CN104376365A - Method for constructing information system running rule libraries on basis of association rule mining - Google Patents

Abstract

The invention discloses a construction method of an information system operation rule base based on association rule mining, which is characterized in that it includes the following steps: S01: Obtain the network topology structure of the information system and the dynamic monitoring indicators and static monitoring indicators of all equipment; S02 : Generate a network fault tree through the network topology and dynamic and static monitoring indicators of equipment, and generate a basic rule base through the network fault tree; S03: Execute the association rule mining algorithm on the historical data of the information system to obtain the association rule base; S04: Combine The basic rule base and the association rule base are inferred to generate an extended rule base; wherein, the retrieval priority of each rule base is: basic rule base>association rule base>extended rule base. Use fault tree technology and association rule mining technology to intelligently generate information system operation rule base, and use machine learning technology to optimize the rules. Furthermore, the three-domain structure of the rules is designed to realize the automatic sorting and automatic adjustment of the rules.

Description

A Construction Method of Information System Operating Rule Base Based on Association Rules Mining

technical field

The invention relates to a construction method of an information system operating rule base based on association rule mining.

Background technique

In order to ensure the safe, stable, and effective operation of the information system, the State Grid Corporation of China launched the construction of an integrated information operation and maintenance supervision system (hereinafter referred to as "IMS") covering "integrated network management, desktop management, security management, and operation and maintenance services" in 2008. In 2011, the whole network promotion of the system was completed, and in 2012, the in-depth application construction of the IMS system was completed with the six modules of "deep collection, equipment management, one order and two tickets, alarm center, display center, and green computer room" as the core. The work fully covers the network, network equipment, host, database, middleware, desktop terminal, security equipment and other IT basic equipment and real-time monitoring of business systems, providing technical support for the operation and maintenance of the information system of the entire network.

However, there are still the following deficiencies in the setting and judgment of operation monitoring rules:

1. The operation performance monitoring of IT infrastructure and business systems still requires operation and maintenance personnel to set monitoring threshold rules based on historical operation and maintenance experience and professional knowledge, which cannot adapt to the operating rules of IT infrastructure and business systems. The monitoring threshold rules solidified in the segment do not conform to the actual operating conditions, which is prone to false positives and false negatives;

2. The set operation monitoring rules cannot be rationally judged, and it is impossible to verify whether the set operation monitoring rules fit the actual operation of IT infrastructure and business systems;

3. The setting of operation monitoring rules has no self-learning function, and cannot be adjusted and optimized according to the historical operation conditions of IT infrastructure and business systems.

Contents of the invention

In view of the above problems, the present invention provides a method for constructing an information system operation rule base based on association rule mining, using fault tree technology and association rule mining technology to intelligently generate an information system operation rule base, and using machine learning technology to analyze the rules optimization. Furthermore, the three-domain structure of the rules is designed to realize the automatic sorting and automatic adjustment of the rules.

In order to achieve the above-mentioned technical purpose and achieve the above-mentioned technical effect, the present invention is realized through the following technical solutions:

A method for constructing an information system operating rule base based on association rule mining, characterized in that it includes the following steps:

S01: Obtain the network topology of the information system and the dynamic monitoring indicators and static monitoring indicators of all equipment;

S02: Generate a network fault tree through the network topology and dynamic and static monitoring indicators of equipment, and generate a basic rule base through the network fault tree;

S03: Execute an association rule mining algorithm on the historical data of the information system to obtain an association rule base;

S04: Combining the basic rule base and the association rule base for reasoning to generate an extended rule base;

Wherein, the retrieval priority of each rule base is: basic rule base>associated rule base>extended rule base.

Preferably, each rule of the basic rule base is a three-domain structure, including,

Rule sequence field: the number of successful executions of the rules during the actual running process, the number of execution failures, the final count of the rules and the ordering of the rules;

Rule identification field: used to identify the subordinate object of the rule;

Rule subject field: used to describe the rule in detail.

Preferably, the system executes the rule sorting algorithm and the rule flow algorithm in real time to determine the priority of the rules and refresh the rules.

