unique mark, the industry of the generation of this arc Business path unique mark, regular unique mark, stable state field whether is reached；Respectively by different in the directed acyclic graph Connected component is constituted, and each connected component is actually an alarm correlation group, for the persistence of alarm correlation, on Report output is all based on the connected component；

Warning relation extreme saturation：Extreme saturation is regularly carried out in correlation DAG figures, below execution during extreme saturation Operation：The time on each summit in the connected component associated in the directed acyclic graph by judging the summit of current traversal is It is no to determine whether the relation between summit reaches stable state more than stabilization time threshold value, reach stable state then that this is steady Determine relation and be delivered to report queue；Determine to whether there is merging relation between summit, if there is the relation of merging, then merge top Point；Determine whether the alarm correlation relation represented between summit can be cached in persistence module；If above-mentioned connection point The time on all of summit is above stabilization time threshold value in amount, then it is assumed that reach persistence standard, and the connected component is respectively pushed up The alarm correlation relation perdurability represented between point；

During alarm correlation analysis exist by intermediateness produce interim pretreatment relation, this part relations refer to Lower method is merged：

Pretreatment correlation adjustment is based on root alert priority, type of service, treatment 4 conditions of rule type and process time, Suppress priority packet by alarm first, packet-priority is sorted by priority, and priority value is smaller, and priority is higher, selection One group of relation of highest priority, the low packet of other priority is abandoned, and the order of priority is as follows：

The packet of circuit unique mark is pressed first；

With in circuit unique mark group, selection rule prioritization highest is regular；If there are multiple phases in highest priority rule Same priority, then whether judgment rule is to support many rules, if single rule, selection time correlation at most Retain, other discardings, if many rules then retain corresponding result；

The second wheel exclusion, second are carried out by the alarm correlation relation that circuit unique mark packet transaction is calculated to the first round Wheel is excluded according to the regular priority corresponding to the alarm correlation relation in first round result, selects highest priority rule Corresponding alarm correlation relation is retained, if highest priority rule has multiple equal priorities, then sentence Whether disconnected rule is to support many rules, if single rule, selection time correlation at most retains, other discardings, such as Fruit is many rules, then retain corresponding result；

After the second wheel analysis, secondary analysis module reports the association results after the completion of the analysis of the second wheel to interface module.

2. communication network transmission class as claimed in claim 1 alerts the device of united analysis, it is characterised in that：The adaptation module The data for using include alarm, configuration data and service path data, and alarm includes location information, warning code, time of origin, Location information includes single-deck unique mark, network element unique mark and port-mark；Configuration data includes network element data, rubber bridge According to, port data；Service path data are 3 combinations of hierarchical data：Circuit->Path->Connection, a subnet transposition circuit It is combined into Protection path collection by operating path set, operating path set is identical with the data structure of Protection path set, road Footpath essential information includes ID of trace route path, circuit identifier, work/protection, service path information.

3. communication network transmission class as claimed in claim 2 alerts the device of united analysis, it is characterised in that：Remember in the alarm Record has temporal information, location information, the alarm correlation analysis result that warning code, alarm occur, alarm correlation analysis knot Fruit is according to the structure of regular unique mark+root alarm unique mark+derivative alarm unique mark to upper layer transfers.

4. communication network transmission class as claimed in claim 2 alerts the device of united analysis, it is characterised in that：The port-mark Including：(1) single-deck unique mark；(2) level where port；(3) port-mark character string；Level where port includes same The transmission medium layer of step number word series SDH serial equipments, higher order path layer, low order channel layer, PDH PDH physics Interface layer；The section layer of Packet Transport Network PTN serial equipments, channel layer, circuit layer, operation layer；The light of wave division multiplexing WDM series is passed Defeated layer OTS, optical multiplex layer OMS, optical channel layers OCH, client layer；Optical transfer network OTN series OTS layers, OMS layers, OCH layers, ODUk layers of light-path data cell, client layer, k=0,1,2,3,4.

5. communication network transmission class as claimed in claim 4 alerts the device of united analysis, it is characterised in that：The class of the port Type include physical terminal point PTP, floated terminal point FTP, connection end points CTP, port-mark character string according to port type, The set membership of port is identified；The string table of port-mark is shown as：[port type 1=port numbers 1] [/ port type 2 =port numbers 2] [/ port type 3=port numbers 3] ... [/ port type n=port numbers n], n is natural number.

