CN105786919A - Alarm association rule mining method and device - Google Patents

Abstract

The invention discloses an alarm association rule mining method. The method comprises the following steps: de-noising the current network alarm according to set field information and obtaining a weight parameter of the de-noised alarm according to an alarm characteristic attribute; carrying out window splitting on the de-noised alarm; constructing a transaction database, and constructing a weighted frequent mode tree by taking the de-noised alarm as a project, taking an alarm window as a transaction and combining the weight parameter of the de-noised alarm; obtaining a weighted frequent mode set according to the weighted frequent mode tree; and obtaining a weighted association rule for alarms in the weighted frequent mode set according to a relationship between the weighted frequent mode set and all the sub-sets thereof. According to the method disclosed in the invention, the efficient and correct mining of the alarm association rule can be realized. The invention furthermore discloses an alarm association rule mining device.

Description

A kind of alarm association rule digging method and device

Technical field

The present invention relates to communication technical field, be specifically related to alarm association rule digging technology.

Background technology

Telecom operators have passed through network management system construction for many years, constantly perfect, in alarm management, had the analyzing and processing flow process of comparatively ripe monitoring management pattern and alarm data.The alarm monitoring of telecom network management system and management module, play an important role in daily maintenance work, become the indispensable instrument of operator's alarm monitoring, management and operational analysis.

Recent years data mining technology all achieves the application effect attracted people's attention in every profession and trade, is also such in the communications industry, has had the many application case of comparison particularly in business support field.In alarm application aspect, operator have accumulated substantial amounts of alarm history data, is wherein likely to comprise substantial amounts of business rule or logic, and the service operation that alarm is relevant is had positive help.In the past owing to there is no good technological means support to process the alarm history data of bulky, therefore the excavation of professional knowledge in alarm data is also had tried to less.

In current communication network alarm association rule generally by business expert, O&M expert based on accumulation correlation experience, summarize refinement, it is initially formed alternative rule, after expert team discusses and determines, part rule is as preference rule, implementing existing network checking, the rule being verified eventually enters into alarm association rule base, formally promotes the use of at existing network.This manual type obtains the method for existing network efficient association rule, itself exists inefficient, and relies on specific specialists experience so that effectively the procurement cost of alarm association rule is high, it is difficult to adapt to the new business scene constantly occurred.Owing to new business network is based on new technologies and methods, and network structure is more complicated, there is network structure change trend more and more frequently simultaneously, originally relies on the mode of expertise to be increasingly difficult to prove effective, and the acquisition of new effectively rule becomes more and more difficult.Dissimilar network element, different stage alert, or other factors may result in alarm quantity distribution and there are differences, and this species diversity can not be fully achieved expection to the result making alarm regulation excavate.Therefore, the method carrying out effective rule digging and acquisition by building system dependence existing network data is of great practical value, and Ye Shi telecom operators O&M, monitoring user need in a hurry.

In sum a kind of based on existing network data realize automatically analyze and accurately excavate alarm of telecommunication network correlation rule technology urgently occur.

Summary of the invention

The present invention provides a kind of alarm association rule digging method, and described method includes:

According to the field information set, existing network alarm is carried out denoising, and obtain the weight parameter of described denoising alarm according to alarm feature attribute；

Described denoising alarm is carried out a point window；

Structure transaction database, alerts as project using described denoising, and described alarm window is as affairs, and then the weight parameter in conjunction with described denoising alarm constructs weighting frequent pattern tree (fp tree)；

Weighting fuzzy frequent itemsets is obtained according to described weighting frequent pattern tree (fp tree)；

Relation according to described weighting fuzzy frequent itemsets and its all subsets obtains described weighting frequent mode and concentrates the weighted association rules between alarm.

Preferably, described method also includes:

According to network element resources information, obtain the network element relation between described denoising alarm；

Network element relation between alerting according to described denoising, is filtered the weighting fuzzy frequent itemsets of described acquisition；

Relation according to the weighting fuzzy frequent itemsets after filtering and its all subsets obtains described weighting frequent mode and concentrates the weighted association rules between alarm.

Detailed, between alerting according to described denoising network element relation, the method that the weighting fuzzy frequent itemsets of described acquisition is filtered particularly as follows:

Judge whether any two project that described weighting frequent mode is concentrated exists network element relation, if it does not exist, then filter described weighting fuzzy frequent itemsets.

Detailed, the method for the described weight parameter obtaining denoising alarm according to alarm feature attribute particularly as follows:

Belonging to the alarm level alerted according to described denoising and alarm, the NE type of network element calculates the weight parameter of described denoising alarm.

Further, described structure transaction database, alert as project using described denoising, described alarm window as affairs, and then in conjunction with described denoising alarm weight parameter structure weighting frequent pattern tree (fp tree) method particularly as follows:

The each project in described transaction database of obtaining support number in transaction database and K support expectation, support that the project in described transaction database is carried out first time and filters by expectation according to the support number of described each project and K；

Set minimum achievement support, calculate the product of the support of each project and its weight parameter in described transaction database, and the project in described transaction database is carried out second time filtration by the minimum achievement support that combination is preset；

By described each affairs in the remaining described transaction database of twice filtration according to affairs in the support number descending of are remaining items；

By the transaction database of described descending according to FP-growth method construct weighting frequent pattern tree (fp tree).

Further, described according to described weighting frequent pattern tree (fp tree) obtain weighting fuzzy frequent itemsets method particularly as follows:

Scan described weighting frequent pattern tree (fp tree), calculate the weighted support measure of each branch in tree, cut the described weighted support measure branch less than default weighted support measure threshold value；

Each branch in described beta pruning rear weight frequent pattern tree (fp tree) is converted into a weighting fuzzy frequent itemsets, the node of the element correspondence branch in set.

Preferably, described method also includes:

Length according to the preset rules degree of depth described weighting fuzzy frequent itemsets of deletion exceedes the weighting fuzzy frequent itemsets of the described rule degree of depth.

Detailed, the described relation according to described weighting fuzzy frequent itemsets and its all subsets obtain described weighting frequent mode concentrate weighted association rules between alarm method particularly as follows:

Obtain all nonvoid subsets of described each weighting fuzzy frequent itemsets；

Calculate the confidence level of described weighting fuzzy frequent itemsets nonvoid subset each with it；

When described confidence level is more than default min confidence, the nonvoid subset that described weighting fuzzy frequent itemsets is corresponding the weighted association rules generated is set up.

Detailed, the described method that according to the field information set, existing network alarm is carried out denoising particularly as follows:

According to the field information incomplete alarm of cancel (CANCL) segment data set, removal engineering alerts, removal non-communicating equipment class alerts, remove associated alarm, removal slightly alerts, removal repeats alarm.

