CN105786919B - A kind of alarm association rule digging method and device - Google Patents
A kind of alarm association rule digging method and device Download PDFInfo
- Publication number
- CN105786919B CN105786919B CN201410828721.1A CN201410828721A CN105786919B CN 105786919 B CN105786919 B CN 105786919B CN 201410828721 A CN201410828721 A CN 201410828721A CN 105786919 B CN105786919 B CN 105786919B
- Authority
- CN
- China
- Prior art keywords
- alarm
- weighting
- tree
- frequent
- denoising
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The present invention discloses a kind of alarm association rule digging method, is denoised according to the field information of setting to the alarm of existing net, and the weight parameter of the denoising alarm is obtained according to alarm feature attribute；A point window is carried out to denoising alarm；Transaction database is constructed, is alerted using the denoising as project, the alarm window constructs weighting frequent pattern tree (fp tree) as affairs, and then in conjunction with the weight parameter of the denoising alarm；Weighting fuzzy frequent itemsets are obtained according to the weighting frequent pattern tree (fp tree)；The weighted association rules between the weighting frequent mode concentration alarm are obtained according to the relationship of the weighting fuzzy frequent itemsets and its all subset.It is excavated with the efficiently and accurately of the achievable alarm association rule of the present invention, invention additionally discloses a kind of alarm association rule digging devices.
Description
Technical field
The present invention relates to fields of communication technology, and in particular to alarm association rule digging technology.
Background technique
Telecom operators have passed through many years network management system construction, constantly improve, had in terms of alarm management
The analysis process flow of more mature monitoring management mode and alarm data.The alarm monitoring and management mould of telecom network management system
Block plays an important role in daily maintenance work, becomes the indispensable work of operator's alarm monitoring, management and business diagnosis
Tool.
Recent years data mining technology all achieves the application effect to attract people's attention in every profession and trade, is also such as in the communications industry
This, has especially had more application case in business support field.In alarm application aspect, operator is had accumulated largely
Alarm history data be had actively wherein may include a large amount of business rule or logic to relevant service operation is alerted
Help.The alarm history data for handling bulky due to not preferable technological means support in the past, to alarm
The excavation of professional knowledge also has tried to less in data.
Correlation of the alarm association rule generally by business expert, O&M expert based on accumulation in telecommunication network at present
Experience, refinement of summarizing, is initially formed alternative rule, and after expert team discusses and determines, part rule is used as preference rule,
Implement existing net verifying, the rule being verified eventually enters into alarm association rule base, formally promotes the use of in existing net.It is this artificial
The method that mode obtains existing net efficient association rule, itself relies on specific specialists experience there are inefficient, so that effectively accusing
The procurement cost of alert correlation rule is high, it is difficult to adapt to the new business scene continuously emerged.Since new business network is based on a variety of
New technology, and network structure is more complicated, exists simultaneously network structure and changes more and more frequent trend, originally passes through by expert
The mode tested is more and more hard to work, and the acquisition of new effective rule becomes more and more difficult.Different type network element, different stage
Alarm or other factors may cause alarm quantity distribution and have differences, this species diversity is to so that the knot that alarm regulation excavates
Expection cannot be fully achieved in fruit.Therefore, the method that existing network data carries out effective rule digging and acquisition is relied on by building system
Of great practical value and telecom operators' O&M, monitoring user need in a hurry.
A kind of realized based on existing network data is automatically analyzed and accurately excavates alarm of telecommunication network correlation rule in summary
Technology urgently occurs.
Summary of the invention
The present invention provides a kind of alarm association rule digging method, which comprises
The alarm of existing net is denoised according to the field information of setting, and the denoising is obtained according to alarm feature attribute and is accused
Alert weight parameter；
A point window is carried out to denoising alarm；
Transaction database is constructed, is alerted using the denoising as project, the alarm window combines institute as affairs
State the weight parameter construction weighting frequent pattern tree (fp tree) of denoising alarm；
Weighting fuzzy frequent itemsets are obtained according to the weighting frequent pattern tree (fp tree)；
The weighting frequent mode, which is obtained, according to the relationship of the weighting fuzzy frequent itemsets and its all subset concentrates alarm
Between weighted association rules.
Preferably, the method also includes:
According to network element resources information, the network element relationship between the denoising alarm is obtained；
According to the network element relationship between the denoising alarm, the weighting fuzzy frequent itemsets of the acquisition are filtered；
The weighting frequent mode is obtained according to the relationship of filtered weighting fuzzy frequent itemsets and its all subset to concentrate
Weighted association rules between alarm.
It is detailed, according to the network element relationship between the denoising alarm, the weighting fuzzy frequent itemsets of the acquisition were carried out
The method of filter specifically:
Any two project for judging that the weighting frequent mode is concentrated whether there is network element relationship, if it does not exist, then
Filter the weighting fuzzy frequent itemsets.
It is detailed, the method for the weight parameter that denoising alarm is obtained according to alarm feature attribute specifically:
The denoising alarm is calculated according to the alarm level of the denoising alarm and the NE type for alerting affiliated network element
Weight parameter.
Further, the construction transaction database is alerted using the denoising as project, and the alarm window is as thing
Business, and then the method for the weight parameter construction weighting frequent pattern tree (fp tree) in conjunction with the denoising alarm specifically:
It obtains support number and K of each project in transaction database in the transaction database and supports expectation, according to institute
The support number and K for stating each project support expectation to carry out first time filtering to the project in the transaction database；
Minimum achievement support is set, the support of each project and its weight parameter in the transaction database are calculated
Product, and second is carried out to the project in the transaction database in conjunction with preset minimum achievement support and is filtered；
By described by filtering each affairs in the remaining transaction database twice according to remaining item in affairs
Support number descending arrangement；
The transaction database that the descending is arranged weights frequent pattern tree (fp tree) according to FP-growth method construct.
Further, the method that weighting fuzzy frequent itemsets are obtained according to the weighting frequent pattern tree (fp tree) specifically:
The weighting frequent pattern tree (fp tree) is scanned, the weighted support measure of each branch in tree is calculated, cuts the weighting branch
Degree of holding is less than the branch of default weighted support measure threshold value；
A weighting fuzzy frequent itemsets are converted by each of beta pruning rear weight frequent pattern tree (fp tree) branch, are gathered
In element correspond to the node of branch.
Preferably, the method also includes:
It is more than the weighting frequency of the regular depth according to the length that preset rules depth deletes the weighting fuzzy frequent itemsets
Numerous set of patterns.
It is detailed, it is described that the frequent mould of weighting is obtained according to the relationship of the weighting fuzzy frequent itemsets and its all subset
The method that formula concentrates the weighted association rules between alarm specifically:
Obtain all nonvoid subsets of each weighting fuzzy frequent itemsets；
Calculate the confidence level of the weighting fuzzy frequent itemsets and its each nonvoid subset；
When the confidence level is greater than preset min confidence, by the corresponding non-empty of the weighting fuzzy frequent itemsets
The weighted association rules that subset generates are set up.
Detailed, the field information according to setting alerts the method denoised to existing net specifically:
The incomplete alarm of field data is deleted according to the field information of setting, removal engineering alerts, removal non-communicating is set
Standby class alarm, removal associated alarm, the slight alarm of removal, removal repeat to alert.