Among them, in each rule base, the rule retrieval priority is determined by the rule final count index in the rule sequence domain, where the formula for the rule final count is:

F＝R-0.5W

In the formula, F is the final count, R is the number of successful rule executions in the actual running process, and W is the number of rule execution failures; if machine learning is performed on the execution failure scenarios, the relevant rules are optimized and related problems are solved, then Correspondingly, the number W of execution failures is reduced by one.

Preferably, the rule flow algorithm of the association rule base is: in the actual operation of the system, as long as the rule is proven correct once, it will be directly moved to the basic rule base; if the rule is proven wrong twice, the rule will be deleted.

Preferably, the rule flow algorithm of the extended rule base is: use historical data to verify all rules,

For rules with a success rate of 80% to 100%, use historical data for machine learning and then move directly to the basic rule base;

For rules with a success rate of 60% to 80%, after using historical data for machine learning, if the success rate is greater than 80%, move to the basic rule base, otherwise stay in the extended rule base, and accept machine learning of running data until Its success rate is greater than 80%;

For rules with a success rate of 50% to 60%, use historical data and operational data for machine learning until the success rate is greater than 80%, move to the basic rule base, otherwise stay in the extended rule base;

For the rules whose success rate is less than 50%, delete them directly.

The invention realizes the dynamic construction and optimization of the information system operation rule library, which can be applied to the company's information operation and maintenance comprehensive supervision platform, making the establishment and maintenance of monitoring and alarm rules easier, and the rule matching efficiency higher, thereby quickly adapting to information system objects and operating environments , Various changes in the operating state data source, while meeting the real-time requirements of large-scale information system rule set matching processing, greatly improving the practicability of the rule system, and improving the quality of information system monitoring and alarming, security management, behavior auditing and compliance management.

The beneficial effects of the present invention are:

1. The regionalized structure of the rule base: the rule base designed by the method of the present invention has three partitions, which store the basic rules, association rules and extension rules respectively, wherein the priority of the basic rules is the highest, followed by the association rules, and the priority of the extension rules lowest. Through the partitioning of the rule base, the priority order of rule retrieval can be determined through the priority management of rules, and the low-area rules can be upgraded through continuous real-time machine learning to realize the flow of rules from low to high.

2. The three-domain structure of the rule: The three-domain structure of the rule includes the rule sequence domain, the rule identification domain and the rule subject domain: the rule sequence domain implements the priority ordering of the rules through quantitative means; the rule identification domain is used to identify the subordination of the rule object, so as to facilitate the adaptive adjustment of the rule base when the network topology changes; the rule body field stores the main part of the rule, which is a detailed description of the rule.

3. Real-time adaptive threshold adjustment: the system uses historical performance data and operating data to analyze and calculate the alarm threshold suitable for business operation alarm requirements, improve the alarm self-learning ability for the information system, and use the threshold planning algorithm to dynamically adjust the alarm threshold. To reduce the amount of events from the source of the event, improve the quality of monitoring alarms.

4. Automatic rationality analysis of new rules storage: new rules can be automatically generated by the system, or added manually. For newly added rules, historical data and real-time operation data are used to rationalize the rules and determine the availability of the rules.

5. Automatic adjustment and optimization of rules: through real-time execution of the rule sorting algorithm and rule flow algorithm, the priority of the rules is determined and the priority is refreshed or upgraded to ensure that the rule base is in the optimal state and improve the retrieval efficiency of rules and the efficiency of rules. accuracy, thereby improving system performance.

Description of drawings

Fig. 1 is a flow chart of a method for constructing an information system operation rule base based on association rule mining in the present invention;

Fig. 2 is a three-domain structural diagram of the rules of the basic rule base of the present invention;

Fig. 3 is a flow chart of the rule flow algorithm for expanding the three regions of the rule base in the present invention.

Detailed ways

The technical scheme of the present invention will be described in further detail below in conjunction with the accompanying drawings and specific embodiments, so that those skilled in the art can better understand the present invention and implement it, but the examples given are not intended to limit the present invention.

A method for constructing an information system operating rule base based on association rule mining, as shown in Figure 1, includes the following steps:

S01: Obtain the network topology of the information system and the dynamic monitoring indicators and static monitoring indicators of all equipment.

Firstly, the network topology structure is obtained through topology discovery technology, and then for each network device in the topology structure, corresponding dynamic monitoring indicators and static monitoring indicators are collected, including network indicators, security indicators, host indicators, database indicators, middleware indicators and business indicators. Six categories of system indicators.

Network indicators include link delay, network device health running time, network device status, network device CPU usage, network device memory usage, receiving packet loss rate, sending packet loss rate, receiving error packet rate, sending error packet rate, Interface receiving traffic, interface sending traffic, interface total traffic, and interface bandwidth utilization; security indicators include security events, security device status (CPU, memory, etc.) and compliance; host indicators include host status, healthy running time, and CPU usage rate, memory usage, disk space usage, number of critical processes, and host configuration information.

Database indicators include SqlServer indicators, Oracle indicators and DB2 indicators. The SqlServer indicators include SGA hit rate, available cache size, dictionary buffer hit rate, shared cache area hit rate, Redo log buffer hit rate, number of sessions, number of available sessions, transaction response time, and table space availability , table space growth rate and MTS performance; Oracle indicators include the number of sessions, the number of available sessions, transaction response time, table space availability, table space growth rate, shared memory usage, shared memory hit rate and rollback segment usage; DB2 Indicators include Process availability, buffer pool (Bufferpool) availability, buffer pool hit rate, table space availability, table space growth rate, sorting index (SortsPerTransaction), number of sessions, and number of available sessions.

Middleware indicators include Weblogic indicators and Websphere indicators. Among them, Weblogic indicators include JVM memory heap free amount, JVM memory heap total amount, JVM memory heap usage rate, execution time of all Servlet calls, longest execution time of a single Servlet call, Servlet average execution time, Servlet execution times, and JDBC pool maximum Capacity, the high water mark of the number of active connections in the JDBC Pool, the high water mark of the number of waiting connections in the JDBC Pool, the cumulative number of connections since the instantiation of the JDBC Pool, the average number of active connections in the JDBC Pool, the average connection delay in the JDBC Pool, and the leakage rate of the JDBC Pool The number of connections, the current capacity of the JDBC pool, the number of JDBC Pool reconnection failures, the maximum number of available connections in the JDBC Pool, the maximum number of unavailable connections in the JDBC Pool, the number of JDBC Pool LEAKED connections, the number of available connections in the JDBC Pool, and the number of unavailable connections in the JDBC Pool Number of connections, JDBC Pool utilization, current session number, maximum session number, and session occupancy rate; Websphere indicators include JVM memory free, JVM total memory, JVM memory usage, average session lifetime, total number of currently accessed sessions, The total number of currently surviving sessions, the maximum capacity of the JDBC pool, the average number of active connections of the JDBC pool, the average connection delay of the JDBC pool, the number of leaked connections of the JDBC pool, the current capacity of the JDBC pool, the number of JDBC pool reconnection failures, and the maximum available JDBC pool The number of connections, the maximum number of unavailable connections in JDBC Pool, the number of JDBC Pool LEAKED connections, the number of available connections in JDBC Pool, the number of unavailable connections in JDBC Pool, and the utilization rate of JDBC Pool.

Business system indicators include the number of online users, the number of daily logged-in users, the operating status of the business system, the status of the interface of the business system, and the healthy running time of the business system.

S02: Generate a network fault tree through the network topology structure and dynamic and static monitoring indicators of equipment, and generate a basic rule base through the network fault tree. Through the construction of the fault tree, various monitoring indicators and the relationship between various network devices can be expressed concisely and clearly. Among them, the relevant thresholds in the basic rule base are determined through machine learning of historical data and execution of threshold planning algorithms.

For the basic rules, the three-domain structure of the rules is designed, as shown in Figure 2, including the rule sequence domain, the rule identification domain and the rule body domain.

The rule sequence field is used to store the number of successful executions of the rules, the number of failed executions, the final count of the rules, and the sorting of the rules during the actual running process. The purpose of the rule sequence field is to facilitate the ordering of the priority of the rules and improve the retrieval efficiency of the rules.