Invention additionally discloses a kind of alarm regulation correlating method excavating gear, described device includes:

Alarm pretreatment unit, for existing network alarm being carried out denoising according to the field information set, and obtains the weight parameter of described denoising alarm according to described alarm feature attribute；

Alarm point window unit, carries out a point window for the denoising alarm after described alarm pretreatment unit is processed；

Weighting frequent pattern tree (fp tree) structural unit, for constructing transaction database, denoising after processing using described alarm pretreatment unit alerts as project, and described alarm divides each alarm window that window unit determines as affairs, and then in conjunction with the weight parameter structure weighting frequent pattern tree (fp tree) of described denoising alarm；

Weighting fuzzy frequent itemsets acquiring unit, for obtaining weighting fuzzy frequent itemsets according to the weighting frequent pattern tree (fp tree) of described weighting frequent pattern tree (fp tree) structural unit structure；

Relationship data mining unit, the relation for the weighting fuzzy frequent itemsets obtained according to described weighting fuzzy frequent itemsets acquiring unit and its all subsets obtains the weighted association rules between the concentration alarm of described weighting frequent mode.

Preferably, described device also includes weighting fuzzy frequent itemsets filter element:

Described alarm pretreatment unit, is additionally operable to the field information according to described setting, obtains the network element relation between described denoising alarm；

Described weighting fuzzy frequent itemsets filter element, for the network element relation between the denoising alarm according to the acquisition of described alarm pretreatment unit, is filtered the weighting fuzzy frequent itemsets of described acquisition；With, the length of weighting fuzzy frequent itemsets according to preset rules depth-type filtration exceedes the weighting fuzzy frequent itemsets of the described rule degree of depth；

The relation that relationship data mining unit obtains the weighting fuzzy frequent itemsets after filter element filters and its all subsets according to described weighting fuzzy frequent itemsets obtains the weighted association rules between the concentration alarm of described weighting frequent mode.

Detailed, described alarm pretreatment unit farther includes:

Alarm denoising module, alerts for the field information incomplete alarm of cancel (CANCL) segment data according to setting, removal engineering, remove the alarm of non-communicating equipment class, removal associated alarm, removal slightly alarm, removes and repeat to alert；

Alarm weight computation module, belonging to the alarm level alerted according to described denoising and alarm, the NE type of network element calculates the weight parameter of described denoising alarm；

Network element Relation acquisition module, for according to network element resources information, obtaining the network element relation between described denoising alarm.

Detailed, described weighting frequent pattern tree (fp tree) structural unit farther includes:

Project filtering module, supports expectation for obtaining the support number in transaction database of each project in described transaction database and K, supports that the project in described transaction database is carried out first time and filters by expectation according to the support number of described each project and K；Set minimum achievement support, calculate the product of the support of each project and its weight parameter in described transaction database, and the project in described transaction database is carried out second time filtration by the minimum achievement support that combination is preset；

Transaction orderings module, being used for will the support number descending of are remaining items in each affairs in the described project filtering module remaining described transaction database of filtration are according to affairs；

Weighting frequent pattern tree (fp tree) constructing module, the affairs being used for sort through described transaction orderings module are according to FP-growth method construct weighting frequent pattern tree (fp tree).

Detailed, described weighting fuzzy frequent itemsets acquiring unit farther includes:

Beta pruning module, is used for scanning described weighting frequent pattern tree (fp tree) constructing module weighting frequent pattern tree (fp tree), calculates the weighted support measure of each branch in tree, cuts the described weighted support measure branch less than default weighted support measure threshold value；

Weighting fuzzy frequent itemsets acquisition module, for each branch in the weighting frequent pattern tree (fp tree) after described beta pruning module beta pruning is converted into a weighting fuzzy frequent itemsets, the node of the element correspondence branch in set.

Detailed, described relationship data mining unit farther includes:

Subset acquisition module, for obtaining all nonvoid subsets of each weighting fuzzy frequent itemsets that described weighting fuzzy frequent itemsets acquisition module obtains；

Confidence calculations module, for calculating the confidence level of described weighting fuzzy frequent itemsets nonvoid subset each with it；

Rule sets up determination module, for when the confidence level that described confidence calculations module calculates is more than default min confidence, it is determined that the weighted association rules generated by the nonvoid subset that described weighting fuzzy frequent itemsets is corresponding is set up.

Based on dissimilar network element, different stage alarm, or the result that other factors may result in alarm regulation excavation is inaccurate, first existing network alarm is carried out denoising and weight calculation by the present invention, denoising is the alarm eliminating and being not suitable for doing rule digging in existing network data, such as engineering alarm, slight alarm etc., namely weight calculation considers and is similar to the factor that high level alarm is bigger than low-level alarm influence degree, it is possible to obtain alarm association rule more accurately；Further, by building weighting frequent pattern tree (fp tree), alarm regulation is excavated, during excavation, consider the resources relationship of weight and network element, it is to avoid the output of " rubbish rule ", improve the accurately fixed of rule digging；The benefit setting up tree construction on the other hand is that the item in transaction database is all compressed on one tree, when looking for frequent item set, need not multiple scanning raw data base, avoid substantial amounts of I/O expense, therefore present invention achieves a kind of technology automatically analyzed based on existing network data and accurately excavate alarm of telecommunication network correlation rule.

Accompanying drawing explanation

The schematic flow sheet of a kind of alarm association rule digging method that Fig. 1 provides for the embodiment of the present invention one；

The method preferred flow schematic diagram that Fig. 2 provides for the embodiment of the present invention two；

The invention of doing that Fig. 3 provides for the embodiment of the present invention three builds weighting frequent pattern tree (fp tree) method flow schematic diagram；

The present invention that Fig. 4 provides for the embodiment of the present invention four obtains the method flow schematic diagram of weighting fuzzy frequent itemsets；

The method flow schematic diagram that Fig. 5 provides for the embodiment of the present invention five；

Structure weighting frequent pattern tree (fp tree) schematic diagram in the method that Fig. 6 provides for the embodiment of the present invention five；

A kind of alarm association rule digging apparatus structure schematic diagram that Fig. 7 provides for the embodiment of the present invention six；

The apparatus structure schematic diagram that Fig. 8 provides for the embodiment of the present invention seven.

Detailed description of the invention

Describe embodiments of the present invention in detail below in conjunction with graphic and embodiment, thereby the present invention how application technology means are solved technical problem and reaches the process that realizes of technology effect and can fully understand and implement according to this.

Correlation rule indicates that in data base the rule of certain incidence relation between a group objects.Association between data item, namely in affairs, the appearance of some data item can derive the appearance in same affairs of other data item.

Correlation rule be shape asImplication, whereinAnd

Below as it is shown in figure 1, provide embodiments of the invention one to set forth a kind of alarm association rule digging method, described method includes:

Step S101: according to the field information set, existing network alarm is carried out denoising, and obtain the weight parameter of described denoising alarm according to alarm feature attribute.

The weight parameter calculating alarm is to combine some attributes alerted to determine the importance of alarm, and such as different alarm levels, business is different with the influence degree of network element, it is necessary to treat with a certain discrimination；Different network elements, the scope owing to managing business is different, and importance is also different；Therefore alarm weight is calculated in combinations with alarm level and NE type.Select other alarm attributes to calculate the weight of alarm also dependent on actual demand, flexible selection can be made.

Needs according to mining analysis and the result of pretreatment, its alarm level of the alarm of analysis to be excavated is divided into three, 1 grade (serious, Critical)；2 grades (important, Major)；3 grades (secondary, Minor)

NE type is also classified into three classes, and (every class gives part NE type sample, other are not at NE type described herein or newly-increased NE type, can same method process), one class: MSC/GMSC (101)/MSCserver (130)/MGW (131), HLR (102), HSTP/LSTP (108)；Two classes: BSC (200)/RNC (9200), bts (201)/NodeB (9201), STP (108)；Three classes: Cell (300)/utracell (9300).