Invention additionally discloses a kind of alarm association rule digging device, described device includes:
Pretreatment unit is alerted, for denoising according to the field information of setting to the alarm of existing net, and according to the announcement
Alert characteristic attribute obtains the weight parameter of the denoising alarm；
Alarm divide window unit, for the alarm pretreatment unit treated denoising alert carry out a point window；
Frequent pattern tree (fp tree) structural unit is weighted, for constructing transaction database, after handling with the alarm pretreatment unit
Denoising alarm be used as project, it is described alarm divide window unit determine each alarm window gone as affairs, and then in conjunction with described
Make an uproar alarm weight parameter construction weighting frequent pattern tree (fp tree)；
Fuzzy frequent itemsets acquiring unit is weighted, for the weighting frequency according to the weighting frequent pattern tree (fp tree) structural unit construction
Numerous scheme-tree obtains weighting fuzzy frequent itemsets；
Relationship data mining unit, the weighting frequent mode for being obtained according to the weighting fuzzy frequent itemsets acquiring unit
The relationship of collection and its all subset obtains the weighted association rules between the weighting frequent mode concentration alarm.
Preferably, described device further includes weighting fuzzy frequent itemsets filter element:
The alarm pretreatment unit is also used to the field information according to the setting, between the acquisition denoising alarm
Network element relationship；
The weighting fuzzy frequent itemsets filter element, between the denoising alarm for being obtained according to the alarm pretreatment unit
Network element relationship, the weighting fuzzy frequent itemsets of the acquisition are filtered；With the weighting according to preset rules depth-type filtration
The length of fuzzy frequent itemsets is more than the weighting fuzzy frequent itemsets of the regular depth；
Relationship data mining unit obtains the filtered frequent mould of weighting of filter element according to the weighting fuzzy frequent itemsets
The relationship of formula collection and its all subset obtains the weighted association rules between the weighting frequent mode concentration alarm.
Detailed, the alarm pretreatment unit further comprises:
Alarm denoising module, for deleting the incomplete alarm of field data, removal engineering according to the field information of setting
Alarm, the alarm of removal non-communicating equipment class, removal associated alarm, the slight alarm of removal, removal repeat to alert；
Weight calculation module is alerted, for the network element class according to network element belonging to the alarm level of the denoising alarm and alarm
Type calculates the weight parameter of the denoising alarm；
Network element Relation acquisition module, for obtaining the network element relationship between the denoising alarm according to network element resources information.
Detailed, the weighting frequent pattern tree (fp tree) structural unit further comprises:
Project filtering module, for obtain in the transaction database support number of each project in transaction database and
K supports expectation, supports expectation to carry out first to the project in the transaction database according to the support number of each project and K
Secondary filtering；Minimum achievement support is set, the support of each project and its weight parameter in the transaction database are calculated
Product, and second is carried out to the project in the transaction database in conjunction with preset minimum achievement support and is filtered；
Transaction orderings module, for will pass through the project filtering module filter it is every in the remaining transaction database
A affairs are arranged according to the support number descending of remaining item in affairs；
Frequent pattern tree (fp tree) constructing module is weighted, for the affairs of the transaction orderings module sequence will to be passed through according to FP-
Growth method construct weights frequent pattern tree (fp tree).
Detailed, the weighting fuzzy frequent itemsets acquiring unit further comprises:
Pruning module calculates every in tree for scanning the weighting frequent pattern tree (fp tree) constructing module weighting frequent pattern tree (fp tree)
The weighted support measure of one branch cuts the branch that the weighted support measure is less than default weighted support measure threshold value；
It weights fuzzy frequent itemsets and obtains module, for will be by the weighting frequent pattern tree (fp tree) after the pruning module beta pruning
Each branch be converted into a weighting fuzzy frequent itemsets, the element in set corresponds to the node of branch.
Detailed, the relationship data mining unit further comprises:
Subset obtains module, obtains each weighting frequent mode that module obtains for obtaining the weighting fuzzy frequent itemsets
All nonvoid subsets of collection；
Confidence calculations module, for calculating the confidence level of the weighting fuzzy frequent itemsets and its each nonvoid subset；
Rule sets up determination module, and the confidence level for calculating when the confidence calculations module is greater than preset minimum and sets
When reliability, determine that the weighted association rules generated by the corresponding nonvoid subset of the weighting fuzzy frequent itemsets are set up.
It may cause the result of alarm regulation excavation based on different type network element, different stage alarm or other factors
Inaccuracy, the present invention denoises first to the alarm of existing net and weight calculation, denoising are to eliminate to be not suitable for doing in existing network data
The alarm of rule digging, such as engineering alarm, slight alarm, weight calculation are considered similar to high level alarm than rudimentary
The bigger factor of other alarm influence degree, can obtain more accurate alarm association rule；Further, added by building
Power frequent pattern tree (fp tree) excavates alarm regulation, and when excavation considers the resources relationship of weight and network element, avoids " rubbish rule
Output then " improves the accurate fixed of rule digging；On the other hand establishing the benefit of tree construction is the item in transaction database
It being all compressed on one tree, when looking for frequent item set, it is not necessary to multiple scanning raw data base avoids a large amount of I/O expense, because
This present invention realizes a kind of technology automatically analyzed based on existing network data and accurately excavate alarm of telecommunication network correlation rule.
Detailed description of the invention
Fig. 1 is a kind of flow diagram for alarm association rule digging method that the embodiment of the present invention one provides；
Fig. 2 is method preferred flow schematic diagram provided by Embodiment 2 of the present invention；
Fig. 3 is that the invention building of doing that the embodiment of the present invention three provides weights frequent pattern tree (fp tree) method flow schematic diagram；
The method flow schematic diagram of weighting fuzzy frequent itemsets is obtained in the present invention that Fig. 4 provides for the embodiment of the present invention four；
Fig. 5 is the method flow schematic diagram that the embodiment of the present invention five provides；
Construction weighting frequent pattern tree (fp tree) schematic diagram in the method that Fig. 6 provides for the embodiment of the present invention five；
Fig. 7 is a kind of alarm association rule digging apparatus structure schematic diagram that the embodiment of the present invention six provides；
Fig. 8 is the apparatus structure schematic diagram that the embodiment of the present invention seven provides.
Specific embodiment
Carry out the embodiment that the present invention will be described in detail below in conjunction with schema and embodiment, how the present invention is applied whereby
Technological means solves technical problem and reaches the realization process of technical effect to fully understand and implement.
Correlation rule is the rule for indicating certain incidence relation between a group objects in database.Pass between data item
Join, i.e. the appearance of certain data item can export appearance of other data item in same affairs in an affairs.
Correlation rule be shaped likeImplication, whereinAnd
Below as shown in Figure 1, providing the embodiment of the present invention one illustrates a kind of alarm association rule digging method, the side
Method includes:
Step S101: the alarm of existing net is denoised according to the field information of setting, and is obtained according to alarm feature attribute
The weight parameter of the denoising alarm.
The weight parameter for calculating alarm is the importance for determining alarm in conjunction with some attributes of alarm, such as different alert levels
Not, business is different with the influence degree of network element, needs to be treated differently；Different network elements, since the range of management business is different, weight
The property wanted is also different；Therefore alarm weight is calculated in combination with alarm level and NE type.Other can also be selected according to actual needs
Alarm attributes calculates the weight of alarm, can enable flexible choice.
According to needs of mining analysis and pretreated as a result, its alarm level of the alarm of analysis to be excavated is divided into three, 1
Grade (serious, Critical)；2 grades (important, Major)；3 grades (secondary, Minor)
NE type is also classified into three classes, and (every class gives part NE type sample, other are not in network element described herein
Type or newly-increased NE type, can same method processing), it is a kind of: MSC/GMSC (101)/MSCserver (130)/MGW
(131), (102) HLR, HSTP/LSTP (108)；Two classes: BSC (200)/RNC (9200), bts (201)/NodeB (9201),
STP(108)；Three classes: Cell (300)/utracell (9300).
Step S102: a point window is carried out to denoising alarm.
The alarm of distinct device producer can be focused in network management system and is managed collectively in telecommunication network, to network management system
For, alarm data is exactly continuous, the stream data of time upper " with neither head nor tail ", it is necessary to after specially treated, could be excavated
Incidence relation between alarm.