6. the method that the communication network transmission class based on device any one of claim 1 to 5 alerts united analysis, its feature It is to comprise the following steps：

S1, whether warning code is judged in static data read through model, if it is, going to step S2；Otherwise, terminate；

After adaptation module, interface module reach Preprocessing module, foundation is in static data read through model for S2, alarm Rule and preprocessing and scheduling strategy, carry out alarm pretreatment assign：When interface module is input into an alarm, accused first Alert verification, if in the warning code of input alarm regular collection not in static data read through model, do not processed, Continue with next input alarm；When alarm is entered into Preprocessing module, the team of alarm to be analyzed is initially entered Row, taking-up is responsible for by assignment thread, alert the pretreatment in path；After assignment thread completes path pretreatment, according to line Journey selection algorithm, will alert and be delivered to the thread specified and be analyzed, and take out next alarm from queue again again, work as team In row during no alarm, then dormancy wait is carried out；When correlation service stopping, top service notifies that Preprocessing module stops The treatment of thread pool；

When Preprocessing module is directed to alarm correlation analysis, the related alarm of business possesses for the alarm on same path Correlation, non-traffic class alarm possesses correlation for the alarm in same network element：In concurrent processing, accused for non-traffic The related alarm of alert, business, similar alarm scheduling is processed in same thread；

The mode of the related alarm concurrent scheduling of business is：(1) service path is without service layer path：Treatment thread number=(alarm institute In path unique mark) % (business relevant processing thread number), % represents modulo operation；(2) service path has service layer path： Treatment thread number=(bottom service layer path unique mark in path where alarm) % (business relevant processing thread number)；

The mode of the unrelated alarm concurrent scheduling of business：Treatment thread number=(network element unique mark where alarm) (business is unrelated for % Treatment Thread Count)；

Concurrently classification treatment：Concurrently located based on the business related alarm alarm unrelated with business for possessing service path unique mark There is the situation of scene intersection during reason, concurrent processing is divided into two stages for the treatment of：The related alarm of first order processing business, without service path The alarm of unique mark then flows into the second level；For the alarm that the first order has drawn correlation results, the second level is no longer flow into；It is right In the alarm for flowing into the second level, the network element unique mark selection treatment thread for occurring according to alarm again；

S3, Preprocessing module alarm correlation Preprocessing flow it is as follows：

Corresponding correlation analysis rule is obtained by the alarm of current input, a set for rule is obtained；By alarm point Strategy is extracted in analysis, based on current input alarm, finds the alarm set of association；

The alarm set obtained by extraction, current alarm is used with the alarm of current input one by one with the alarm in alarm set Rule is analyzed, and checks whether matching, if it does not match, being calculated into next rule；If it does, then caching is current Analysis result；

After strictly all rules matching is completed, there is analysis result if none of rule, then cache current alarm, exit epicycle Preprocessing；Secondary analysis module is sent to if there is Preprocessing result, after merging, while this alarm is cached, Exit epicycle Preprocessing；

The extraction strategy of Preprocessing module institute foundation includes space constraint and time-constrain, and space constraint is alarm in network And the distribution relation produced on service path, time-constrain includes：Alarm time of origin is corresponded in spatial dimension in the alarm, with Centered on the alarm time of origin, respectively to analyze the limitation time as the time interval of positive and negative upper and lower limit；

The process of Preprocessing module generation alarm correlation data is as follows：

It is determined that after the alarm scope of constraint, the alarm set in restriction range is derived, as the object set that current alarm is analyzed Close, all alarms in current input alarm and goal set are alerted corresponding analysis by pre-analysis process according to current input Rule, is judged, if there is correlation, then the correlation is submitted into secondary analysis module, if non-correlation, no Process, retain the data preparation subsequent analysis；

After generating preanalysis relation in preanalysis, regular unique mark, business unique mark are carried in preanalysis relation, is divided The analysis time, as the foundation of secondary analysis；

S4, alarm correlation secondary analysis：The alarm of the correlation of Preprocessing result is stored as one by secondary analysis module Individual directed acyclic graph DAG, directed acyclic graph DAG store the relation between alarm, and the summit storage in directed acyclic graph is accused Alert unique mark and the alarm add the temporal information of graph of a relation, to alert unique mark as the foundation word of extreme saturation Section；