Step S102: described denoising alarm is carried out a point window.

In communication network, the alarm of distinct device producer can focus on and carry out unified management in network management system, for network management system, alarm data is exactly continuous, the stream data of time upper " with neither head nor tail ", it is necessary to after special handling, could excavate the incidence relation between alarm.

Adopt sliding window mechanism that alarm data carries out " transactionization " to process at this, namely artificial from time dimension, alarm is carried out " branch mailbox " processes, but it not simple according to different time points, alarm is put under in different windows, but the method adopting sliding window, solve the problem that the window edge alarm association relation of non-sliding window method existence is likely to lose.

Step S103: structure transaction database, alerts as project using described denoising, and described alarm window is as affairs, and then the weight parameter in conjunction with described denoising alarm constructs weighting frequent pattern tree (fp tree).

Step S104: obtain weighting fuzzy frequent itemsets according to described weighting frequent pattern tree (fp tree).

Step S105: obtain described weighting frequent mode according to the relation of described weighting fuzzy frequent itemsets and its all subsets and concentrate the weighted association rules between alarm.

In order to better set forth the present invention, embodiments of the invention two are given below, as shown in Figure 2:

Step S201: according to the field information set, existing network alarm is carried out denoising, and obtain the weight parameter of described denoising alarm according to alarm feature attribute.

Alarm denoising, refers to and alarm data is carried out and filters, and in alarm initial data, some alarm is noise data or unwanted for alarm mining analysis, it is necessary to these data rejected.

According to the field information incomplete alarm of cancel (CANCL) segment data set, removal engineering alerts, removal non-communicating equipment class alerts, remove associated alarm, removal slightly alerts, removal repeats alarm.Concrete process content is as follows:

A) full dose alarm data is filtered out according to the needs excavated the field contents of necessity.As shown in table 1:

Table 1 alerts the signal of necessary field

Field name	Field is abridged	Can be empty
			NE ID	int_id	No

[0091]

NE type	object_class	No
			Alarm title ID	alarm_title	No
Alarm title	alarm_title_text	No
			Raising Time	event_time	No
Original alarm rank	org_severity	No
			Producer's alarm level	vendor_severity	No
Alarm classification	org_type	No
			Alarm cleared time	cancel_time	It is
Alarm active state	active_status	No
			OMC_id	omc_id	No
Alarm number	omc_alarm_id	No
			Redefine rank	redefine_severity	No
Redefine classification	redefine_type	No
			Group's alarm level	group_severity	No
Districts and cities' alarm level	region_severity	No
			Alarm subtype	sub_alarm_type	No
Resource status	resource_status	No
			Home network element ID	parent_int_id	No
Home network element type	parent_object_class	No
			Producer ID	vendor_id	No
Vendor name	vendor_name	No
			Element name	ne_lable	No
City name	city_name	No
			City ID	city_id	No
Area ID	region_id	No
			Area name	region_name	No
Network type	network_type	No
			Alarm engineering state	alarm_resource_status	No
Many types	professional_type	No
			Work order state	sheet_status	No

[0092]

Work order number	sheet_no	No
			Logic Alarm Classification	logic_alarm_type	It is
Logic alarm subclass	logic_sub_alarm_type	It is
			Standard alarm ID	standard_alarm_id	No
The alarm impact on equipment	effect_ne	It is
			The alarm impact on business	effect_service	It is
Device object type	eqp_object_class	No
			Standardization mark	standart_flag	No
Element name	Ne_label	No
			Network element Chinese	Zh_label	It is

B) remove incomplete alarm data, for alarm mining analysis list of fields above, check that whether alarm data is complete.

According to the mark that in table can be sky, it is determined that whether alarm data is complete, if "No" can be designated for empty, then it represents that this field can not be empty, and this field alerted is sky, then show that this alarm is imperfect alarm, it is necessary to removal.

C) engineering alarm is removed.

Engineering alarm belongs to noise data to excavating, it is necessary to filter, and judges whether this alarm is engineering alarm according to " alarm engineering state " field in above-mentioned table 1.

D) alarm of non-communicating equipment class is removed.

Such as: the alarm etc. that the alarm of performance alarm, webmaster acquisition layer and other webmaster modules self produce, these alarms non-real equipment alarm, it is also desirable to filter out, judge according to " alarm type " field in above-mentioned table 1.

E) " associated alarm " (alarm that non-network element device produces) generated in removal system

F) " slightly " alarm is removed

In general slight alarm is made without the process of monitoring O&M department, it is not necessary to carries out the mining analysis of alarm association rule, directly filters out such alarm, judge according to alarm level.

G) repetition alarm data (for mining analysis, belong to the alarm data of repetition) is rejected

The excavation of alarm association rule is no advantage by the alarm repeated, but can increase the complexity of process, and the efficiency that also influential system processes, the alarm of repetition only retains one.

The weight calculation of alarm can have a variety of mode, and the present invention provides a kind of method calculating weight again, carries out weight calculation based on alarm level and NE type.

Weight ratio listed respectively by table 1, table 2, table 3:

The weight ratio of table 1 alarm level and NE type

Project project	Alarm level	NE type
			Alarm level	1	3
NE type	1:3	1

Value in contrast matrix, represents the importance ratio of column name and row title, such as: 1:3 (0.333333) represents that NE type is lower than alarm level importance, and value relation is 1/3.

Weight ratio between table 2 alarm level

Project project	One-level	Two grades	Three grades
				One-level	1	3	9
Two grades	1:3	1	3
				Three grades	1:9	1:3	1

Weight ratio between table 3 NE type

Project project	One class	Two classes	Three classes
				One class	1	3	9
Two classes	1:3	1	3
				Three classes	1:9	1:3	1

Variety classes alarm weight (one has 9 kinds) can be obtained by calculating:

Illustrate and be calculated alerting class 1:

1, each alarm of the bottom, has two lines to obtain weight: alarm level and NE type, and according to contrast matrix design, alarm level weight 0.75, NE type weight was 0.25 (total weight value adds and is 1)

2, alarm level is subdivided into three grades, according to contrast matrix design, calculates basic alarm weight in three and is respectively as follows: Level 1Alarming (0.5192), two grades of alarms (0.1731), three grades of alarms (0.0577).NE type is similar.

Citing: Level 1Alarming weight=0.75* (9/ (9+3+1)) ≈ 0.5192.

3, the weight computations of final alarm class 1 is as follows:

Weight value=(0.75* (9/ (9+3+1))+0.25* (9/ (9+3+1)))/3

≈0.2308

Step S202: described denoising alarm is carried out a point window.

Adopt sliding window mechanism, relate generally to two parameters: length of window and sliding step.

Length of window: belong to empirical data, it is determined that it is not many that principle is usually in window alarm quantity, and obtain rule moderate number through the process of mining algorithm, can on-the-spot test determine.

Sliding step: about 1st/to ten/5ths of desirable length of window.

Step S203: according to network element resources information, obtain the network element relation between described denoising alarm.