" transactionization " processing is carried out to alarm data using sliding window mechanism herein, that is, artificial from time dimension
On " branch mailbox " processing is carried out to alarm, but be not simply alarm is divided into different windows according to different time points, and
It is the method using sliding window, what the window edge alarm association relationship existing for non-sliding window method that solves may lose asks
Topic.
Step S103: construction transaction database is alerted using the denoising as project, the alarm window as affairs,
And then in conjunction with the weight parameter construction weighting frequent pattern tree (fp tree) of the denoising alarm.
Step S104: weighting fuzzy frequent itemsets are obtained according to the weighting frequent pattern tree (fp tree).
Step S105: the weighting frequent mode is obtained according to the relationship of the weighting fuzzy frequent itemsets and its all subset
Concentrate the weighted association rules between alarm.
In order to preferably illustrate the present invention, the embodiment of the present invention two is given below, as shown in Figure 2:
Step S201: the alarm of existing net is denoised according to the field information of setting, and is obtained according to alarm feature attribute
The weight parameter of the denoising alarm.
Alarm denoising, refer to and alarm data cleaned and is filtered, alert initial data in some alarm for
It is noise data or unwanted for alerting for mining analysis, needs to reject these data.
The incomplete alarm of field data is deleted according to the field information of setting, removal engineering alerts, removal non-communicating is set
Standby class alarm, removal associated alarm, the slight alarm of removal, removal repeat to alert.Specific process content is as follows:
A) need to filter out necessary field contents according to excavation to full dose alarm data.It is as shown in table 1:
Table 1 alerts necessary field signal
| Field name | Field abbreviation | It can be sky |
| NE ID | int_id | It is no |
| NE type | object_class | It is no |
| Alert title ID | alarm_title | It is no |
| Alert title | alarm_title_text | It is no |
| Raising Time | event_time | It is no |
| Original alarm rank | org_severity | It is no |
| Producer's alarm level | vendor_severity | It is no |
| Alert classification | org_type | It is no |
| Alarm cleared time | cancel_time | It is |
| Alert active state | active_status | It is no |
| OMC_id | omc_id | It is no |
| Alarm number | omc_alarm_id | It is no |
| Redefine rank | redefine_severity | It is no |
| Redefine classification | redefine_type | It is no |
| Group's alarm level | group_severity | It is no |
| Districts and cities' alarm level | region_severity | It is no |
| Alert subtype | sub_alarm_type | It is no |
| Resource status | resource_status | It is no |
| Home network element ID | parent_int_id | It is no |
| Home network element type | parent_object_class | It is no |
| Producer ID | vendor_id | It is no |
| Vendor name | vendor_name | It is no |
| Element name | ne_lable | It is no |
| City name | city_name | It is no |
| City ID | city_id | It is no |
| Regional ID | region_id | It is no |
| Area name | region_name | It is no |
| Network type | network_type | It is no |
| Alert engineering state | alarm_resource_status | It is no |
| Many types | professional_type | It is no |
| Work order state | sheet_status | It is no |
| Work order number | sheet_no | It is no |
| Logic Alarm Classification | logic_alarm_type | It is |
| Logic alerts subclass | logic_sub_alarm_type | It is |
| Standard alarm ID | standard_alarm_id | It is no |
| Alert the influence to equipment | effect_ne | It is |
| Alert the influence to business | effect_service | It is |
| Device object type | eqp_object_class | It is no |
| Standardization mark | standart_flag | It is no |
| Element name | Ne_label | It is no |
| Network element Chinese | Zh_label | It is |
B) incomplete alarm data is removed, for the alarm mining analysis list of fields of front, checks that alarm data is
It is no complete.
According to that can be empty mark in table, determine whether alarm data is complete, if "No" can be identified as empty,
Indicate that the field cannot be sky, and the field alerted is sky, then shows that the alarm is imperfect alarm, needs to remove.
C) removal engineering alarm.
Engineering alarm belongs to noise data for excavation, needs to filter, according to " the alarm engineering state " in above-mentioned table 1
Field judges whether the alarm is engineering alarm.
D) removal non-communicating equipment class alarm.
Such as: the alarm etc. that performance alarm, the alarm of network management acquisition layer and other network management modules itself generate, these alarms are simultaneously
Non-real equipment alarm, it is also desirable to filter out, be judged according to " alarm type " field in above-mentioned table 1.
E) " associated alarm " (alarm that non-network element device generates) generated in removal system
F) remove " slight " alarm
In general slight alarm does not need to be monitored the processing of O&M department, it is not necessary to carry out the digging of alarm association rule
Pick analysis, directly filters out such alarm, is judged according to alarm level.
G) it rejects and repeats alarm data (for mining analysis, belonging to duplicate alarm data)
Duplicate alarm is no advantage to the excavation of alarm association rule, but will increase the complexity of processing, also influences system
The efficiency of system processing, duplicate alarm only retain one.
The weight calculation of alarm can be there are many kinds of mode, and the present invention provides a kind of method for calculating weight again, is based on
Alarm level and NE type carry out weight calculation.
Table 1, table 2, table 3 list weight ratio respectively:
The weight ratio of table 1 alarm level and NE type
| Project project | Alarm level | NE type |
| Alarm level | 1 | 3 |
| NE type | 1:3 | 1 |
The value in matrix is compared, indicates the importance ratio of column name and row title, such as: 1:3 (0.333333) table
Show that NE type is lower than alarm level importance, value relationship is 1/3.
Weight ratio between 2 alarm level of table
| Project project | Level-one | Second level | Three-level |
| Level-one | 1 | 3 | 9 |
| Second level | 1:3 | 1 | 3 |
| Three-level | 1:9 | 1:3 | 1 |
Weight ratio between 3 NE type of table
| Project project | It is a kind of | Two classes | Three classes |
| It is a kind of | 1 | 3 | 9 |
| Two classes | 1:3 | 1 | 3 |
| Three classes | 1:9 | 1:3 | 1 |
It can get variety classes alarm weight (one shares 9 kinds) by calculating:
It is illustrated and is calculated for alerting class 1:
1, each alarm of the bottom, has two lines to obtain weight: alarm level and NE type, according to comparison square
Battle array design, alarm level weight 0.75, NE type weight are 0.25 (total weight value adduction is 1)
2, alarm level is subdivided into three-level, according to comparison matrix design, basic alarm weight in three is calculated and is respectively as follows:
Level 1Alarming (0.5192), second level alert (0.1731), and three-level alerts (0.0577).NE type is similar.
Citing: Level 1Alarming weight=0.75* (9/ (9+3+1)) ≈ 0.5192.
3, finally the weight computations of alarm class 1 are as follows:
Weight value=(0.75* (9/ (9+3+1))+0.25* (9/ (9+3+1)))/3
≈0.2308
Step S202: a point window is carried out to denoising alarm.
Using sliding window mechanism, two parameters: length of window and sliding step are related generally to.
Length of window: belonging to empirical data, determine principle be usually in window alarm quantity it is not many, and through excavation calculate
The processing of method obtains regular moderate number, can field test determination.
Sliding step: 1/10 to ten/5ths or so of desirable length of window.
Step S203: according to network element resources information, the network element relationship between the denoising alarm is obtained.
" the network element relationship " in resource data is extracted according to net element business relationship, the foundation for extracting network element relationship is as follows:
) there are transmission link connections between network element；
A) there are service management relationships between network element；
B) there are power supply relationships between network element；
C) exist between network element with location relationship, such as: " being located at identical computer room " or " being in identical machine building " relationship；
Network element set of relationship is formed, the basic data as the filtering of subsequent mining algorithm.