Relation between alarm represents that the starting point of arc represents Root alarm, and the terminal of arc is represented with the arc in directed acyclic graph DAG Derivative alarm, the attribute on arc includes time, Root alarm unique mark, derivative alarm unique mark, the industry of the generation of this arc Business path unique mark, regular unique mark, stable state field whether is reached；Respectively by different in the directed acyclic graph Connected component is constituted, and each connected component is actually an alarm correlation group, for the persistence of alarm correlation, on Report output is all based on the connected component；

Warning relation extreme saturation：Extreme saturation is regularly carried out in correlation DAG figures, below execution during extreme saturation Operation：The time on each summit in the connected component associated in the directed acyclic graph by judging the summit of current traversal is It is no to determine whether the relation between summit reaches stable state more than stabilization time threshold value, reach stable state then that this is steady Determine relation and be delivered to report queue；Determine to whether there is merging relation between summit, if there is the relation of merging, then merge top Point；Determine whether the alarm correlation relation represented between summit can be cached in persistence module；If above-mentioned connection point The time on all of summit is above stabilization time threshold value in amount, then it is assumed that reach persistence standard, and the connected component is respectively pushed up The alarm correlation relation perdurability represented between point；

During alarm correlation analysis exist by intermediateness produce interim pretreatment relation, this part relations refer to Lower method is merged：

Pretreatment correlation adjustment is based on root alert priority, type of service, treatment 4 conditions of rule type and process time, Suppress priority packet by alarm first, packet-priority is sorted by priority, and priority value is smaller, and priority is higher, selection One group of relation of highest priority, the low packet of other priority is abandoned, and the order of priority is as follows：

The packet of circuit unique mark is pressed first；

With in circuit unique mark group, selection rule prioritization highest is regular；If there are multiple phases in highest priority rule Same priority, then whether judgment rule is to support many rules, if single rule, selection time correlation at most Retain, other discardings, if many rules then retain corresponding result；

The second wheel exclusion, second are carried out by the alarm correlation relation that circuit unique mark packet transaction is calculated to the first round Wheel is excluded according to the regular priority corresponding to the alarm correlation relation in first round result, selects highest priority rule Corresponding alarm correlation relation is retained, if highest priority rule has multiple equal priorities, then sentence Whether disconnected rule is to support many rules, if single rule, selection time correlation at most retains, other discardings, such as Fruit is many rules, then retain corresponding result；

S5, second wheel analysis after, secondary analysis module to interface module report the second wheel analyze after the completion of association results, Terminate.

7. the method that communication network transmission class as claimed in claim 6 alerts united analysis, it is characterised in that：The adaptation module The data for using include alarm, configuration data and service path data, and alarm includes location information, warning code, time of origin, Location information includes single-deck unique mark, network element unique mark and port-mark；Configuration data includes network element data, rubber bridge According to, port data；Service path data are 3 combinations of hierarchical data：Circuit->Path->Connection, a subnet transposition circuit It is combined into Protection path collection by operating path set, operating path set is identical with the data structure of Protection path set, road Footpath essential information includes ID of trace route path, circuit identifier, work/protection, service path information.

8. the method that communication network transmission class as claimed in claim 7 alerts united analysis, it is characterised in that：Remember in the alarm Record has temporal information, location information, the alarm correlation analysis result that warning code, alarm occur, alarm correlation analysis knot Fruit is according to the structure of regular unique mark+root alarm unique mark+derivative alarm unique mark to upper layer transfers.

9. the method that communication network transmission class as claimed in claim 7 alerts united analysis, it is characterised in that：The port-mark Including：(1) single-deck unique mark；(2) level where port；(3) port-mark character string；Level where port includes same The transmission medium layer of step number word series SDH serial equipments, higher order path layer, low order channel layer, PDH PDH physics Interface layer；The section layer of Packet Transport Network PTN serial equipments, channel layer, circuit layer, operation layer；The light of wave division multiplexing WDM series is passed Defeated layer OTS, optical multiplex layer OMS, optical channel layers OCH, client layer；Optical transfer network OTN series OTS layers, OMS layers, OCH layers, ODUk layers of light-path data cell, client layer, k=0,1,2,3,4.

10. the method that communication network transmission class as claimed in claim 9 alerts united analysis, it is characterised in that：The port Type include physical terminal point PTP, floated terminal point FTP, connection end points CTP, port-mark character string according to port class Type, the set membership of port are identified；The string table of port-mark is shown as：[port type 1=port numbers 1] [/ port class Type 2=port numbers 2] [/ port type 3=port numbers 3] ... [/ port type n=port numbers n], n is natural number.