Extracting " the network element relation " in resource data according to net element business relation, the foundation extracting network element relation is as follows:

) there is transmission link between network element and connect；

A) there is operational control relation between network element；

B) there is power supply relation between network element；

C) there is same location relation between network element, such as: " being positioned at identical machine room " or " being in identical machine building " relation；

Form network element set of relationship, as the basic data that follow-up mining algorithm filters.

Network element set of relationship after resource data is processed, arranges, it is possible to form network element relation storehouse.As shown in table 4:

Table 4 network element relation storehouse represents meaning

Step S204: structure transaction database, alerts as project using described denoising, and described alarm window is as affairs, and then the weight parameter in conjunction with described denoising alarm constructs weighting frequent pattern tree (fp tree).

If I={i₁,i₂,…,i_nIt is a set of n disparity items, i_k, k=1,2 ..., n is called that project, D are transaction databases, D={t₁,t₂,…,t_k, wherein t_p, p=1,2 ..., k is the subset of set I, t_pIt is called affairs, arbitrary affairs t in D_p∈ D, meetsArbitrary affairs t_pThere is unique Transaction Identifier, be denoted as TID.

Generally, comprising multiple affairs in transaction database D, after alarm performs point window operation, each window is considered affairs, is arranged in the alarm of each window, is considered project.Therefore transaction database comprises multiple affairs, and each transaction packet is containing multiple projects, and the alarm after denoising and point window operation is the project in transaction database.

Weight parameter structure weighting frequent pattern tree (fp tree) in conjunction with alarm has all been compressed to the project in transaction database on a tree to a certain extent, when next step finds frequent item set, it is not necessary to multiple scanning data base, it is to avoid substantial amounts of I/O expense.

Step S205: obtain weighting fuzzy frequent itemsets according to described weighting frequent pattern tree (fp tree).

Namely each branch on weighting frequent pattern tree (fp tree) can be considered a weighting fuzzy frequent itemsets.Obtain all branches on weighting frequent pattern tree (fp tree), namely obtain all weighting fuzzy frequent itemsets on tree, but consider actual application scenarios, need when some according to practical situation, the weighting fuzzy frequent itemsets obtained to be filtered.

Step S206: the network element relation between alerting according to described denoising, is filtered the weighting fuzzy frequent itemsets of described acquisition.

During in conjunction with the whole network resource, it is found that the network element at alarm place can exist various relation, therefore 4 kinds of relations as described in table 1 filter out alarm association rule by network element relation, should have certain accuracy.

Judge whether any two project that described weighting frequent mode is concentrated exists network element relation, if it does not exist, then filter described weighting fuzzy frequent itemsets.

Through above-mentioned judgement, if weighting frequent mode is concentrated two project not network element relations, then illustrate that the alarm association rule that the project concentrated with this weighting frequent mode generates is likely inaccurate, therefore this weighting fuzzy frequent itemsets is filtered out.

This filtration step is preferred steps, on the basis by network element relation filtering alarm correlation rule, it is also possible to be filtered by limiting the length of weighting fuzzy frequent itemsets.In conjunction with concrete application scenarios, the length needing the weighting fuzzy frequent itemsets obtained can not be excessive, if the length of weighting fuzzy frequent itemsets is very big, weighted association rules explanatory just very poor so generated by this weighting fuzzy frequent itemsets, therefore, when generating weighting fuzzy frequent itemsets, ensure the interpretability of weighted association rules by restricting the length of weighting fuzzy frequent itemsets.

The method being embodied as is, exceedes the weighting fuzzy frequent itemsets of the described rule degree of depth according to the length of the preset rules degree of depth described weighting fuzzy frequent itemsets of deletion.

Step S207: obtain described weighting frequent mode according to the relation of the weighting fuzzy frequent itemsets after filtering and its all subsets and concentrate the weighted association rules between alarm.

After above-mentioned steps, would know that weighting frequent mode is concentrated to exist between projects and certainly exist correlation rule, therefore can obtain weighted association rules according to weighting fuzzy frequent itemsets subset relation each with it, namely obtain final alarm association rule.

Method particularly includes:

Obtain all nonvoid subsets of described each weighting fuzzy frequent itemsets.

Calculate the confidence level of described weighting fuzzy frequent itemsets nonvoid subset each with it.

When described confidence level is more than default min confidence, the nonvoid subset that described weighting fuzzy frequent itemsets is corresponding the weighted association rules generated is set up.

In order to better illustrate that the present invention constructs the step of weighting frequent pattern tree (fp tree), embodiments of the invention three are given below, as shown in Figure 3:

In order to better explain the building method of weighting frequent pattern tree (fp tree), it is necessary to some terms are explained:

Support: assuming that X is an Item Sets, D is a transaction database, the ratio claiming the number of the affairs comprising X in the D affairs number total with D is X support (support) in D.The support of X is denoted as sup (X), and correlation ruleSupport be then denoted as sup (X ∪ Y).

$\sup \left(X\right)=\frac{\left|\right\{t\∈D|X\⊆t\}|}{\left|D\right|}$

Support number: support number=support * | D |

Confidence level: to shape asCorrelation rule, wherein X and Y is Item Sets, affairs set D both comprised X also comprise in the affairs number of Y and D and only comprise X and do not comprise the ratio of the affairs number of Y, the support of Item Sets X ∪ Y and the ratio of the support of X are called the confidence level (confidence) of rule in other words conj.or perhaps, both sup (X ∪ Y)/sup (X), ruleConfidence level be denoted as

$\mathrm{conf}(X\⇒Y)=\frac{\sup (X\∪Y)}{\sup \left(X\right)}$

Weighted support measure: weighted association rulesWeighted support measure wsup be defined as:

$\mathrm{wsup}=\left({\mathrm{\Σ}}_{i_j\∈X\∪Y}{w}_j\right)\×\sup (X\∪Y)$

Weighting fuzzy frequent itemsets: given minimum weight support threshold wminsup, if k-item collection X meets following equation, then claiming X is k-weighting fuzzy frequent itemsets:

$\left(\underset{i_j\∈X}{\mathrm{\Σ}}{w}_j\right)\×\sup \left(X\right)\≥w\min \sup$

If k-item integrates X as k-weighting fuzzy frequent itemsets, then the support number (SC) of X meets:

$\mathrm{SC}\left(X\right)\≥\frac{w\min \sup \×\left|D\right|}{{\mathrm{\Σ}}_{i_j\∈X}{w}_j}$

The maximum possible weight of the k-item collection that comprises Y is:

$w(Y,k)=\underset{i_j\∈Y}{\mathrm{\Σ}}{w}_j+\underset{j=1}{\overset{k-q}{\mathrm{\Σ}}}{w}_{r_j}$

Wherein i is the set of all items, and Y is a q-Item Sets, wherein q < k, is located in the project of remaining I-Y, and the weight of (k-q) individual project that weight is maximum is respectively

Support expectation

According to theorem 1 and theorem 2, the minimum possibility of the k-weighted frequent items comprising Y supports that number is:

$B(Y,k)=\frac{w\min \sup \&times;\left|D\right|}{W(Y,k)}$

Claim B (Y k) supports expectation for the k-of Y.Consider B (Y, k) answers round numbers, in order to ensure that the k-Item Sets comprising Y is likely to be weighting frequently, take B (Y, k) be more thanSmallest positive integral.