To network element set of relationship after resource data processing, is arranged, network element relationship library can be formed.It is as shown in table 4:
4 network element relationship library of table indicates meaning
Step S204: construction transaction database is alerted using the denoising as project, the alarm window as affairs,
And then in conjunction with the weight parameter construction weighting frequent pattern tree (fp tree) of the denoising alarm.
If I={ i1,i2,,inIt is one of n disparity items set, ik, k=1,2, n is known as project, and D is number of transactions
According to library, D={ t1,t2,,tk, wherein tp, p=1,2, k is the subset of set I, tpReferred to as affairs, arbitrary affairs t in Dp∈
D meetsAny affairs tpThere is unique Transaction Identifier, is denoted as TID.
Under normal circumstances, include multiple affairs in transaction database D, alarm is executed after dividing window to operate, each window quilt
It is considered as an affairs, the alarm in each window is considered as project.Therefore transaction database includes multiple affairs, each
Affairs include multiple projects, and the alarm after denoising and dividing window to operate is the project in transaction database.
Frequent pattern tree (fp tree) is weighted to a certain extent the project in transaction database in conjunction with the weight parameter construction of alarm
It has all been compressed on a tree, when next step finds frequent item set, has not needed multiple scanning database, avoid a large amount of I/
O expense.
Step S205: weighting fuzzy frequent itemsets are obtained according to the weighting frequent pattern tree (fp tree).
Each branch on weighting frequent pattern tree (fp tree) can be considered a weighting fuzzy frequent itemsets.It obtains and weights frequent mould
All branches on formula tree, that is, all weighting fuzzy frequent itemsets set, but consider actual application scenarios, at certain
It needs according to the actual situation to be filtered the weighting fuzzy frequent itemsets of acquisition when a little.
Step S206: according to the network element relationship between the denoising alarm, the weighting fuzzy frequent itemsets of the acquisition are carried out
Filtering.
When in conjunction with the whole network resource, it is found that the network element where alerting can have various relationships, 4 kinds of passes as described in table 1
System, therefore alarm association rule is filtered out by network element relationship, there should be certain accuracy.
Any two project for judging that the weighting frequent mode is concentrated whether there is network element relationship, if it does not exist, then
Filter the weighting fuzzy frequent itemsets.
By above-mentioned judgement, if weighting frequent mode is concentrated and be there is no network element relationship there are two project, illustrate with
The alarm association rule that the project that the weighting frequent mode is concentrated generates is possible to inaccuracy, therefore by the weighting fuzzy frequent itemsets
It filters out.
This filtration step is preferred steps, on the basis of passing through network element relationship filtering alarm correlation rule, can also be led to
The length for crossing restriction weighting fuzzy frequent itemsets is filtered.In conjunction with specific application scenarios, the weighting frequent mode that needs
The length of collection cannot be excessive, if the length of weighting fuzzy frequent itemsets is very big, then the weighting generated by the weighting fuzzy frequent itemsets
Correlation rule it is explanatory just it is very poor, therefore, generate weight fuzzy frequent itemsets when, pass through limitation weighting fuzzy frequent itemsets length
Spend the interpretation to guarantee weighted association rules.
The method of specific implementation is that it is more than described that the length of the weighting fuzzy frequent itemsets is deleted according to preset rules depth
The weighting fuzzy frequent itemsets of regular depth.
Step S207: it is frequent that the weighting is obtained according to the relationship of filtered weighting fuzzy frequent itemsets and its all subset
Weighted association rules between being alerted in set of patterns.
After through the above steps, it would know that weighting frequent mode is concentrated to exist between projects and certainly exist correlation rule,
Therefore weighted association rules can be obtained according to weighting fuzzy frequent itemsets and its each subset relation, that is, obtains final alarm association
Rule.
Method particularly includes:
Obtain all nonvoid subsets of each weighting fuzzy frequent itemsets.
Calculate the confidence level of the weighting fuzzy frequent itemsets and its each nonvoid subset.
When the confidence level is greater than preset min confidence, by the corresponding non-empty of the weighting fuzzy frequent itemsets
The weighted association rules that subset generates are set up.
For the step of more preferably illustrating present invention construction weighting frequent pattern tree (fp tree), the embodiment of the present invention three is given below,
It is as shown in Figure 3:
In order to preferably explain weighting frequent pattern tree (fp tree) building method, need to explain to some terms:
Support: it is assumed that X is an Item Sets, D is a transaction database, claims the number and D of the affairs in D comprising X
In the ratio between total affairs number be support (support) of the X in D.The support of X is denoted as sup (X), and correlation ruleSupport be then denoted as sup (X ∪ Y).
Support number: supporting number=support * | D |
Confidence level: to shaped likeCorrelation rule, wherein X and Y is Item Sets, in affairs set D both comprising X or
Affairs number comprising Y and the ratio between the affairs number for only not including Y in D comprising X, or perhaps the support of Item Sets X ∪ Y
It is known as the confidence level (confidence) of rule with the ratio between the support of X, both sup (X ∪ Y)/sup (X), regular's
Confidence level is denoted as
Weighted support measure: weighted association rulesWeighted support measure wsup is defined as:
Weight fuzzy frequent itemsets: given minimum weight support threshold wminsup, if k- item collection X meets following equation,
X is referred to as k- weighting fuzzy frequent itemsets:
If k- item collection X is that k- weights fuzzy frequent itemsets, the support number (SC) of X meets:
The maximum possible weight of one k- item collection comprising Y are as follows:
Wherein i is the set of all items, and Y is a q- Item Sets, wherein is located in the project of remaining I-Y, weight is most
The weight of big (k-q) a project is respectively
Support expectation
According to theorem 1 and theorem 2, the minimum of the k- weighted frequent items comprising Y may support number are as follows:
The k- of referred to as Y supports expectation.In view of answering round numbers, in order to guarantee that the k- Item Sets comprising Y are likely to be weighting
Frequently, it is taken as being greater thanSmallest positive integral.
Weight confidence level: weighted association rulesConfidence level is defined as:
Step S301: support number and K of each project in transaction database in the transaction database are obtained and supports the phase
It hopes, supports expectation to carry out first time filtering to the project in the transaction database according to the support number of each project and K.
According to above recording, number=support * item number is supported.
If the support number of project, which is less than K, supports expectation, which is deleted from database.
First time filtration step is the conventional filtration step that building weighting is frequently set, since the dynamics of its filtering is smaller, because
This combines weight further to be filtered in step s 302.
Step S302: setting minimum achievement support, calculates in the transaction database support of each project and its
The product of weight parameter, and second of mistake is carried out to the project in the transaction database in conjunction with preset minimum achievement support
Filter.
Achievement support is the support of project and the product of weight parameter, if the product is less than minimum contribute and supports
Degree, then delete the project from database.
Step S303: by described by filtering each affairs in the remaining transaction database twice according in affairs
The support number descending of remaining item arranges.
The purpose of achievement is for compressed data library, it is therefore desirable to support number to carry out descending row according to it remaining project
Column.
Step S304: the transaction database that the descending is arranged weights frequent mode according to FP-growth method construct
Tree.
FP-growth achievement algorithm is more mature achievement method, according to conventional FP-growth achievement method to drop
The transaction database of sequence arrangement is contribute.
For the apparent method for illustrating the present invention and obtaining weighting fuzzy frequent itemsets according to weighting frequent pattern tree (fp tree), this is provided
The example IV of invention, as shown in Figure 4.
Step S401: scanning the weighting frequent pattern tree (fp tree), calculates the weighted support measure of each branch in tree, cuts institute
State the branch that weighted support measure is less than default weighted support measure threshold value.
Step S402: the frequent mould of weighting is converted by each of beta pruning rear weight frequent pattern tree (fp tree) branch
Formula collection, the element in set correspond to the node of branch.