The rule identification field is used to identify the subordinate object of the rule, for example, the rule is the exclusive rule of a certain network device, or the rule belongs to a certain subnet or the entire network. The purpose of the rule identification field is to identify each rule. When the network topology changes, the rules that need to be deleted and modified can be identified through the identification field of the rule, and the corresponding topological structure of the changed part can be regenerated. Basic rules are used to add, delete, and modify rules, and intelligently construct a rule base that adapts to the new network architecture.

The rule body field stores the body part of the rule, which is a detailed description of the rule. Rules are production rules, which refer to a fixed logical structural relationship in people's thinking and judgment. The structure of a general production can be expressed in the form of natural language. In fact, in natural language expression, various "cause-effect", "condition-conclusion", "premise-operation", "fact-progress" are widely used ", "Situation-behavior" and other structures can all be attributed to productive knowledge expressions. The basic form of the rule: A→B or IF A THENB, A is the premise (precondition) of the production, which is used to indicate whether the production is available or not. B is a set of conclusions or operations (consequents), which are used to point out the conclusions that should be drawn or the operations that should be performed when the conditions indicated by the premise A are met. There are three types of reasoning in production rule reasoning: forward reasoning, reverse reasoning and two-way reasoning. The three reasoning methods have corresponding advantages in different situations, and they should be considered comprehensively when choosing the rule reasoning method.

S03: Execute the association rule mining algorithm on the historical data of the information system to obtain the association rule base. The association rules are generated through association rule mining and passed the inspection of historical data.

Preferably, an improved Apriori algorithm based on branch screening optimization strategy and database single scan technology is used to mine historical data association rules. Apriori algorithm is a frequent itemset algorithm for mining association rules. The algorithm is divided into two stages: finding frequent itemsets and mining association rules from frequent itemsets. The principle of the algorithm is to find frequent itemsets that satisfy the minimum support from the data set, and then generate association rules based on the frequent itemsets. The Apriori algorithm is a very classic association rule mining algorithm, but it has two disadvantages. When searching for frequent itemsets, many candidate sets will be generated, which wastes a lot of computing efficiency and time, and requires multiple scans of the database, which seriously affects the efficiency of the algorithm. For the first problem, hash table and bit container are used to filter the candidate set to reduce the consumption of the algorithm in generating the candidate set. Because the main consumption of the classic algorithm is in the generation of C1, L1, C2, and L2, filtering more branches in the generation of C2 can greatly improve the efficiency of the algorithm. For the second problem, the classical algorithm needs to scan the entire database every time it calculates the support, and the frequency of calculating the support in the algorithm is very high, which requires frequent scanning of the database, resulting in low efficiency of the algorithm. Therefore, by maintaining a Boolean matrix to record all the transaction information in the database, the Boolean matrix can be constructed only by scanning the database once. This Boolean matrix contains all the data needed to calculate the support, and there is no need to scan the database again in the future, greatly improving Algorithmic efficiency.

Through the improved Apriori algorithm, the historical data can be mined for association rules, and the obtained results can intelligently generate an association rule base with the cooperation of the threshold programming algorithm. Association rules are mined from historical data, passed the test of historical data, and have relatively high credibility, but there are still some uncertainties in association rules, and must pass the test of operational data before they can be upgraded to basic rules.

The relevant thresholds in the association rule base are determined by machine learning on historical data and executing threshold planning algorithms.

In terms of threshold determination, the basic rule base and association rule base use historical performance data to analyze and calculate alarm thresholds suitable for business operation alarm requirements, improve the alarm self-learning ability for information systems, optimize alarm logic, and dynamically adjust alarm thresholds. To reduce the amount of events from the source of the event and improve the quality of monitoring alarms.

Preferably, the threshold planning algorithm for a certain indicator is:

Statistically analyze the historical data of the indicator under normal network operation conditions, determine its maximum value, minimum value and median, and then determine the threshold according to the following formula:

${\mathrm{<span\; class="notranslate">\; T</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; +</span>\frac{\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; Z</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; *</span><span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; m</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>}{\mathrm{<span\; class="notranslate">\; 3</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>}$

In the formula, T _i is the threshold, D _i is the maximum value of the index under the normal operation of the network, Xi is the minimum value of the index under the normal operation of the network, M _i is the maximum value of the index design, _{Z i is} the normal operation of the network The median of the indicators below.

After the rule base is put into operation, all effective values of the indicator can participate in the calculation in real time under normal network operation conditions, and the threshold of the indicator can be determined in real time. The adaptive dynamic modification of the threshold improves the ability of the threshold to adapt to the system, which is beneficial to the improvement of the system performance.

S04: Combining the basic rule base and the association rule base to infer and generate an extended rule base.

Rules are production rules, which refer to a fixed logical structural relationship in people's thinking and judgment. The basic form of the rule: A → B or IF A THEN B, A is the premise (precondition) of the production, which is used to indicate the condition of whether the production is available. B is a set of conclusions or operations (consequents), which are used to point out the conclusions that should be drawn or the operations that should be performed when the conditions indicated by the premise A are met. Extended rules can be generated directly through rule inference using basic rules and association rules. For example, if there are rules "A→B", "B→C" and "A D", through rule reasoning, three extended rules "B→C", "D→B" and "D→C" can be obtained.

Extended rules are deduced from the basic rules and association rules. The reasoning of the rules itself has uncertainty, so the credibility of the extended rules is the lowest, and must undergo strict verification (including verification of historical data and verification of operating data). , to be upgraded to a basic rule.

On the basis of studying the construction technology of the information system operation monitoring and alarm rule base, starting from the monitoring type, data, source, alarm time, alarm mode, performance data, etc., through monitoring historical data and related daily operation and maintenance work order faults Type analysis, starting from different time periods such as busy periods and idle periods of the information system, combined with the business time and business volume of the information system, to understand the ebb and flow of the business, and use the historical performance data to analyze and calculate the alarm that is suitable for the alarm requirements of the business operation Threshold, improve the alarm self-learning ability of the information system, dynamically adjust the alarm threshold, reduce the amount of events from the source of the event, and improve the quality of monitoring alarms.

We can divide the rule base into three partitions to store different types of rules. For example, the first area stores the basic rule base, the second area stores the association rule base, and the third area stores the extended rule base. Wherein, the retrieval priority of each rule base is: basic rule base>associated rule base>extended rule base. In the rule retrieval process, the basic rules of the first area are searched first, and if no corresponding rules are found, the association rules of the second area and the extended rules of the third area are searched. The association rules of the second area and the extension rules of the third area are automatically adjusted and optimized through the machine learning of historical data. In addition, the relevant rules need to pass the rationality check of the historical data before they can be retained, otherwise the rules will be removed directly.

In addition, in each rule base partition, the priority of the rules can be determined by the rule sorting algorithm, specifically, the priority of the rules to be retrieved is determined by the rule final count index in the rule sequence field, and the rules with higher priority are retrieved first , the rules with low priority will be retrieved later, which can improve the efficiency of rule retrieval. Among them, the formula for the final count of the rule is:

F＝R-0.5W

In the formula, F is the final count, R is the number of successful rule executions in the actual running process, and W is the number of rule execution failures; if machine learning is performed on the execution failure scenarios, the relevant rules are optimized and related problems are solved, then Correspondingly, the number W of execution failures is reduced by one.

Through the inspection of historical data and operational data, it is possible to find out which of all the rules in the rule base are reasonable and which are unreasonable, and the rationality of the rules can be determined by means of quantitative analysis, for example, through the three-domain structure of the rules The final count indicator in the sequence domain of the rule in the middle is used to quantify the rationality of the rule. After the rationality analysis of the rules, the rules can be further processed intelligently. For example, some rules have been verified and meet the system requirements; some rules are generally reasonable and need to be used after machine learning; If the performance is relatively poor, it may be deleted directly.

Similarly, through machine learning of historical data and operating data, rule performance can be continuously improved to make it more compatible with the system, and corresponding performance optimization and adjustment suggestions can be provided. For example, the threshold value is not static, and the system operation data can be used to carry out adaptive real-time learning of the rules to improve the rationality of the rules.

In the design of the rule base, the flow of rules from the low-level area to the high-level area is also allowed. The flow of rules from the low-level area to the high-level area first requires verification of the rationality of the rules, and secondly requires machine learning to continuously improve the rationality of the rules. In the actual operation process, the rules are automatically adjusted and optimized through real-time operation data: through the rule sorting algorithm, the rules in the first, second and third areas of the rule base are prioritized and sorted, and the rule flow algorithm is used to Upgrade or refresh the rules of the second and third districts.

Among them, the rule flow algorithm of the association rule base is: in the actual operation of the system, as long as the rule is proved to be correct once, it will be directly moved to the basic rule base; if the rule is proved to be wrong twice, the rule will be deleted.

The rule flow algorithm of the extended rule base is shown in Figure 3: using historical data to verify all rules,

For rules with a success rate of 80% to 100%, use historical data for machine learning and then move directly to the basic rule base;

For rules with a success rate of 60% to 80%, after using historical data for machine learning, if the success rate is greater than 80%, move to the basic rule base, otherwise stay in the extended rule base, and accept machine learning of running data until Its success rate is greater than 80%;

For rules with a success rate of 50% to 60%, use historical data and operational data for machine learning until the success rate is greater than 80%, move to the basic rule base, otherwise stay in the extended rule base;

For the rules whose success rate is less than 50%, delete them directly.

By adjusting the priority of the rules in real time, the rule base can be in the optimal state, and the retrieval efficiency and accuracy of the rules can be improved, thereby improving the system performance. The priority adjustment of rules is very important. Frequently used rules and rules with high rationality should be retrieved in advance, and rules that are not commonly used and rules with low rationality can be retrieved later, which can improve the retrieval efficiency of rules and improve system performance. .

In addition, some operations can also be performed manually. For example, system operation and maintenance personnel can directly add and delete rules, and modify the relevant attributes of existing rules.

The beneficial effects of the present invention are:

1. The regionalized structure of the rule base: the rule base designed by the method of the present invention has three partitions, which store the basic rules, association rules and extension rules respectively, wherein the priority of the basic rules is the highest, followed by the association rules, and the priority of the extension rules lowest. Through the partitioning of the rule base, the priority order of rule retrieval can be determined through the priority management of rules, and the low-area rules can be upgraded through continuous real-time machine learning to realize the flow of rules from low to high.

2. The three-domain structure of the rule: The three-domain structure of the rule includes the rule sequence domain, the rule identification domain and the rule subject domain: the rule sequence domain implements the priority ordering of the rules through quantitative means; the rule identification domain is used to identify the subordination of the rule object, so as to facilitate the adaptive adjustment of the rule base when the network topology changes; the rule body field stores the main part of the rule, which is a detailed description of the rule.

3. Real-time adaptive threshold adjustment: the system uses historical performance data and operating data to analyze and calculate the alarm threshold suitable for business operation alarm requirements, improve the alarm self-learning ability for the information system, and use the threshold planning algorithm to dynamically adjust the alarm threshold. To reduce the amount of events from the source of the event, improve the quality of monitoring alarms.

4. Automatic rationality analysis of new rules storage: new rules can be automatically generated by the system, or added manually. For newly added rules, historical data and real-time operation data are used to rationalize the rules and determine the availability of the rules.

5. Automatic adjustment and optimization of rules: through real-time execution of the rule sorting algorithm and rule flow algorithm, the priority of the rules is determined and the priority is refreshed or upgraded to ensure that the rule base is in the optimal state and improve the retrieval efficiency of rules and the efficiency of rules. accuracy, thereby improving system performance.

The invention realizes the dynamic construction and optimization of the information system operation rule library, which can be applied to the company's information operation and maintenance comprehensive supervision platform, making the establishment and maintenance of monitoring and alarm rules easier, and the rule matching efficiency higher, thereby quickly adapting to information system objects and operating environments , Various changes in the operating state data source, while meeting the real-time requirements of large-scale information system rule set matching processing, greatly improving the practicability of the rule system, and improving the quality of information system monitoring and alarming, security management, behavior auditing and compliance management.

The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made by using the description of the present invention and the contents of the accompanying drawings, or directly or indirectly used in other related technical fields , are all included in the scope of patent protection of the present invention in the same way.

Claims (10)

1. A method for constructing an information system operating rule base based on association rule mining, characterized in that, comprising the steps: S01: Obtain the network topology of the information system and the dynamic monitoring indicators and static monitoring indicators of all equipment; S02: Generate a network fault tree through the network topology and dynamic and static monitoring indicators of equipment, and generate a basic rule base through the network fault tree; S03: Execute an association rule mining algorithm on the historical data of the information system to obtain an association rule base; S04: Combining the basic rule base and the association rule base for reasoning to generate an extended rule base; Wherein, the retrieval priority of each rule base is: basic rule base>associated rule base>extended rule base. 2. the construction method of a kind of information system operating rule base based on association rule mining according to claim 1, it is characterized in that, each rule of basic rule base is a three-domain structure, promptly comprises, rule sequence domain: rule in The number of successful executions, the number of failed executions, the final count of rules and the sorting of rules during the actual operation; Rule identification field: used to identify the subordinate object of the rule; Rule subject field: used to describe the rule in detail. 3. the construction method of a kind of information system operating rule base based on association rule mining according to claim 1, it is characterized in that, the correlation threshold in the basic rule base and the association rule base is passed through the machine learning and execution threshold to historical data planning algorithm to determine. 4. the construction method of a kind of information system operating rule base based on association rule mining according to claim 3, is characterized in that, described threshold value programming algorithm is: Statistically analyze the historical data of the indicator under normal network operation conditions, determine its maximum value, minimum value and median, and then determine the threshold according to the following formula: ${\mathrm{<span\; class="notranslate">\; T</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; +</span>\frac{\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; Z</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; *</span><span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; m</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>}{\mathrm{<span\; class="notranslate">\; 3</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>}$ In the formula, T _i is the threshold, D _i is the maximum value of the index under the normal operation of the network, Xi is the minimum value of the index under the normal operation of the network, M _i is the maximum value of the index design, _{Z i is} the normal operation of the network The median of the indicators below. 5. A method for constructing an information system operating rule base based on association rule mining according to claim 1, wherein the system executes the rule sorting algorithm and the rule flow algorithm in real time to determine the priority of the rules and refresh the rules. 6. A method for constructing an information system operating rule base based on association rule mining according to claim 5, wherein, in each rule base, it is determined that the rule is determined by the rule final count index in the rule sequence domain. The priority of the search, where the formula for the final count of the rule is: F＝R-0.5W In the formula, F is the final count, R is the number of successful rule executions in the actual running process, and W is the number of rule execution failures; if machine learning is performed on the execution failure scenarios, the relevant rules are optimized and related problems are solved, then Correspondingly, the number W of execution failures is reduced by one. 7. the construction method of a kind of information system operating rule base based on association rule mining according to claim 5, is characterized in that, the rule flow algorithm of association rule base is: During the actual operation of the system, as long as the rule is proved to be correct once, it will be directly moved to the basic rule base; if the rule is proved to be wrong twice, the rule will be deleted. 8. the construction method of a kind of information system operating rule base based on association rule mining according to claim 5, is characterized in that, the rule flow algorithm of extended rule base is: Use historical data to verify all rules. For rules with a success rate of 80% to 100%, use historical data for machine learning and then move directly to the basic rule base; for rules with a success rate of 60% to 80%, use historical data for verification. After machine learning, if the success rate is greater than 80%, move to the basic rule base, otherwise stay in the extended rule base, and accept the machine learning of the running data until the success rate is greater than 80%; for the success rate between 50% and 60% For rules, use historical data and running data for machine learning, until the success rate is greater than 80%, move to the basic rule base, otherwise stay in the extended rule base; for rules with a success rate of less than 50%, delete them directly. 9. the construction method of a kind of information system operating rule base based on association rule mining according to claim 1, it is characterized in that, in step S03, adopt the improved Apriori algorithm based on branch screening optimization strategy and database single scan technology To carry out mining of historical data association rules; wherein, the improved Apriori algorithm uses hash tables and bit containers to filter the candidate sets, reducing the consumption of the algorithm in generating candidate sets, and recording in the database by maintaining a Boolean matrix All business information. 10. A method for constructing an information system operating rule base based on association rule mining according to claim 1, characterized in that system operation and maintenance personnel can directly add and delete rules, and modify the relevant attributes of existing rules .