Weighting confidence level: weighted association rulesConfidence level be defined as:

$\mathrm{wconf}(X\&DoubleRightArrow;Y)=\frac{\sup (x\&cup;y)}{\sup \left(x\right)}$

According to the support number of described each project and K, step S301: each project in described transaction database of obtaining support number in transaction database and K support expectation, supports that the project in described transaction database is carried out first time and filters by expectation.

According to above recording, support number=support * item number.

If the support number of project supports expectation less than K, then this project is deleted from data base.

First time filtration step is build the conventional filtration step that weighting is frequently set, and owing to the dynamics of its filtration is less, therefore further filters in conjunction with weight in step s 302.

Step S302: set minimum achievement support, calculates the product of the support of each project and its weight parameter in described transaction database, and the project in described transaction database is carried out second time filtration by the minimum achievement support that combination is preset.

Achievement support is the support product with weight parameter of project, if this product is less than minimum achievement support, then this project is deleted from data base.

Step S303: by described each affairs in the remaining described transaction database of twice filtration according to affairs in the support number descending of are remaining items.

That contribute in order that compress data base, it is therefore desirable to according to it, remaining project is supported that number carries out descending.

Step S304: by the transaction database of described descending according to FP-growth method construct weighting frequent pattern tree (fp tree).

FP-growth achievement algorithm, is more ripe achievement method, and the transaction database of descending is contribute by FP-growth achievement method conventionally.

For the method that the apparent explanation present invention obtains weighting fuzzy frequent itemsets according to weighting frequent pattern tree (fp tree), provide embodiments of the invention four, as shown in Figure 4.

Step S401: scan described weighting frequent pattern tree (fp tree), calculates the weighted support measure of each branch in tree, cuts the described weighted support measure branch less than default weighted support measure threshold value.

Step S402: each branch in described beta pruning rear weight frequent pattern tree (fp tree) is converted into a weighting fuzzy frequent itemsets, the node of the element correspondence branch in set.

Obtain all branches in weighting frequent pattern tree (fp tree) according to this step, so that the alarm association rule obtained is more accurate, final weighting fuzzy frequent itemsets can be filtered out by following two filtration step.

Step S403: exceed the weighting fuzzy frequent itemsets of the described rule degree of depth according to the length of the preset rules degree of depth described weighting fuzzy frequent itemsets of deletion.

The rule degree of depth has been arranged weighting frequent mode and has been concentrated the number comprising project, if weighting frequent mode concentrates the project number comprised more than the rule degree of depth, weighting fuzzy frequent itemsets length can be caused very big, the explanatory difference of weighted association rules of generation.

The rule degree of depth is rule of thumb set with practical situation.

Step S404: judge whether any two project that described weighting frequent mode is concentrated exists network element relation, if it does not exist, then filter described weighting fuzzy frequent itemsets.

It is required weighting fuzzy frequent itemsets through above-mentioned 4 remaining set of step.

For the method describing excavation alarm association disclosed by the invention rule in detail, provide embodiments of the invention five below in conjunction with example, as shown in Figure 5.

First an alarm transaction database is provided, it was previously mentioned, article one, alarm comprises multiple field (such as time window, NE type, network element rank, alarm level etc.), for avoiding describing difficulty, when describing Mining Weighted Association Rules, one alarm is taken out the I of Xiang Chengyi subscripting (such as I₁、I₂、I₄、I₅, I₁Represent an alarm).

Step S501: according to the field information set, existing network alarm is carried out denoising, and obtain, according to alarm feature attribute, the weight parameter that described denoising alerts, obtain the network element relation of alarm.

The alarm weight related in example is as shown in table 5:

Table 5 alerts weight signal

Alarm	weights
		I1	0.1
I2	0.3
		I3	0.4
I4	0.8
		I5	0.9

Step S502: described denoising alarm is carried out a point window.

Following table only lists alarm and excavates the part field needed, and including time window (this is to discriminate between the mark of different affairs), int_id-alarm_id (the unique mark of alarm) and weight, other fields are omitted.)

The alarm data of split window is as shown in table 6.

Table 6 original alarm transaction database divides window to illustrate

Step S503: structure 9 makes alarm transaction database.

Above-mentioned alarm transaction database is changed into the alarm transaction database of simplification, as shown in table 7 below:

The alarm transaction database that table 7 simplifies

Windows-id	Alarm
		2014-04-3023:56:00-2014-05-0100:00:59	I1I2I4I5
2014-04-3023:57:00-2014-05-0100:01:59	I1I4I5
		2014-04-3023:58:00-2014-05-0100:02:59	I2I4I5
2014-04-3023:59:00-2014-05-0100:03:59	I1I2I4I5
		2014-05-0100:00:00-2014-05-0100:04:59	I1I3I5
2014-05-0100:01:00-2014-05-0100:05:59	I2I4I5
		2014-05-0100:02:00-2014-05-0100:06:59	I2I3I4I5

Wherein I₁:-109_601-075-00-075002 (int_id-alarm_id is the unique mark of alarm, so representing an alarm with it here), I₂:-109_603-070-00-070011, I₃: 932827395_FF-1932858163, I₄:-109_602-076-00-076010, I₅:-155110151_FF-29254771.

Step S504: given input threshold value.

Given input threshold value: minimum achievement support=0.01, minimum weight support=1, the rule degree of depth=4, min confidence=0.7.

Step S505: scanning simplifies alarm transaction database D, the support number and the k-that calculate each project support expectation, delete and support that number supports desired alarm less than k-.

Scanning simplifies alarm transaction database D, | D |=7.

Calculate the support number of each project:

I₁: 4/7* | D |=4

I₂: 5/7* | D |=5

I₃: 2/7* | D |=2

I₄: 6/7* | D |=6

I₅: 7/7* | D |=7

The K calculating each project supports expectation:

To I1:

$B\left(\right\{I_1\},2)=\frac{1.0\&times;7}{0.1+0.9}=7$

$B\left(\right\{I_1\},3)=\frac{1.0\&times;7}{0.1+0.9+0.8}=4$

$B\left(\right\{I_1\},4)=\frac{1.0\&times;7}{0.1+0.9+0.8+0.4}=4$

So, B_min(I₁)=4=SC (I₁)=4

To I₂:

$B\left(\right\{I_2\},2)=\frac{1.0\&times;7}{0.3+0.9}=6$

$B\left(\right\{I_2\},3)=\frac{1.0\&times;7}{0.3+0.9+0.8}=4$

$B\left(\right\{I_2\},4)=\frac{1.0\&times;7}{0.3+0.9+0.8+0.4}=3$

So having, B_min(I₂)=3 < SC (I₂)=5

So I₂It it is the potential 1-pattern of weighting.

To I₃:

$B\left(\right\{I_3\},2)=\frac{1.0\&times;7}{0.4+0.9}=6$

$B\left(\right\{I_3\},3)=\frac{1.0\&times;7}{0.4+0.9+0.8}=4$

$B\left(\right\{I_3\},4)=\frac{1.0\&times;7}{0.4+0.9+0.8+0.3}=3$

So, B_min(I₃)=3 > SC (I₃)=2

Delete I₃。

To I₄, I₅Do same calculating, all need not delete.