All branches in weighting frequent pattern tree (fp tree) are obtained according to the step, in order to enable the alarm association rule obtained
It is then more accurate, final weighting fuzzy frequent itemsets can be filtered out by following two filtration step.
Step S403: being more than the regular depth according to the length that preset rules depth deletes the weighting fuzzy frequent itemsets
Weighting fuzzy frequent itemsets.
Regular depth has arranged to weight the number that frequent mode concentration includes project, if weighting frequent mode concentration includes
Number of items be greater than regular depth, will cause that weighting fuzzy frequent itemsets length is very big, and the weighted association rules of generation are explanatory
Difference.
Regular depth is rule of thumb set with actual conditions.
Step S404: any two project for judging that the weighting frequent mode is concentrated whether there is network element relationship, if
It is not present, then filters the weighting fuzzy frequent itemsets.
It is required weighting fuzzy frequent itemsets by the remaining set of above-mentioned 4 steps.
In order to which the present invention will be described in detail, the disclosed method for excavating alarm association rule, provides the present invention below with reference to example
Embodiment five, as shown in Figure 5.
An alarm transaction database is provided first, was previously mentioned, and an alarm includes multiple field (such as times
Window, NE type, network element rank, alarm level etc.), to avoid description difficult, the handle when describing Mining Weighted Association Rules
I (such as I of Xiang Chengyi subscripting is taken out in one alarm1、I2、I4、I5, I1Indicate an alarm).
Step S501: the alarm of existing net is denoised according to the field information of setting, and is obtained according to alarm feature attribute
The weight parameter of the denoising alarm, obtains the network element relationship of alarm.
Alarm weight involved in example is as shown in table 5:
Table 5 alerts weight signal
| Alarm | weights |
| I1 | 0.1 |
| I2 | 0.3 |
| I3 | 0.4 |
| I4 | 0.8 |
| I5 | 0.9 |
Step S502: a point window is carried out to denoising alarm.
Following table only lists alarm and excavates the part field needed, and including time window, (this is to discriminate between the mark of different affairs
Will), int_id-alarm_id (alarm unique identification) and weight, other fields omit.)
The alarm data of split window is as shown in table 6.
6 original alarm transaction database of table divides window to illustrate
Step S503: construction alarm transaction database.
Above-mentioned alarm transaction database is converted to simplified alarm transaction database, as shown in table 7 below:
The alarm transaction database that table 7 simplifies
| Windows-id | Alarm |
| 2014-04-3023:56:00-2014-05-0100:00:59 | I1I2I4I5 |
| 2014-04-3023:57:00-2014-05-0100:01:59 | I1I4I5 |
| 2014-04-3023:58:00-2014-05-0100:02:59 | I2I4I5 |
| 2014-04-3023:59:00-2014-05-0100:03:59 | I1I2I4I5 |
| 2014-05-0100:00:00-2014-05-0100:04:59 | I1I3I5 |
| 2014-05-0100:01:00-2014-05-0100:05:59 | I2I4I5 |
| 2014-05-0100:02:00-2014-05-0100:06:59 | I2I3I4I5 |
Wherein I1: (int_id-alarm_id is alarm unique identification to -109_601-075-00-075002, so here
An alarm is represented with it), I2: -109_603-070-00-070011, I3: 932827395_FF-1932858163, I4:-
109_602-076-00-076010、I5: -155110151_FF-29254771.
Step S504: given input threshold value.
Given input threshold value: minimum achievement support=0.01, minimum weight support=1, regular depth=4, minimum
Confidence level=0.7.
Step S505: scanning simplifies alarm transaction database D, and the support number and k- for calculating each project support expectation, deletes
Desired alarm is supported except support number is less than k-.
Scanning simplifies alarm transaction database D, | D |=7.
Calculate the support number of each project:
I1: 4/7* | D |=4
I2: 5/7* | D |=5
I3: 2/7* | D |=2
I4: 6/7* | D |=6
I5: 7/7* | D |=7
The K for calculating each project supports expectation:
To I1:
So Bmin(I1)=4=SC (I1)=4
To I2:
So having, Bmin(I2< SC (the I of)=32)=5
So I2It is the potential 1- mode of weighting.
To I3:
So Bmin(I3> SC (the I of)=33)=2
Delete I3。
To I4, I5Same calculating is done, does not have to delete.
Obtain I1, I2, I4, I5。
Step S506: calculate every alarm support with the product of respective weights and compared with minimum achievement support,
Delete the alarm lower than minimum achievement support.
support(I1)*weight(I1)=4/7*0.1=0.0285
support(I2)*weight(I2)=0.2142
Similarly, I is calculated4、I5Corresponding value is all higher than minimum achievement support, does not delete alarm.
This step filter condition is to add on the basis of first step filter condition later, due to alerting the design side of weight
Method, all alarm weights only have 9 kinds, this influences k- and supports desired filter effect unobvious, in practical applications, k- branch
Filtering can hardly be played the role of by holding expectation, but it is again necessary that k-, which supports desired filtering theoretically, so in its mistake
This step filtering is being carried out after filter, it is therefore an objective to really play the role of filtering alarm, this step filtering is both in view of the support of alarm
It is also contemplated that the weight of alarm, therefore, this step filtering are effective and have practical significance.
Step S507: by every affairs in filtered alarm transaction database by support number descending arrangement.
It is as shown in table 8:
The alarm transaction database of 8 descending of table arrangement
| Windows-id | Alarm |
| 2014-04-3023:56:00-2014-05-0100:00:59 | I5I4I2I1 |
| 2014-04-3023:57:00-2014-05-0100:01:59 | I5I4I1 |
| 2014-04-3023:58:00-2014-05-0100:02:59 | I5I4I2 |
| 2014-04-3023:59:00-2014-05-0100:03:59 | I5I4I2I1 |
| 2014-05-0100:00:00-2014-05-0100:04:59 | I5I1 |
| 2014-05-0100:01:00-2014-05-0100:05:59 | I5I4I2 |
| 2014-05-0100:02:00-2014-05-0100:06:59 | I5I4I2 |
Step S508: the transaction database that the descending is arranged weights frequent mode according to FP-growth method construct
Tree.
The weighting frequent pattern tree (fp tree) of generation is as shown in Figure 6.
Step S509: weighting frequent pattern tree (fp tree) beta pruning is given according to minimum weight support.
The weighted support measure of each branch in weighting frequent pattern tree (fp tree) is calculated, and compared with given threshold value, is less than given
The branch of threshold value is cut.
It first calculates with I1For the branch of bottom node, I1Appear in 3 branches in WFP tree.These paths are respectively <
(I5I4I2: 2)>,<(I5: 1)>,<(I5I4: 1) >.
Calculate separately the weighted support measure of these branches and compared with minimum weight support
So I1It is cut up for the branch of bottom node.
Step S510: a weighting frequent mode is converted by each of beta pruning rear weight frequent pattern tree (fp tree) branch
Collection.
Gathered { I5I4I2And set { I5I4}。
Step S511: fuzzy frequent itemsets are weighted according to regular depth-type filtration.
Regular depth is 4, and two weighting fuzzy frequent itemsets are without departing from regular depth.
Step S512: weighting fuzzy frequent itemsets are filtered according to network element relationship.
The network element relationship obtained in inquiry above-mentioned steps, finds I2, I4, I5There is network element relationship between two-by-two.
Step S513: all nonvoid subsets of each weighting fuzzy frequent itemsets are obtained
Gather { I5I4I2All nonvoid subsets be { I2, { I4, { I5, { I2, I4, { I2, I5, { I4, I5}
Gather { I5I4All nonvoid subsets be { I4, { I5}
Step S514: the confidence level of the weighting fuzzy frequent itemsets and its each nonvoid subset is calculated.
Rule one:
Rule two:
Rule three:
Rule four:
Rule five:
Rule six:
Rule seven:
Rule eight:
Step S515: when the confidence level is greater than preset min confidence, by the weighting fuzzy frequent itemsets and its
The weighted association rules that corresponding nonvoid subset generates are set up.
Since min confidence is set as 0.7, above-mentioned eight rule is eligible, excavates altogether with the present invention
8 alarm association rules.
The present invention also provides a kind of alarm association rule digging devices to realize a kind of alarm association rule digging method,
Specific structure of the embodiment of the present invention six to illustrate described device is given below, as shown in Figure 7.
A kind of alarm association rule digging device includes:
Pretreatment unit 1 is alerted, for denoising according to the field information of setting to the alarm of existing net, and according to the announcement
Alert characteristic attribute obtains the weight parameter of the denoising alarm.
Pretreatment unit is alerted according to the alarm preprocess method of above method, alarm is denoised, detailed process
See above description.
Alarm divide window unit 2, for the alarm pretreatment unit 1 treated denoising alert carry out a point window.
Alarm divides window unit according to the alarm method for filling of above method, carries out a point window to alarm, detailed process referring to
Above description.
Frequent pattern tree (fp tree) structural unit 3 is weighted, for constructing transaction database, is handled with the alarm pretreatment unit 1
Denoising alarm afterwards is used as project, and the alarm divides each alarm window of the determination of window unit 2 as affairs, and then in conjunction with described
The weight parameter construction weighting frequent pattern tree (fp tree) of denoising alarm.
Under normal circumstances, include multiple affairs in transaction database D, alarm is executed after dividing window to operate, each window quilt
It is considered as an affairs, the alarm in each window is considered as project.Therefore transaction database includes multiple affairs, each
Affairs include multiple projects, and the alarm after denoising and dividing window to operate is the project in transaction database.
By the way that the project of being used as will be alerted, transaction database of the window as transaction constructs is alerted, building weighting pattern tree will
These projects are all compressed on one tree, are avoided extra expense, be can be improved efficiency.
Fuzzy frequent itemsets acquiring unit 4 is weighted, for the weighting according to weighting 3 structural unit of the frequent pattern tree (fp tree) construction
Frequent pattern tree (fp tree) obtains weighting fuzzy frequent itemsets.
Each branch on weighting pattern tree can be a weighting pattern collection.Obtain the institute on weighting frequent pattern tree (fp tree)
There is branch, that is, all weighting fuzzy frequent itemsets set, but consider actual application scenarios, it is needed sometimes
The weighting fuzzy frequent itemsets of acquisition are filtered according to the actual situation.It can be carried out according to the network element relationship belonging to alarm
Filter, can also be filtered according to regular depth.Concrete methods of realizing refers to the description of method above, no longer superfluous herein
It states.
Relationship data mining unit 5, the frequent mould of weighting for being obtained according to the weighting fuzzy frequent itemsets acquiring unit 4
The relationship of formula collection and its all subset obtains the weighted association rules between the weighting frequent mode concentration alarm.
The method for obtaining weighted association rules according to weighting fuzzy frequent itemsets are as follows:
Obtain all nonvoid subsets of each weighting fuzzy frequent itemsets.
Calculate the confidence level of the weighting fuzzy frequent itemsets and its each nonvoid subset.
When the confidence level is greater than preset min confidence, by the corresponding non-empty of the weighting fuzzy frequent itemsets
The weighted association rules that subset generates are set up.
In order to further ensure the accuracy of the alarm association rule of excavation, pretreatment unit is alerted, is also used to according to institute
The field information of setting is stated, the network element relationship between the denoising alarm is obtained.Preferably, described device can also include:
Fuzzy frequent itemsets filter element 6 is weighted, between the denoising alarm for obtaining according to the alarm pretreatment unit 1
Network element relationship is filtered the weighting fuzzy frequent itemsets of the acquisition；With the weighting frequency according to preset rules depth-type filtration
The length of numerous set of patterns is more than the weighting fuzzy frequent itemsets of the regular depth.
Relationship data mining unit 5 obtains the filtered frequent mould of weighting of filter element according to the weighting fuzzy frequent itemsets
The relationship of formula collection and its all subset obtains the weighted association rules between the weighting frequent mode concentration alarm.
In the present invention about construction weight frequent pattern tree (fp tree) when using to some definition and formula see above method
Relevant portion in description, details are not described herein.
For a kind of structure of alarm association rule digging device each section of the more detailed description present invention, the present invention is provided
Embodiment seven, as shown in Figure 8.
Alarm pretreatment unit 1 further comprises:
Alarm denoising module 11, for deleting the incomplete alarm of field data, removal work according to the field information of setting
Journey alarm, the alarm of removal non-communicating equipment class, removal associated alarm, the slight alarm of removal, removal repeat to alert.
The field information of setting is seen above shown in middle table 1.The correlation that the method for denoising is described referring also to above method
Part.
Weight calculation module 12 is alerted, for the network element according to network element belonging to the alarm level of the denoising alarm and alarm
Type calculates the weight parameter of the denoising alarm.
Network element Relation acquisition module 13, for obtaining the network element relationship between the denoising alarm according to network element resources information.
Alarm divide window unit 2, for the alarm pretreatment unit 1 treated denoising alert carry out a point window.
Weighting frequent pattern tree (fp tree) structural unit 3 further comprises:
Project filtering module 31, for obtaining support number of each project in transaction database in the transaction database
It supports it is expected with K, supports expectation to carry out the to the project in the transaction database according to the support number of each project and K
Primary filtering；Minimum achievement support is set, the support of each project and its weight parameter in the transaction database are calculated
Product, and second is carried out to the project in the transaction database in conjunction with preset minimum achievement support and is filtered；
Transaction orderings module 32 filters in the remaining transaction database for that will pass through the project filtering module 31
Each affairs according in affairs remaining item support number descending arrange；
Weight frequent pattern tree (fp tree) constructing module 33, for will pass through affairs that the transaction orderings module 32 sorts according to
FP-growth method construct weights frequent pattern tree (fp tree).
Weighting fuzzy frequent itemsets acquiring unit 4 further comprises:
Pruning module 41 calculates in tree for scanning the weighting frequent pattern tree (fp tree) constructing module weighting frequent pattern tree (fp tree)
The weighted support measure of each branch cuts the branch that the weighted support measure is less than default weighted support measure threshold value；
It weights fuzzy frequent itemsets and obtains module 42, for will be by the weighting frequent pattern tree (fp tree) after the pruning module beta pruning
Each of branch be converted into a weighting fuzzy frequent itemsets, the element in set corresponds to the node of branch.
Relationship data mining unit 5 further comprises:
Subset obtains module 51, frequent for obtaining each weighting that the weighting fuzzy frequent itemsets obtain the acquisition of module 42
All nonvoid subsets of set of patterns.
Confidence calculations module 52, for calculating the confidence level of the weighting fuzzy frequent itemsets and its each nonvoid subset.
Rule set up determination module 53, for when the confidence calculations module 52 calculate confidence level be greater than it is preset most
When small confidence level, determine that the weighted association rules generated by the corresponding nonvoid subset of the weighting fuzzy frequent itemsets are set up.
Fuzzy frequent itemsets filter element 6 is weighted, between the denoising alarm for obtaining according to the alarm pretreatment unit 1
Network element relationship is filtered the weighting fuzzy frequent itemsets of the acquisition；With the weighting frequency according to preset rules depth-type filtration
The length of numerous set of patterns is more than the weighting fuzzy frequent itemsets of the regular depth.