Obtain I₁, I₂, I₄, I₅。

Step S506: the support calculating every alarm compares with the product of respective weights and with minimum achievement support, and deletion is lower than the alarm of minimum achievement support.

support(I₁)*weight(I₁)=4/7*0.1=0.0285

support(I₂)*weight(I₂)=0.2142

In like manner, I is calculated₄、I₅Corresponding value, is all higher than minimum achievement support, does not delete alarm.

This step filtercondition is to add on the basis of first step filtercondition later, owing to alerting the method for designing of weight, all of alarm weight only has 9 kinds, this has influence on k-and supports that desired filter effect is inconspicuous, in actual applications, k-supports that expectation is little to play the effect of filtration, but k-supports that desired filtration is necessary in theory again, so carrying out this step filtration after it filters, purpose is really to play the effect of filtering alarm, this step filter both considered alarm support it is also contemplated that alarm weight, therefore, this step filtration is effective and has practical significance.

Step S507: every the affairs alerted in transaction database after filtering are pressed support number descending.

As shown in table 8:

The alarm transaction database of table 8 descending

Windows-id	Alarm
		2014-04-3023:56:00-2014-05-0100:00:59	I5I4I2I1
2014-04-3023:57:00-2014-05-0100:01:59	I5I4I1
		2014-04-3023:58:00-2014-05-0100:02:59	I5I4I2
2014-04-3023:59:00-2014-05-0100:03:59	I5I4I2I1
		2014-05-0100:00:00-2014-05-0100:04:59	I5I1
2014-05-0100:01:00-2014-05-0100:05:59	I5I4I2
		2014-05-0100:02:00-2014-05-0100:06:59	I5I4I2

[0250]Step S508: by the transaction database of described descending according to FP-growth method construct weighting frequent pattern tree (fp tree).

The weighting frequent pattern tree (fp tree) generated is as shown in Figure 6.

Step S509: according to minimum weight support to weighting frequent pattern tree (fp tree) beta pruning.

Calculate the weighted support measure of each branch in weighting frequent pattern tree (fp tree), and with given threshold ratio relatively, cut less than the branch of given threshold value.

First calculate with I₁For the branch of bottom node, I₁Occur in 3 branches in WFP tree.These paths are < (I respectively₅I₄I₂: 2)>,<(I₅: 1)>,<(I₅I₄: 1) >.

Calculate the weighted support measure of these branches respectively and compare with minimum weight support

$\mathrm{wsup}(<(I_5{I}_4{I}_2:2)>)=(0.9+0.8+0.4+0.1)\&times;\frac{2}{7}<1,$

$\mathrm{wsup}(<(I_5:1)>)=\frac{1}{7}<1$

$\mathrm{wsup}(<(I_5{I}_4:1)>)=(0.9+0.8+0.1)\&times;\frac{1}{7}<1$

So I₁Branch for bottom node is cut up.

Step S510: each branch in beta pruning rear weight frequent pattern tree (fp tree) is converted into a weighting fuzzy frequent itemsets.

Obtain set { I₅I₄I₂And set { I₅I₄}。

Step S511: according to rule depth-type filtration weighting fuzzy frequent itemsets.

The rule degree of depth is 4, and two weighting fuzzy frequent itemsets are all without departing from the rule degree of depth.

Step S512: filter weighting fuzzy frequent itemsets according to network element relation.

The network element relation obtained in inquiry above-mentioned steps, it has been found that I₂, I₄, I₅Network element relation is all there is between two.

Step S513: obtain all nonvoid subsets of described each weighting fuzzy frequent itemsets

Set { I₅I₄I₂All nonvoid subsets be { I₂, { I₄, { I₅, { I₂, I₄, { I₂, I₅, { I₄, I₅}

Set { I₅I₄All nonvoid subsets be { I₄, { I₅}

Step S514: calculate the confidence level of described weighting fuzzy frequent itemsets nonvoid subset each with it.

Rule one:

Rule two:

Rule three:

Rule four:

Rule five:

Rule six:

Rule seven: $I_5\&DoubleRightArrow;I_4\mathrm{wconf}=\frac{6}{7}>70\%$

Rule eight: $I_4\&DoubleRightArrow;I_5\mathrm{wconf}=\frac{6}{6}=1>70\%$

Step S515: when described confidence level is more than default min confidence, the nonvoid subset that described weighting fuzzy frequent itemsets is corresponding the weighted association rules generated is set up.

Owing to min confidence is set as 0.7, therefore above-mentioned eight rules are all eligible, use the present invention to excavate 8 alarm association rules altogether.

The present invention also provides for a kind of alarm association rule digging device in order to realize a kind of alarm association rule digging method, embodiments of the invention six is given below in order to the concrete structure of described device to be described, as shown in Figure 7.

A kind of alarm association rule digging device includes:

Alarm pretreatment unit 1, for existing network alarm being carried out denoising according to the field information set, and obtains the weight parameter of described denoising alarm according to described alarm feature attribute.

The alarm pretreatment unit alarm preprocess method according to above method, carries out denoising to alarm, and detailed process is referring to described above.

Alarm point window unit 2, carries out a point window for the denoising alarm after described alarm pretreatment unit 1 is processed.

The alarm point window unit alarm method for filling according to above method, carries out a point window to alarm, and detailed process is referring to described above.

Weighting frequent pattern tree (fp tree) structural unit 3, for constructing transaction database, denoising after processing using described alarm pretreatment unit 1 alerts as project, described alarm divides each alarm window that window unit 2 determines as affairs, and then in conjunction with the weight parameter structure weighting frequent pattern tree (fp tree) of described denoising alarm.

Generally, comprising multiple affairs in transaction database D, after alarm performs point window operation, each window is considered affairs, is arranged in the alarm of each window, is considered project.Therefore transaction database comprises multiple affairs, and each transaction packet is containing multiple projects, and the alarm after denoising and point window operation is the project in transaction database.

By will alarm as project, alarm window, as the transaction database of transaction constructs, builds weighting pattern tree, these projects is all compressed on one tree, it is to avoid unnecessary expense, it is possible to increase efficiency.

Weighting fuzzy frequent itemsets acquiring unit 4, for obtaining weighting fuzzy frequent itemsets according to the weighting frequent pattern tree (fp tree) of described weighting frequent pattern tree (fp tree) 3 structural unit structure.

Each branch on weighting pattern tree can be a weighting pattern collection.Obtain all branches on weighting frequent pattern tree (fp tree), namely obtain all weighting fuzzy frequent itemsets on tree, but consider actual application scenarios, need when some according to practical situation, the weighting fuzzy frequent itemsets obtained to be filtered.Can the network element relation belonging to alarm be filtered, it is also possible to be filtered according to the rule degree of depth.Concrete methods of realizing refers to method above and describes, and does not repeat them here.

Relationship data mining unit 5, the relation for the weighting fuzzy frequent itemsets obtained according to described weighting fuzzy frequent itemsets acquiring unit 4 and its all subsets obtains the weighted association rules between the concentration alarm of described weighting frequent mode.

The method obtaining weighted association rules according to weighting fuzzy frequent itemsets is:

Obtain all nonvoid subsets of described each weighting fuzzy frequent itemsets.

Calculate the confidence level of described weighting fuzzy frequent itemsets nonvoid subset each with it.

When described confidence level is more than default min confidence, the nonvoid subset that described weighting fuzzy frequent itemsets is corresponding the weighted association rules generated is set up.

In order to be further ensured that the accuracy of the alarm association rule of excavation, alert pretreatment unit, be additionally operable to the field information according to described setting, obtain the network element relation between described denoising alarm.Preferably, described device can also include:

Weighting fuzzy frequent itemsets filter element 6, for the network element relation between the denoising alarm according to the acquisition of described alarm pretreatment unit 1, is filtered the weighting fuzzy frequent itemsets of described acquisition；With, the length of weighting fuzzy frequent itemsets according to preset rules depth-type filtration exceedes the weighting fuzzy frequent itemsets of the described rule degree of depth.

The relation that relationship data mining unit 5 obtains the weighting fuzzy frequent itemsets after filter element filters and its all subsets according to described weighting fuzzy frequent itemsets obtains the weighted association rules between the concentration alarm of described weighting frequent mode.

Some definition used time in the present invention about structure weighting frequent pattern tree (fp tree) and formula, all referring to the relevant portion in the description of method above, do not repeat them here.

For the structure of the more detailed description present invention a kind of alarm association rule digging device each several part, provide embodiments of the invention seven, as shown in Figure 8.

Alarm pretreatment unit 1 farther includes:

Alarm denoising module 11, alerts for the field information incomplete alarm of cancel (CANCL) segment data according to setting, removal engineering, remove the alarm of non-communicating equipment class, removal associated alarm, removal slightly alarm, removes and repeat to alert.

The field information set is referring to shown in Table 1 above.The relevant portion that the method for denoising describes referring also to above method.

Alarm weight computation module 12, belonging to the alarm level alerted according to described denoising and alarm, the NE type of network element calculates the weight parameter of described denoising alarm.

Network element Relation acquisition module 13, for according to network element resources information, obtaining the network element relation between described denoising alarm.

Alarm point window unit 2, carries out a point window for the denoising alarm after described alarm pretreatment unit 1 is processed.

Weighting frequent pattern tree (fp tree) structural unit 3 farther includes:

Project filtering module 31, supports expectation for obtaining the support number in transaction database of each project in described transaction database and K, supports that the project in described transaction database is carried out first time and filters by expectation according to the support number of described each project and K；Set minimum achievement support, calculate the product of the support of each project and its weight parameter in described transaction database, and the project in described transaction database is carried out second time filtration by the minimum achievement support that combination is preset；

Transaction orderings module 32, for will each affairs that filter through described project filtering module 31 in remaining described transaction database according to affairs in the support number descending of are remaining items；

Weighting frequent pattern tree (fp tree) constructing module 33, the affairs being used for sort through described transaction orderings module 32 are according to FP-growth method construct weighting frequent pattern tree (fp tree).

Weighting fuzzy frequent itemsets acquiring unit 4 farther includes:

Beta pruning module 41, is used for scanning described weighting frequent pattern tree (fp tree) constructing module weighting frequent pattern tree (fp tree), calculates the weighted support measure of each branch in tree, cuts the described weighted support measure branch less than default weighted support measure threshold value；

Weighting fuzzy frequent itemsets acquisition module 42, for each branch in the weighting frequent pattern tree (fp tree) after described beta pruning module beta pruning is converted into a weighting fuzzy frequent itemsets, the node of the element correspondence branch in set.

Relationship data mining unit 5 farther includes:

Subset acquisition module 51, for obtaining all nonvoid subsets of each weighting fuzzy frequent itemsets that described weighting fuzzy frequent itemsets acquisition module 42 obtains.

Confidence calculations module 52, for calculating the confidence level of described weighting fuzzy frequent itemsets nonvoid subset each with it.

Rule sets up determination module 53, for when the confidence level that described confidence calculations module 52 calculates is more than default min confidence, it is determined that the weighted association rules generated by the nonvoid subset that described weighting fuzzy frequent itemsets is corresponding is set up.

Weighting fuzzy frequent itemsets filter element 6, for the network element relation between the denoising alarm according to the acquisition of described alarm pretreatment unit 1, is filtered the weighting fuzzy frequent itemsets of described acquisition；With, the length of weighting fuzzy frequent itemsets according to preset rules depth-type filtration exceedes the weighting fuzzy frequent itemsets of the described rule degree of depth.

Alarm is carried out and after denoising by alarm denoising module 11, and alarm weight computation module 12 obtains the weight of alarm, and network element Relation acquisition module 13 obtains the network element relation between alarm；Alarm is carried out a point window shape and becomes project by alarm point window unit 2, weighting frequent pattern tree (fp tree) structural unit 3 combines the weight of alarm according to the alarm after denoising, is completed the structure of the filtration to project, the sequence of affairs and weighting frequent pattern tree (fp tree) by project filtering module 31, transaction orderings module 32, weighting frequent pattern tree (fp tree) constructing module 33；Weighting fuzzy frequent itemsets acquiring unit 4, by beta pruning module 41, weighting fuzzy frequent itemsets acquisition module 42, obtains final weighting fuzzy frequent itemsets after weighting fuzzy frequent itemsets is filtered；Weighting fuzzy frequent itemsets is filtered by weighting fuzzy frequent itemsets filter element 6 further；Relationship data mining unit 5 obtains, by oneself acquisition module 51, the nonvoid subset that weighting frequent mode is concentrated, confidence calculations module 52 calculates the confidence level of these subsets, and rule sets up determination module 53 by confidence level is compared the weighted association rules judging final establishment with the min confidence preset.

Weighting alarm can be realized by this device and carry out computing, and the filtration step of different phase can be set according to practical situation, realize automatically analyzing and accurately excavating alarm of telecommunication network correlation rule based on existing network data.

This device is in order to realize a kind of alarm association rule digging method, and above, method all has corresponding description in describing to the operation principle of each module, does not repeat them here.

Although the embodiment that disclosed herein is as above, but described content be not used to directly limit protection scope of the present invention.Any the technical staff in the technical field of the invention, under the premise without departing from the spirit and scope that disclosed herein, it is possible to do a little change in the formal and details implemented.Protection scope of the present invention, still must be as the criterion with the scope that appending claims defines.

Claims (15)

1. an alarm association rule digging method, it is characterised in that described method includes:

According to the field information set, existing network alarm is carried out denoising, and obtain the weight parameter of described denoising alarm according to alarm feature attribute；

Described denoising alarm is carried out a point window；

Structure transaction database, alerts as project using described denoising, and described alarm window is as affairs, and then the weight parameter in conjunction with described denoising alarm constructs weighting frequent pattern tree (fp tree)；

Weighting fuzzy frequent itemsets is obtained according to described weighting frequent pattern tree (fp tree)；

Relation according to described weighting fuzzy frequent itemsets and its all subsets obtains described weighting frequent mode and concentrates the weighted association rules between alarm.

2. method according to claim 1, it is characterised in that described method also includes:

According to network element resources information, obtain the network element relation between described denoising alarm；

Network element relation between alerting according to described denoising, is filtered the weighting fuzzy frequent itemsets of described acquisition；

Relation according to the weighting fuzzy frequent itemsets after filtering and its all subsets obtains described weighting frequent mode and concentrates the weighted association rules between alarm.

3. method according to claim 2, it is characterised in that the network element relation between alerting according to described denoising, the method that the weighting fuzzy frequent itemsets of described acquisition is filtered particularly as follows:

Judge whether any two project that described weighting frequent mode is concentrated exists network element relation, if it does not exist, then filter described weighting fuzzy frequent itemsets.

4. method according to claim 3, it is characterised in that described according to alarm feature attribute obtain denoising alarm weight parameter method particularly as follows:

Belonging to the alarm level alerted according to described denoising and alarm, the NE type of network element calculates the weight parameter of described denoising alarm.

5. method according to claim 4, it is characterized in that, described structure transaction database, alert as project using described denoising, described alarm window as affairs, and then in conjunction with described denoising alarm weight parameter structure weighting frequent pattern tree (fp tree) method particularly as follows:

The each project in described transaction database of obtaining support number in transaction database and K support expectation, support that the project in described transaction database is carried out first time and filters by expectation according to the support number of described each project and K；

Set minimum achievement support, calculate the product of the support of each project and its weight parameter in described transaction database, and the project in described transaction database is carried out second time filtration by the minimum achievement support that combination is preset；

By described each affairs in the remaining described transaction database of twice filtration according to affairs in the support number descending of are remaining items；

By the transaction database of described descending according to FP-growth method construct weighting frequent pattern tree (fp tree).

6. method according to claim 5, it is characterised in that described according to described weighting frequent pattern tree (fp tree) obtain weighting fuzzy frequent itemsets method particularly as follows:

Scan described weighting frequent pattern tree (fp tree), calculate the weighted support measure of each branch in tree, cut the described weighted support measure branch less than default weighted support measure threshold value；

Each branch in described beta pruning rear weight frequent pattern tree (fp tree) is converted into a weighting fuzzy frequent itemsets, the node of the element correspondence branch in set.

7. method according to claim 6, it is characterised in that described method also includes:

Length according to the preset rules degree of depth described weighting fuzzy frequent itemsets of deletion exceedes the weighting fuzzy frequent itemsets of the described rule degree of depth.

8. method according to claim 7, it is characterised in that the described relation according to described weighting fuzzy frequent itemsets and its all subsets obtain described weighting frequent mode concentrate weighted association rules between alarm method particularly as follows:

Obtain all nonvoid subsets of described each weighting fuzzy frequent itemsets；

Calculate the confidence level of described weighting fuzzy frequent itemsets nonvoid subset each with it；

When described confidence level is more than default min confidence, the nonvoid subset that described weighting fuzzy frequent itemsets is corresponding the weighted association rules generated is set up.

9. according to described method arbitrary in claim 1 to 8, it is characterised in that the described method that according to the field information set, existing network alarm is carried out denoising particularly as follows:

According to the field information incomplete alarm of cancel (CANCL) segment data set, removal engineering alerts, removal non-communicating equipment class alerts, remove associated alarm, removal slightly alerts, removal repeats alarm.

10. an alarm association rule digging device, it is characterised in that described device includes:

Alarm pretreatment unit, for existing network alarm being carried out denoising according to the field information set, and obtains the weight parameter of described denoising alarm according to described alarm feature attribute；

Alarm point window unit, carries out a point window for the denoising alarm after described alarm pretreatment unit is processed；

Weighting frequent pattern tree (fp tree) structural unit, for constructing transaction database, denoising after processing using described alarm pretreatment unit alerts as project, and described alarm divides each alarm window that window unit determines as affairs, and then in conjunction with the weight parameter structure weighting frequent pattern tree (fp tree) of described denoising alarm；

Weighting fuzzy frequent itemsets acquiring unit, for obtaining weighting fuzzy frequent itemsets according to the weighting frequent pattern tree (fp tree) of described weighting frequent pattern tree (fp tree) structural unit structure；

Relationship data mining unit, the relation for the weighting fuzzy frequent itemsets obtained according to described weighting fuzzy frequent itemsets acquiring unit and its all subsets obtains the weighted association rules between the concentration alarm of described weighting frequent mode.

11. device according to claim 10, it is characterised in that described device also includes weighting fuzzy frequent itemsets filter element:

Described alarm pretreatment unit, is additionally operable to the field information according to described setting, obtains the network element relation between described denoising alarm；

Described weighting fuzzy frequent itemsets filter element, for the network element relation between the denoising alarm according to the acquisition of described alarm pretreatment unit, is filtered the weighting fuzzy frequent itemsets of described acquisition；With, the length of weighting fuzzy frequent itemsets according to preset rules depth-type filtration exceedes the weighting fuzzy frequent itemsets of the described rule degree of depth；

The relation that relationship data mining unit obtains the weighting fuzzy frequent itemsets after filter element filters and its all subsets according to described weighting fuzzy frequent itemsets obtains the weighted association rules between the concentration alarm of described weighting frequent mode.

12. device according to claim 11, it is characterised in that described alarm pretreatment unit farther includes:

Alarm denoising module, alerts for the field information incomplete alarm of cancel (CANCL) segment data according to setting, removal engineering, remove the alarm of non-communicating equipment class, removal associated alarm, removal slightly alarm, removes and repeat to alert；

Alarm weight computation module, belonging to the alarm level alerted according to described denoising and alarm, the NE type of network element calculates the weight parameter of described denoising alarm；

Network element Relation acquisition module, for according to network element resources information, obtaining the network element relation between described denoising alarm.

13. device according to claim 12, it is characterised in that described weighting frequent pattern tree (fp tree) structural unit farther includes:

Project filtering module, supports expectation for obtaining the support number in transaction database of each project in described transaction database and K, supports that the project in described transaction database is carried out first time and filters by expectation according to the support number of described each project and K；Set minimum achievement support, calculate the product of the support of each project and its weight parameter in described transaction database, and the project in described transaction database is carried out second time filtration by the minimum achievement support that combination is preset；

Transaction orderings module, being used for will the support number descending of are remaining items in each affairs in the described project filtering module remaining described transaction database of filtration are according to affairs；

Weighting frequent pattern tree (fp tree) constructing module, the affairs being used for sort through described transaction orderings module are according to FP-growth method construct weighting frequent pattern tree (fp tree).

14. device according to claim 13, it is characterised in that described weighting fuzzy frequent itemsets acquiring unit farther includes:

Beta pruning module, is used for scanning described weighting frequent pattern tree (fp tree) constructing module weighting frequent pattern tree (fp tree), calculates the weighted support measure of each branch in tree, cuts the described weighted support measure branch less than default weighted support measure threshold value；

Weighting fuzzy frequent itemsets acquisition module, for each branch in the weighting frequent pattern tree (fp tree) after described beta pruning module beta pruning is converted into a weighting fuzzy frequent itemsets, the node of the element correspondence branch in set.

15. device according to claim 14, it is characterised in that described relationship data mining unit farther includes:

Subset acquisition module, for obtaining all nonvoid subsets of each weighting fuzzy frequent itemsets that described weighting fuzzy frequent itemsets acquisition module obtains；

Confidence calculations module, for calculating the confidence level of described weighting fuzzy frequent itemsets nonvoid subset each with it；

Rule sets up determination module, for when the confidence level that described confidence calculations module calculates is more than default min confidence, it is determined that the weighted association rules generated by the nonvoid subset that described weighting fuzzy frequent itemsets is corresponding is set up.