After 11 pairs of module alarms of alarm denoising are cleaned and denoised, alarm weight calculation module 12 obtains the power of alarm
Weight, network element Relation acquisition module 13 obtain the network element relationship between alarm；Alarm divides 2 pairs of window unit alarms to carry out point window shape into item
Mesh, weighting frequent pattern tree (fp tree) structural unit 3 according to after denoising alarm combine alarm weight, by project filtering module 31,
Transaction orderings module 32, weighting frequent pattern tree (fp tree) constructing module 33 are completed to the filtering of project, the sequence of affairs and weighting frequency
The construction of numerous scheme-tree；It weights fuzzy frequent itemsets acquiring unit 4 and obtains module by pruning module 41, weighting fuzzy frequent itemsets
42, final weighting fuzzy frequent itemsets are obtained after being filtered to weighting fuzzy frequent itemsets；Weight fuzzy frequent itemsets filter element 6
Weighting fuzzy frequent itemsets are further filtered；Relationship data mining unit 5 obtains weighting frequency by oneself obtaining module 51
Nonvoid subset in numerous set of patterns, confidence calculations module 52 calculate the confidence level of these subsets, and rule sets up determination module 53
Pass through the weighted association rules for determining finally to set up compared with preset min confidence by confidence level.
Weighting alarm may be implemented by the present apparatus and carry out operation, and the mistake of different phase can be set according to the actual situation
Step is filtered, automatically analyzed based on existing network data realization and accurately excavates alarm of telecommunication network correlation rule.
The present apparatus is to realize a kind of alarm association rule digging method, the method description above of the working principle of each module
In have corresponding description, details are not described herein.
Although disclosed herein embodiment it is as above, the content is not of the invention directly to limit
Protection scope.Any the technical staff in the technical field of the invention, do not depart from disclosed herein spirit and scope
Under the premise of, a little change can be made in the formal and details of implementation.Protection scope of the present invention, still must be with appended power
Subject to the range that sharp claim is defined.
Claims (13)
1. a kind of alarm association rule digging method, which is characterized in that the described method includes:
The alarm of existing net is denoised according to the field information of setting, and the denoising alarm is obtained according to alarm feature attribute
Weight parameter；
A point window is carried out to denoising alarm；
Transaction database is constructed, is alerted using the denoising as project, the alarm window is gone as affairs, and then in conjunction with described
Make an uproar alarm weight parameter construction weighting frequent pattern tree (fp tree)；
Weighting fuzzy frequent itemsets are obtained according to the weighting frequent pattern tree (fp tree)；
It is obtained between the weighting frequent mode concentrates and alert according to the relationship of the weighting fuzzy frequent itemsets and its all subset
Weighted association rules；
The construction transaction database is alerted using the denoising as project, and the alarm window combines institute as affairs
The method for stating the weight parameter construction weighting frequent pattern tree (fp tree) of denoising alarm specifically:
It obtains support number and K of each project in transaction database in the transaction database and supports expectation, according to described every
The support number and K of a project support expectation to carry out first time filtering to the project in the transaction database；
Minimum achievement support is set, multiplying for the support of each project and its weight parameter in the transaction database is calculated
Product, and second is carried out to the project in the transaction database in conjunction with preset minimum achievement support and is filtered；
By described by filtering each affairs in the remaining transaction database according to the branch of remaining item in affairs twice
Hold several descending arrangements；
The transaction database that the descending is arranged weights frequent pattern tree (fp tree) according to FP-growth method construct.
2. the method according to claim 1, wherein the method also includes:
According to network element resources information, the network element relationship between the denoising alarm is obtained；
According to the network element relationship between the denoising alarm, the weighting fuzzy frequent itemsets of the acquisition are filtered；
The weighting frequent mode, which is obtained, according to the relationship of filtered weighting fuzzy frequent itemsets and its all subset concentrates alarm
Between weighted association rules.
3. according to the method described in claim 2, it is characterized in that, according to the network element relationship between the denoising alarm, to described
The method that the weighting fuzzy frequent itemsets of acquisition are filtered specifically:
Any two project for judging that the weighting frequent mode is concentrated whether there is network element relationship, if it does not exist, then filtering
The weighting fuzzy frequent itemsets.
4. according to the method described in claim 3, it is characterized in that, the power for obtaining denoising alarm according to alarm feature attribute
The method of weight parameter specifically:
The weight of the denoising alarm is calculated according to the alarm level of the denoising alarm and the NE type for alerting affiliated network element
Parameter.
5. according to the method described in claim 4, it is characterized in that, described obtain weighting frequency according to the weighting frequent pattern tree (fp tree)
The method of numerous set of patterns specifically:
The weighting frequent pattern tree (fp tree) is scanned, the weighted support measure of each branch in tree is calculated, cuts the weighted support measure
Less than the branch of default weighted support measure threshold value；
A weighting fuzzy frequent itemsets are converted by each of beta pruning rear weight frequent pattern tree (fp tree) branch, in set
Element corresponds to the node of branch.
6. according to the method described in claim 5, it is characterized in that, the method also includes:
It is more than the frequent mould of weighting of the regular depth according to the length that preset rules depth deletes the weighting fuzzy frequent itemsets
Formula collection.
7. according to the method described in claim 6, it is characterized in that, described according to the weighting fuzzy frequent itemsets and its all son
The relationship of collection obtains the method that the weighting frequent mode concentrates the weighted association rules between alarm specifically:
Obtain all nonvoid subsets of each weighting fuzzy frequent itemsets；
Calculate the confidence level of the weighting fuzzy frequent itemsets and its each nonvoid subset；
When the confidence level is greater than preset min confidence, by the corresponding nonvoid subset of the weighting fuzzy frequent itemsets
The weighted association rules of generation are set up.
8. according to claim 1 to any method in 7, which is characterized in that the field information according to setting is to existing
The method that net alarm is denoised specifically:
The incomplete alarm of field data, the alarm of removal engineering, removal non-communicating equipment class are deleted according to the field information of setting
Alarm, removal associated alarm, the slight alarm of removal, removal repeat to alert.
9. a kind of alarm regulation correlating method excavating gear, which is characterized in that described device includes:
Pretreatment unit is alerted, for being denoised according to the field information of setting to the alarm of existing net, and it is special according to the alarm
Sign attribute obtains the weight parameter of the denoising alarm；
Alarm divide window unit, for the alarm pretreatment unit treated denoising alert carry out a point window；
Frequent pattern tree (fp tree) structural unit is weighted, for constructing transaction database, treated goes with the alarm pretreatment unit
Alarm make an uproar as project, each alarm window that the alarm divides window unit to determine is accused as affairs, and then in conjunction with the denoising
Alert weight parameter construction weighting frequent pattern tree (fp tree)；
Fuzzy frequent itemsets acquiring unit is weighted, for the frequent mould of weighting according to the weighting frequent pattern tree (fp tree) structural unit construction
Formula tree obtains weighting fuzzy frequent itemsets；
Relationship data mining unit, for according to it is described weighting fuzzy frequent itemsets acquiring unit obtain weighting fuzzy frequent itemsets with
The relationship of its all subset obtains the weighted association rules between the weighting frequent mode concentration alarm；
The weighting frequent pattern tree (fp tree) structural unit further comprises:
Project filtering module, for obtaining support number and K branch of each project in transaction database in the transaction database
Expectation is held, supports expectation to carry out for the first time the project in the transaction database according to the support number of each project and K
Filtering；Minimum achievement support is set, multiplying for the support of each project and its weight parameter in the transaction database is calculated
Product, and second is carried out to the project in the transaction database in conjunction with preset minimum achievement support and is filtered；
Transaction orderings module filters each thing in the remaining transaction database for that will pass through the project filtering module
Business is arranged according to the support number descending of remaining item in affairs；
Frequent pattern tree (fp tree) constructing module is weighted, for the affairs of the transaction orderings module sequence will to be passed through according to FP-growth
Method construct weights frequent pattern tree (fp tree).
10. device according to claim 9, which is characterized in that described device further includes that weighting fuzzy frequent itemsets filtering is single
Member:
The alarm pretreatment unit is also used to the field information according to the setting, obtains the network element between the denoising alarm
Relationship；
The weighting fuzzy frequent itemsets filter element, the net between denoising alarm for being obtained according to the alarm pretreatment unit
First relationship is filtered the weighting fuzzy frequent itemsets of the acquisition；With the weighting according to preset rules depth-type filtration is frequent
The length of set of patterns is more than the weighting fuzzy frequent itemsets of the regular depth；
Relationship data mining unit obtains the filtered weighting fuzzy frequent itemsets of filter element according to the weighting fuzzy frequent itemsets
The weighted association rules between the weighting frequent mode concentration alarm are obtained with the relationship of its all subset.
11. device according to claim 10, which is characterized in that the alarm pretreatment unit further comprises:
Denoising module is alerted, for being alerted according to the incomplete alarm of the field information of setting deletion field data, removal engineering,
Removing the alarm of non-communicating equipment class, removal associated alarm, removal, slightly alarm, removal repeat to alert；
Weight calculation module is alerted, based on the NE type according to network element belonging to the alarm level of the denoising alarm and alarm
Calculate the weight parameter of the denoising alarm；
Network element Relation acquisition module, for obtaining the network element relationship between the denoising alarm according to network element resources information.
12. device according to claim 11, which is characterized in that the weighting fuzzy frequent itemsets acquiring unit is further wrapped
It includes:
Pruning module calculates each in tree for scanning the weighting frequent pattern tree (fp tree) constructing module weighting frequent pattern tree (fp tree)
The weighted support measure of branch cuts the branch that the weighted support measure is less than default weighted support measure threshold value；
Weight fuzzy frequent itemsets obtain module, for will by after the pruning module beta pruning weighting frequent pattern tree (fp tree) in it is every
One branch is converted into a weighting fuzzy frequent itemsets, and the element in set corresponds to the node of branch.
13. device according to claim 12, which is characterized in that the relationship data mining unit further comprises:
Subset obtains module, for obtaining each weighting fuzzy frequent itemsets for weighting fuzzy frequent itemsets acquisition module acquisition
All nonvoid subsets；
Confidence calculations module, for calculating the confidence level of the weighting fuzzy frequent itemsets and its each nonvoid subset；
Rule sets up determination module, and the confidence level for calculating when the confidence calculations module is greater than preset min confidence
When, determine that the weighted association rules generated by the corresponding nonvoid subset of the weighting fuzzy frequent itemsets are set up.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410828721.1A CN105786919B (en) | 2014-12-26 | 2014-12-26 | A kind of alarm association rule digging method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410828721.1A CN105786919B (en) | 2014-12-26 | 2014-12-26 | A kind of alarm association rule digging method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN105786919A CN105786919A (en) | 2016-07-20 |
| CN105786919B true CN105786919B (en) | 2019-11-26 |
Family
ID=56388574
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201410828721.1A Active CN105786919B (en) | 2014-12-26 | 2014-12-26 | A kind of alarm association rule digging method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN105786919B (en) |
Families Citing this family (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109840666B (en) * | 2017-11-29 | 2020-12-18 | 中国电力科学研究院有限公司 | Model construction method and system for predicting future wind turbine generator failure |
| CN108156037B (en) * | 2017-12-29 | 2020-12-15 | 中国移动通信集团江苏有限公司 | Alarm correlation analysis method, device, equipment and medium |
| CN108427744B (en) * | 2018-03-07 | 2021-05-14 | 鞍钢集团矿业有限公司 | Intelligent data association relation determining method based on information operation and maintenance |
| CN110300011B (en) * | 2018-03-23 | 2022-07-01 | 中国移动通信集团有限公司 | Alarm root cause positioning method, device and computer readable storage medium |
| CN109567815A (en) * | 2018-10-23 | 2019-04-05 | 电子科技大学 | A kind of remote monitoring method of Infant behavior state |
| CN111950270B (en) * | 2019-04-29 | 2023-11-24 | 中国移动通信集团湖北有限公司 | Communication network alarm association method and device and computing equipment |
| CN113794671B (en) * | 2020-05-25 | 2023-05-12 | 中车株洲电力机车研究所有限公司 | Method and system for generating column control firewall filtering rules |
| US11269706B2 (en) * | 2020-07-15 | 2022-03-08 | Beijing Wodong Tianjun Information Technology Co., Ltd. | System and method for alarm correlation and aggregation in IT monitoring |
| CN112685277B (en) * | 2020-12-31 | 2023-01-24 | 海光信息技术股份有限公司 | Warning information checking method and device, electronic equipment and readable storage medium |
| CN116612612B (en) * | 2023-05-19 | 2024-06-11 | 湖北清江水电开发有限责任公司 | Centralized control center alarm method for river basin step power plant, computer equipment and storage medium |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102142992A (en) * | 2011-01-11 | 2011-08-03 | 浪潮通信信息系统有限公司 | Communication alarm frequent itemset mining engine and redundancy processing method |
| CN102289507A (en) * | 2011-08-30 | 2011-12-21 | 王洁 | Method for mining data flow weighted frequent mode based on sliding window |
-
2014
- 2014-12-26 CN CN201410828721.1A patent/CN105786919B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102142992A (en) * | 2011-01-11 | 2011-08-03 | 浪潮通信信息系统有限公司 | Communication alarm frequent itemset mining engine and redundancy processing method |
| CN102289507A (en) * | 2011-08-30 | 2011-12-21 | 王洁 | Method for mining data flow weighted frequent mode based on sliding window |
Non-Patent Citations (1)
| Title |
|---|
| 网络告警关联规则挖掘系统的研究与设计;吴萍等;《计算机应用与软件》;20080331;第25卷(第3期);第177页 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN105786919A (en) | 2016-07-20 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN105786919B (en) | A kind of alarm association rule digging method and device | |
| CN106792514B (en) | User position analysis method based on signaling data | |
| Napolitano et al. | Single-parameter sensitivity analysis for aquifer vulnerability assessment using DRASTIC and SINTACS | |
| US20210201232A1 (en) | Planning system using spatial-based visualization aids | |
| US7685141B2 (en) | Connection sub-graphs in entity relationship graphs | |
| JP5705307B2 (en) | Dynamic adaptive process discovery and compliance | |
| CN108156037A (en) | Alarm correlation analysis method, device, equipment and medium | |
| US20140058705A1 (en) | System and Method for Detecting Abnormal Occurrences | |
| CN107918629B (en) | Correlation method and device for alarm fault | |
| CN105721228A (en) | Method for importance evaluation of nodes of power telecommunication network based on fast density clustering | |
| CN109508363A (en) | Water conservancy big data service platform and its working method based on GIS | |
| CN107403005A (en) | A kind of web publishing method and device | |
| CN101477552A (en) | Website user rank division method | |
| CN105471670A (en) | Flow data classification method and device | |
| CN108829794B (en) | Alarm analysis method based on interval graph | |
| CN106682206A (en) | Method and system for big data processing | |
| Rautman | Risk, reciprocity, and the operation of social networks | |
| CN112565007A (en) | System health degree evaluation method and device | |
| Klement et al. | Using SOM in the performance monitoring of the emergency call-taking system | |
| Boyce et al. | Negative binomial models for abundance estimation of multiple closed populations | |
| CN104794234A (en) | Data processing method and device for benchmarking | |
| CN104657473B (en) | A kind of large-scale data method for digging guaranteeing quality monotonicity | |
| CN111552847B (en) | Method and device for changing number of objects | |
| Keim et al. | Visual data mining of large spatial data sets | |
| Zaliapin et al. | Inverse cascade in a percolation model: Hierarchical description of time-dependent scaling |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |