CN109951306A - Processing method, device, equipment and the medium of alarm - Google Patents
Processing method, device, equipment and the medium of alarm Download PDFInfo
- Publication number
- CN109951306A CN109951306A CN201711384399.8A CN201711384399A CN109951306A CN 109951306 A CN109951306 A CN 109951306A CN 201711384399 A CN201711384399 A CN 201711384399A CN 109951306 A CN109951306 A CN 109951306A
- Authority
- CN
- China
- Prior art keywords
- alarm
- path
- determined
- work order
- tree
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
- Alarm Systems (AREA)
Abstract
The present invention provides a kind of processing method of alarm, device, equipment and media, wherein, the processing method of the alarm includes: that the attribute information based on dependence and alarm between alarm sets the alarm that formed in the form of path of the alarm record in alarm log；It in preset multiple sliding window durations, obtains path overlapping possibility in alarm tree and meets multiple paths of preset condition, and multiple paths are determined as the associated path with incidence relation between path；The earliest alarm of time-sequencing in associated path is determined as to the alarm source of associated path, and work order is carried out to the alarm for being determined as alarm source and distributes processing operation.Through the invention, solving the alarm association relationship excavated in the related technology can not make explanations and reasoning foundation, and causing to summarize to judge does not have the problem of quantitative criteria.
Description
Technical field
The present invention relates to field of communication technology more particularly to a kind of processing method of alarm, device, equipment and media.
Background technique
In current communication network management, daily equipment and system generate the warning information of magnanimity and carry out concentration remittance
Always.These warning information cover equipment fault, hidden network danger, user's perception and complain the every aspects such as early warning.While with
The rapid development of communication network, the interconnection of communication network, the fusion of various standards, the integration of business and device systems multiplicity
The factors such as change make the structure of mobile network become increasingly complex, and the warning information of generation is also numerous with regard to source, so that network be given to tie up
The work belt that shield eliminates failure carrys out huge workload.Simultaneously these magnanimity warning information also because this complexity majority not
The unification of alarm coding and description can be fully achieved, this also brings some obstructions to alert analysis.For mobile communications network
The characteristics of, though it is foreseeable that network failure has process effects more, and there is also recessive relevance, mesh for the warning information of generation
Preceding excavation means can not sufficiently extract these relevances, if it is possible to which the accuracy and efficiency for improving excavation can then drop
The workload of low network operation avoids alarm from repeating the waste of worksheet processing.Existing technical solution is dug for alarm association rule
It digs to improve the actually rare and Shortcomings of worksheet processing efficiency.
A kind of associated neural network construction method of communication network warning is provided in the related technology, and this method is according to business
Expert establishes training sample set, using the training method of neural network, establishes the model of neural network, is stored in neural network mould
In type library, corresponding neural network model is called using the module of alarm smart filter when applied analysis, association is calculated and closes
System.But this method uses Neural Network Data mining algorithm, it is more prominent to the mining ability of correlation rule, but excavate
Incidence relation out has no ability to make explanations and reasoning foundation, and the standard not quantified is judged in the summary of incidence relation, influences
Factor cannot exclude more, and accuracy is difficult to ensure.
In view of the above problems in the related art, not yet there is effective solution at present.
Summary of the invention
The embodiment of the invention provides a kind of processing method of alarm, device, equipment and media, solve in the related technology
The alarm association relationship excavated can not make explanations and reasoning foundation, and causing to summarize to judge does not have the problem of quantitative criteria.
In a first aspect, method includes: based between alarm the embodiment of the invention provides a kind of processing method of alarm
Dependence and the attribute information of alarm set the alarm that formed in the form of path of the alarm record in alarm log；Pre-
If multiple sliding window durations in, obtain path overlapping possibility in the alarm tree and meet multiple paths of preset condition, and
The multiple path is determined as between path to the associated path with incidence relation；Time-sequencing in the associated path is earliest
Alarm be determined as the alarm source of the associated path, and work order is carried out to the alarm for being determined as alarm source and distributes processing operation.
Second aspect, the embodiment of the invention provides a kind of processing unit of alarm, device includes: to form module, is used for
Attribute information based on dependence and alarm between alarm is by the alarm record in alarm log in the form of path
Form alarm tree；Determining module, it is general in preset multiple sliding window durations, obtaining path overlap in the alarm tree
Rate meets multiple paths of preset condition, and the multiple path is determined as the associated path with incidence relation between path；
Processing module, for the earliest alarm of time-sequencing in the associated path to be determined as to the alarm source of the associated path, and
Work order is carried out to the alarm for being determined as alarm source and distributes processing operation.
The third aspect, the embodiment of the invention provides a kind of processing equipments of alarm, comprising: at least one processor, extremely
A few memory and computer program instructions stored in memory, when computer program instructions are executed by processor
Realize the method such as first aspect in above embodiment.
Fourth aspect, the embodiment of the invention provides a kind of computer readable storage mediums, are stored thereon with computer journey
The method such as first aspect in above embodiment is realized in sequence instruction when computer program instructions are executed by processor.
Processing method, device, equipment and the medium of alarm provided in an embodiment of the present invention, based on the interdependent pass between alarm
The attribute information of system and alarm forms alarm tree for the alarm record in alarm log in the form of path, and preset
It in multiple sliding window durations, obtains path overlapping possibility in alarm tree and meets multiple paths of preset condition, and by multiple roads
Diameter is determined as the associated path with incidence relation between path, so as to which the earliest alarm of time-sequencing in associated path is true
It is set to the alarm source of associated path, and work order is carried out to the alarm for being determined as alarm source and distributes processing operation, that is to say, that passes through
The aforesaid way of the present embodiment, all properties feature of incidence relation provide the foundation of the judge incidence relation reliability of quantization,
Final realize promotes the efficiency that work order distributes, solve the alarm association relationship excavated in the related technology can not make explanations and
Reasoning foundation, causing to summarize to judge does not have the problem of quantitative criteria.
Detailed description of the invention
In order to illustrate the technical solution of the embodiments of the present invention more clearly, will make below to required in the embodiment of the present invention
Attached drawing is briefly described, for those of ordinary skill in the art, without creative efforts, also
Other drawings may be obtained according to these drawings without any creative labor.
Fig. 1 is the flow chart of the processing method of alarm according to an embodiment of the invention；
Fig. 2 is alarm tree construction schematic diagram according to an embodiment of the invention；
Fig. 3 is that alarm source according to an embodiment of the invention establishes schematic diagram；
Fig. 4 is the structural schematic diagram of the processing unit of alarm according to an embodiment of the invention；
Fig. 5 is the optional structure diagram of the processing unit of alarm according to an embodiment of the invention；
Fig. 6 is the hardware configuration signal of the processing equipment of the alarm provided according to an embodiment of the present invention.
Specific embodiment
The feature and exemplary embodiment of various aspects of the invention is described more fully below, in order to make mesh of the invention
, technical solution and advantage be more clearly understood, with reference to the accompanying drawings and embodiments, the present invention is further retouched in detail
It states.It should be understood that specific embodiment described herein is only configured to explain the present invention, it is not configured as limiting the present invention.
To those skilled in the art, the present invention can be real in the case where not needing some details in these details
It applies.Below the description of embodiment is used for the purpose of better understanding the present invention to provide by showing example of the invention.
It should be noted that, in this document, relational terms such as first and second and the like are used merely to a reality
Body or operation are distinguished with another entity or operation, are deposited without necessarily requiring or implying between these entities or operation
In any actual relationship or order or sequence.Moreover, the terms "include", "comprise" or its any other variant are intended to
Non-exclusive inclusion, so that the process, method, article or equipment including a series of elements is not only wanted including those
Element, but also including other elements that are not explicitly listed, or further include for this process, method, article or equipment
Intrinsic element.In the absence of more restrictions, the element limited by sentence " including ... ", it is not excluded that including
There is also other identical elements in the process, method, article or equipment of the element.
Below with reference to the embodiment of the present invention, the present invention is described in detail；
Embodiment 1
Fig. 1 is the flow chart of the processing method of alarm according to an embodiment of the invention, as shown in Figure 1, this method
Step includes:
Step S102: the attribute information based on dependence and alarm between alarm remembers the alarm in alarm log
Record forms alarm tree in the form of path；
Step S104: in preset multiple sliding window durations, it is default to obtain overlapping possibility satisfaction in path in alarm tree
Multiple paths of condition, and multiple paths are determined as to the associated path between path with incidence relation；
Step S106: the earliest alarm of time-sequencing in associated path is determined as to the alarm source of associated path, and to true
The alarm for being set to alarm source carries out work order and distributes processing operation.
S102 to step S106 through the above steps, the attribute information based on dependence and alarm between alarm will
The alarm that formed in the form of path of alarm record in alarm log is set, and in preset multiple sliding window durations, is obtained
It takes path overlapping possibility in alarm tree to meet multiple paths of preset condition, and multiple paths is determined as to have association between path
The associated path of relationship, so as to which the earliest alarm of time-sequencing in associated path to be determined as to the alarm source of associated path,
And work order is carried out to the alarm for being determined as alarm source and distributes processing operation, that is to say, that aforesaid way through this embodiment closes
The all properties feature of connection relationship provides the foundation of the judge incidence relation reliability of quantization, final to realize that promoting work order distributes
Efficiency, solving the alarm association relationship excavated in the related technology can not make explanations and reasoning foundation, cause summarize comment
Sentencing does not have the problem of quantitative criteria.
In an optional embodiment of the present embodiment, be related in the step 102 in the present embodiment based on alarm
Between dependence and alarm attribute information by alarm log alarm record in the form of path formed alert
The mode of tree may is that
Step 102-1: establishing the level Four administrative division dictionary for being used to indicate alarm place according to the region affiliation of alarm, with
And the four networks dictionary of alarm network element is used to indicate according to the network element Level building of alarm；
Step 102-2: by alarm coding, alarm type, the alarm title, alarm description, alarm time in alarm record
The alarm tree being made of multiple paths is formed as the node in path with level Four administrative division dictionary and four networks dictionary.
For above-mentioned steps S102-1 and step S102-2, may is that in concrete application scene in the present embodiment pair
Alarm log is analyzed, based on alarm coding Ci, alarming processing teams and groups AiAnd alarm network element EiAnd region affiliation dictionary and network element
Level dictionary establishes basic network topology database and alarm path Li.Wherein, the step of which may include:
Step S11: level Four district dictionary is established according to region affiliation, as shown in table 1.
Table 1
It should be noted that it is simpler for subsequent progress path operation, it not only needs to guarantee that binary encoding is unique, every grade of volume
Code also needs unique.
Step S12: according to network element Level building four networks dictionary, as shown in table 2:
Table 2
Step S13: using maximum matching process, the prefix grade that acquisition alarm encodes, such as AAAA-BBBB-CCCC, secondly
Grade alarm coding prefix is respectively Pre0=AAAA, Pre1=BBBB.
Step S14: being traversed based on alarm record and above-mentioned coding rule, forms alarm tree, alarm is compiled as shown in table 3
Code dictionary table.
| Alarm point | Alert network element | Alarm type | Alert title | Alarm description | Alarm coding | Alarm time |
| Hongshan District | eNode-B | Rotating ring failure | DH0000 | DH0000 | 000010 |
Table 3
Based on above-mentioned steps S11 to step S14, alarm tree is formd in the present embodiment, Fig. 2 is to implement according to the present invention
The alarm tree construction schematic diagram of example, as shown in Fig. 2, the path Li that above-mentioned steps S1 is alerted into step S4 indicates A10-001-
005-B01-001-003。
Be related in step S102 in the present embodiment in the attribute based on dependence and alarm between alarm
Information by alarm log alarm record in the form of path formed alarm tree after, the method for the present embodiment can also wrap
It includes:
Step S108: the completely duplicate path in path in alarm tree is obtained；
Step S110: duplicate removal processing is carried out to completely duplicate path.
Mode based on above-mentioned steps S102 in concrete application scene, above-mentioned steps S108 and step S110 are specifically being answered
With may is that all paths for obtaining alarm log in scene, removing duplicate paths composition path set L, calculating the road of path set
Diameter LiDistribution probability；Specific method step includes:
Step S21: according to mode of the step S102 in concrete application scene, each of alarm log is recorded and is generated
Alert path LiAnd alarm path set L is merged into, wherein L={ L1, L2...Li...Lm}。
Step S22: being removed the duplicate paths alerted in path set L using the method for array duplicate removal, obtain path set L ',
The sequence that duplicate paths refer to that the node in two paths is identical and node is in path is identical, L '={ L1,
L2...Li...Ln}。
By the naming rule in path it is found that alarm ownership place having the same, identical network element belong to level, identical announcement
Alert coding level, which can just be considered as same alarm, has common path.
Step S23: traverse path collection L ', for the path L in path set L 'i, count in alarm log and convert path tree
For the quantity of the record of L ', it is denoted as Ni, calculate path LiDistribution probability, calculation formula are as follows:
Step S24: setting minimum distribution probability p, and distribution probability is lower than the path of minimum distribution probability from path set L '
Middle deletion, to filter out alarm in small probability event, avoid them from generating abnormal results in subsequent association relation excavation,
Finally obtain path set L ".
In another optional embodiment of the present embodiment, for the preset multiple slidings being related in the present embodiment
In the case that window is preferably two, path overlapping possibility meets pre- in the acquisition alarm tree that the present embodiment step S104 is related to
If multiple paths of condition, and multiple paths being determined as between path to, there is the mode of the associated path of incidence relation may is that
Step S104-1: in preset two sliding windows, the overlapping number in any two path in alarm tree is obtained；
Step S104-2: overlapping possibility is determined by predetermined manner based on overlapping number；
Step S104-3: in the case where overlapping possibility meets preset condition, any two path is determined as between path
Associated path with incidence relation.
It, can be in the concrete application scene of the present embodiment for mode of the above-mentioned steps S104-1 into step S104-3
It is: a length of t when setting sliding window1And t2, calculate the probability that alarm path is overlapped in sliding window, the specific steps are as follows:
Step S31: a length of t when setting sliding window1And t2, traverse path collection L " simultaneously obtains any two of them path L
″m、L″n, in sliding time window t1And t2Under overlapping number, be denoted as Wmn1、Wmn2, the definition of overlapping is path LmCorresponding announcement
Alert record time of origin and path LnThe time difference of corresponding alarm record time of origin is less than sliding window duration, records as follows
Path set L " path overlap number shown in table 4:
Table 4
Step S32: path L "mWith path L "nThe probability to overlap is in sliding window t1And t2It is lower respectively by following
Formula calculates:
Also, it is path set L " path overlap probability tables shown in the following table 5:
Table 5
And wherein according to the incidence relation between the overlapping possibility analysis path in path, traverse path set obtains alarm source
Mode are as follows:
Step S41: according to a length of t in sliding window1And t2Under path between the probability that overlaps come between analysis path
Incidence relation, the judgment formula of incidence relation are as follows:
If qmn1、qmn2Meet above formula then path L "mWith L "nWith incidence relation.
Step S42: the corresponding alarm alarm source having the same in the path with incidence relation, traversal have incidence relation
Path, using time-sequencing it is primary alarm record as incidence relation alarm source.As shown in figure 3, Fig. 3 is according to this hair
The alarm source of bright one embodiment establishes schematic diagram.
In addition, distributing processing operation for carrying out work order to the alarm for being determined as alarm source in the present embodiment step S106
Mode may is that
Step S106-1: determine whether the preset time period before the generation moment for the alarm for being determined as alarm source generates
Cross alarm work order；
Step S106-2: in the case where generating work order, ignore the operation for executing and distributing work order；
Step S106-3: in the case where not generating work order, the alarm for being determined as alarm source is executed and distributes work order
Operation.
Step S106-4: in the case that alarm source is not present in the earliest alarm of time-sequencing in associated path, to alarm
Execute the operation for distributing work order.
For mode of the above-mentioned steps S106-1 into step S106-4, may is that in concrete application scene
The time of origin of alarm is extracted, whether the alarm source of the Recollection Examination alarm generates alarm work order, if generating work order
It then skips over, otherwise distributes work order, the specific steps are as follows:
Step S51: extracting the path of the alarm, the incidence relation query warning source according to alarm.
Step S52: if alarm source is not present in the alarm, distributing work order and terminate to this alarm, and alarm source is then if it exists
Jump to step S53.
Step S53: extracting the time of origin of the alarm, traverses sliding window duration t before this time point1In period
All alarms, if the alarm source occurs in the period alerts and distribute work order, this alarm is ignored, and otherwise distributes to this alarm
Work order.
Embodiment 2
A kind of processing unit of alarm is additionally provided in the present embodiment, and the device is for realizing above-described embodiment and preferably
Embodiment, the descriptions that have already been made will not be repeated.As used below, predetermined function may be implemented in term " module "
The combination of software and/or hardware.Although device described in following embodiment is preferably realized with software, hardware, or
The realization of the combination of person's software and hardware is also that may and be contemplated.
Fig. 4 is the structural schematic diagram of the processing unit of alarm according to an embodiment of the invention, as shown in figure 4, the dress
Setting includes: to form module 42, will be in alarm log for the attribute information based on dependence and alarm between alarm
Alarm record forms alarm tree in the form of path；Determining module 44 is coupled with formation module 42 and is linked, for preset
It in multiple sliding window durations, obtains path overlapping possibility in alarm tree and meets multiple paths of preset condition, and by multiple roads
Diameter is determined as the associated path with incidence relation between path；Processing module 46 is coupled with determining module 44 and is linked, for that will close
The earliest alarm of time-sequencing is determined as the alarm source of associated path in connection path, and carries out work to the alarm for being determined as alarm source
Singly distribute processing operation.
Optionally, which includes: to establish unit, is used to indicate announcement for the region affiliation foundation according to alarm
The level Four district dictionary in alert place, and the four networks word for alerting network element is used to indicate according to the network element Level building of alarm
Allusion quotation；Form unit, link with establishing unit and couple, for will alert the alarm coding in recording, alarm type, alert title,
Alarm description, alarm time and level Four district dictionary and four networks dictionary are formed as the node in path to be made of multiple paths
Alarm tree.
Optionally, in the case where preset multiple sliding windows are two, which includes: acquiring unit,
For in preset two sliding windows, obtaining the overlapping number in any two path in alarm tree；First determination unit, with
Acquiring unit coupling link, for determining overlapping possibility by predetermined manner based on overlapping number；Second determination unit, with first
Determination unit coupling link, in the case where overlapping possibility meets preset condition, any two path to be determined as path
Between with incidence relation associated path.
Optionally, which includes: third determination unit, for determining the hair in the alarm for being determined as alarm source
Whether the preset time period before the raw moment generated alarm work order；First execution unit, for the case where generating work order
Under, ignore the operation for executing and distributing work order；Second execution unit, in the case where not generating work order, to being determined as accusing
The alarm in alert source executes the operation for distributing work order；Third execution unit, the alarm earliest for the time-sequencing in associated path
There is no in the case where alarm source, the operation for distributing work order is executed to alarm.
Fig. 5 is the optional structure diagram of the processing unit of alarm according to an embodiment of the present invention, as shown in figure 5, this reality
The device for applying example can also include: the second acquisition module 52, couple and link with formation module 42, be based on alarm forming module 42
Between dependence and alarm attribute information by alarm log alarm record in the form of path formed alert
After tree, for obtaining the completely duplicate path in path in alarm tree；Duplicate removal unit 54 obtains 52 coupled chain of module with second
It connects, couples and link with the second acquisition module, for carrying out duplicate removal processing to completely duplicate path.
In addition, the processing method in conjunction with the alarm of Fig. 1 embodiment of the present invention stated can be by the processing equipment that alerts Lai real
It is existing.Fig. 6 is the hardware structural diagram of the processing equipment of the alarm provided according to embodiments of the present invention.
The processing equipment of alarm may include processor 601 and the memory 602 for being stored with computer program instructions.
Specifically, above-mentioned processor 601 may include central processing unit (CPU) or specific integrated circuit
(Application Specific Integrated Circuit, ASIC), or may be configured to implement implementation of the present invention
One or more integrated circuits of example.
Memory 602 may include the mass storage for data or instruction.For example it rather than limits, memory
602 may include hard disk drive (Hard Disk Drive, HDD), floppy disk drive, flash memory, CD, magneto-optic disk, tape or logical
With the combination of universal serial bus (Universal Serial Bus, USB) driver or two or more the above.It is closing
In the case where suitable, memory 602 may include the medium of removable or non-removable (or fixed).In a suitable case, it stores
Device 602 can be inside or outside data processing equipment.In a particular embodiment, memory 602 is nonvolatile solid state storage
Device.In a particular embodiment, memory 602 includes read-only memory (ROM).In a suitable case, which can be mask
ROM, programming ROM (PROM), erasable PROM (EPROM), the electric erasable PROM (EEPROM), electrically-alterable ROM of programming
(EAROM) or the combination of flash memory or two or more the above.
Processor 601 is by reading and executing the computer program instructions stored in memory 602, to realize above-mentioned implementation
The processing method of any one alarm in example.
In one example, the processing equipment of alarm may also include communication interface 603 and bus 610.Wherein, such as Fig. 6 institute
Show, processor 601, memory 602, communication interface 603 connect by bus 610 and complete mutual communication.
Communication interface 603 is mainly used for realizing in the embodiment of the present invention between each module, device, unit and/or equipment
Communication.
Bus 610 includes hardware, software or both, and the component of the processing equipment of alarm is coupled to each other together.Citing
For rather than limit, bus may include accelerated graphics port (AGP) or other graphics bus, enhancing Industry Standard Architecture (EISA)
Bus, front side bus (FSB), super transmission (HT) interconnection, the interconnection of Industry Standard Architecture (ISA) bus, infinite bandwidth, low pin count
(LPC) bus, memory bus, micro- channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express
(PCI-X) bus, Serial Advanced Technology Attachment (SATA) bus, Video Electronics Standards Association part (VLB) bus or other conjunctions
The combination of suitable bus or two or more the above.In a suitable case, bus 610 may include one or more
Bus.Although specific bus has been described and illustrated in the embodiment of the present invention, the present invention considers any suitable bus or interconnection.
In addition, in conjunction with the processing method of the alarm in above-described embodiment, the embodiment of the present invention can provide a kind of computer can
Storage medium is read to realize.Computer program instructions are stored on the computer readable storage medium；The computer program instructions
The processing method of any one alarm in above-described embodiment is realized when being executed by processor.
It should be clear that the invention is not limited to specific configuration described above and shown in figure and processing.
For brevity, it is omitted here the detailed description to known method.In the above-described embodiments, several tools have been described and illustrated
The step of body, is as example.But method process of the invention is not limited to described and illustrated specific steps, this field
Technical staff can be variously modified, modification and addition after understanding spirit of the invention, or suitable between changing the step
Sequence.
Functional block shown in structures described above block diagram can be implemented as hardware, software, firmware or their group
It closes.When realizing in hardware, it may, for example, be electronic circuit, specific integrated circuit (ASIC), firmware appropriate, insert
Part, function card etc..When being realized with software mode, element of the invention is used to execute program or the generation of required task
Code section.Perhaps code segment can store in machine readable media program or the data-signal by carrying in carrier wave is passing
Defeated medium or communication links are sent." machine readable media " may include any medium for capableing of storage or transmission information.
The example of machine readable media includes electronic circuit, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), soft
Disk, CD-ROM, CD, hard disk, fiber medium, radio frequency (RF) link, etc..Code segment can be via such as internet, inline
The computer network of net etc. is downloaded.
It should also be noted that, the exemplary embodiment referred in the present invention, is retouched based on a series of step or device
State certain methods or system.But the present invention is not limited to the sequence of above-mentioned steps, that is to say, that can be according in embodiment
The sequence referred to executes step, may also be distinct from that the sequence in embodiment or several steps are performed simultaneously.
The above description is merely a specific embodiment, it is apparent to those skilled in the art that,
For convenience of description and succinctly, the system, module of foregoing description and the specific work process of unit can refer to preceding method
Corresponding process in embodiment, details are not described herein.It should be understood that scope of protection of the present invention is not limited thereto, it is any to be familiar with
Those skilled in the art in the technical scope disclosed by the present invention, can readily occur in various equivalent modifications or substitutions,
These modifications or substitutions should be covered by the protection scope of the present invention.
Claims (9)
1. a kind of processing method of alarm, which is characterized in that the described method includes:
Attribute information based on dependence and alarm between alarm records the alarm in alarm log with the shape in path
Formula forms alarm tree；
In preset multiple sliding window durations, obtains path overlapping possibility in the alarm tree and meet the multiple of preset condition
Path, and the multiple path is determined as to the associated path between path with incidence relation；
The earliest alarm of time-sequencing in the associated path is determined as to the alarm source of the associated path, and to being determined as accusing
The alarm in alert source carries out work order and distributes processing operation.
2. the method according to claim 1, wherein the dependence and alarm based between alarm
Attribute information sets the formation alarm in the form of path of the alarm record in alarm log
The level Four administrative division dictionary for being used to indicate alarm place, and the net according to alarm are established according to the region affiliation of alarm
Meta level establishes the four networks dictionary for being used to indicate alarm network element；
By alarm coding, alarm type, alarm title, alarm description, alarm time and the level Four in the alarm record
The alarm tree that administrative division dictionary and the four networks dictionary are made of as the node formation in path multiple paths.
3. the method according to claim 1, wherein the situation for being two in preset multiple sliding windows
Under, in preset two sliding window durations, obtains path overlapping possibility in the alarm tree and meet the multiple of preset condition
Path, and include: by the associated path that the multiple path is determined as between path with incidence relation
In preset two sliding windows, the overlapping number in any two path in the alarm tree is obtained；
The overlapping possibility is determined by predetermined manner based on the overlapping number；
In the case where the overlapping possibility meets preset condition, any two path is determined as to have association between path
The associated path of relationship.
4. the method according to claim 1, wherein the described pair of alarm for being determined as alarm source carries out work order and distributes
Processing operation includes:
Determine whether the preset time period before the generation moment of the alarm for being determined as alarm source generated alarm work order；
In the case where generating work order, ignore the operation for executing and distributing work order；
In the case where not generating work order, the operation for distributing work order is executed to the alarm for being determined as alarm source.
5. method according to claim 1 or 4, which is characterized in that the method also includes:
In the case that alarm source is not present in the earliest alarm of time-sequencing in the associated path, alarm execution is distributed
The operation of work order.
6. method according to any one of claims 1 to 4, which is characterized in that based on the dependence between alarm with
And the attribute information alerted alerts the formation in the form of path of the alarm record in alarm log after setting, the method is also
Include:
Obtain the completely duplicate path in path in the alarm tree；
Duplicate removal processing is carried out to completely duplicate path.
7. a kind of processing unit of alarm, which is characterized in that described device includes:
Module is formed, remembers the alarm in alarm log for the attribute information based on dependence and alarm between alarm
Record forms alarm tree in the form of path；
Determining module meets in preset multiple sliding window durations, obtaining path overlapping possibility in the alarm tree
Multiple paths of preset condition, and the multiple path is determined as to the associated path between path with incidence relation；
Processing module, for the earliest alarm of time-sequencing in the associated path to be determined as to the alarm of the associated path
Source, and work order is carried out to the alarm for being determined as alarm source and distributes processing operation.
8. a kind of processing equipment of alarm characterized by comprising at least one processor, at least one processor and deposit
The computer program instructions of storage in the memory, are realized such as when the computer program instructions are executed by the processor
Method of any of claims 1-6.
9. a kind of computer readable storage medium, is stored thereon with computer program instructions, which is characterized in that when the computer
Such as method of any of claims 1-6 is realized when program instruction is executed by processor.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711384399.8A CN109951306B (en) | 2017-12-20 | 2017-12-20 | Alarm processing method, device, equipment and medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711384399.8A CN109951306B (en) | 2017-12-20 | 2017-12-20 | Alarm processing method, device, equipment and medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109951306A true CN109951306A (en) | 2019-06-28 |
| CN109951306B CN109951306B (en) | 2022-04-01 |
Family
ID=67005700
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201711384399.8A Active CN109951306B (en) | 2017-12-20 | 2017-12-20 | Alarm processing method, device, equipment and medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109951306B (en) |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111162945A (en) * | 2019-12-30 | 2020-05-15 | 中国移动通信集团江苏有限公司 | Method, device, equipment and storage medium for determining alarm association relationship |
| CN111193627A (en) * | 2019-12-31 | 2020-05-22 | 中国移动通信集团江苏有限公司 | Information processing method, device, equipment and storage medium |
| CN112583644A (en) * | 2020-12-14 | 2021-03-30 | 华为技术有限公司 | Alarm processing method, device, equipment and readable storage medium |
| CN113839802A (en) * | 2020-06-24 | 2021-12-24 | 中兴通讯股份有限公司 | Tree model construction method, device, equipment and storage medium |
| CN114513398A (en) * | 2020-10-27 | 2022-05-17 | 北京华为数字技术有限公司 | Network equipment alarm processing method, device, equipment and storage medium |
| CN116526415A (en) * | 2023-06-26 | 2023-08-01 | 国网山东省电力公司禹城市供电公司 | Power equipment protection device and control method thereof |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7945817B1 (en) * | 2004-04-30 | 2011-05-17 | Sprint Communications Company L.P. | Method and system for automatically recognizing alarm patterns in a communications network |
| CN102291247A (en) * | 2010-06-18 | 2011-12-21 | 中兴通讯股份有限公司 | Alarm association diagram generation method and device and association alarm determination method and device |
| CN103945422A (en) * | 2013-01-22 | 2014-07-23 | 中国移动通信集团山东有限公司 | Method and equipment for controlling work order |
| CN106034051A (en) * | 2015-03-12 | 2016-10-19 | 腾讯科技（深圳）有限公司 | Network monitoring data processing method and network monitoring data processing device |
| CN106656590A (en) * | 2016-12-14 | 2017-05-10 | 北京亿阳信通科技有限公司 | Method and device for processing network equipment alarm message storm |
-
2017
- 2017-12-20 CN CN201711384399.8A patent/CN109951306B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7945817B1 (en) * | 2004-04-30 | 2011-05-17 | Sprint Communications Company L.P. | Method and system for automatically recognizing alarm patterns in a communications network |
| CN102291247A (en) * | 2010-06-18 | 2011-12-21 | 中兴通讯股份有限公司 | Alarm association diagram generation method and device and association alarm determination method and device |
| CN103945422A (en) * | 2013-01-22 | 2014-07-23 | 中国移动通信集团山东有限公司 | Method and equipment for controlling work order |
| CN106034051A (en) * | 2015-03-12 | 2016-10-19 | 腾讯科技（深圳）有限公司 | Network monitoring data processing method and network monitoring data processing device |
| CN106656590A (en) * | 2016-12-14 | 2017-05-10 | 北京亿阳信通科技有限公司 | Method and device for processing network equipment alarm message storm |
Non-Patent Citations (2)
| Title |
|---|
| 刘威歆等: "基于攻击图的多源告警关联分析方法", 《通信学报》 * |
| 王茂行: "光传输网告警相关性分析及处理规则", 《信息通信》 * |
Cited By (13)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111162945B (en) * | 2019-12-30 | 2022-08-12 | 中国移动通信集团江苏有限公司 | Method, device, equipment and storage medium for determining alarm association relationship |
| CN111162945A (en) * | 2019-12-30 | 2020-05-15 | 中国移动通信集团江苏有限公司 | Method, device, equipment and storage medium for determining alarm association relationship |
| CN111193627A (en) * | 2019-12-31 | 2020-05-22 | 中国移动通信集团江苏有限公司 | Information processing method, device, equipment and storage medium |
| CN111193627B (en) * | 2019-12-31 | 2022-08-12 | 中国移动通信集团江苏有限公司 | Information processing method, device, equipment and storage medium |
| CN113839802A (en) * | 2020-06-24 | 2021-12-24 | 中兴通讯股份有限公司 | Tree model construction method, device, equipment and storage medium |
| WO2021259273A1 (en) * | 2020-06-24 | 2021-12-30 | 中兴通讯股份有限公司 | Tree model construction method, apparatus and device, and storage medium |
| CN114513398B (en) * | 2020-10-27 | 2023-12-15 | 北京华为数字技术有限公司 | Network equipment alarm processing method, device, equipment and storage medium |
| CN114513398A (en) * | 2020-10-27 | 2022-05-17 | 北京华为数字技术有限公司 | Network equipment alarm processing method, device, equipment and storage medium |
| WO2022127435A1 (en) * | 2020-12-14 | 2022-06-23 | 华为技术有限公司 | Alarm processing method and apparatus, device, and readable storage medium |
| CN112583644B (en) * | 2020-12-14 | 2022-10-18 | 华为技术有限公司 | Alarm processing method, device, equipment and readable storage medium |
| CN112583644A (en) * | 2020-12-14 | 2021-03-30 | 华为技术有限公司 | Alarm processing method, device, equipment and readable storage medium |
| CN116526415A (en) * | 2023-06-26 | 2023-08-01 | 国网山东省电力公司禹城市供电公司 | Power equipment protection device and control method thereof |
| CN116526415B (en) * | 2023-06-26 | 2023-09-19 | 国网山东省电力公司禹城市供电公司 | Power equipment protection device and control method thereof |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109951306B (en) | 2022-04-01 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109951306A (en) | Processing method, device, equipment and the medium of alarm | |
| CN110210227B (en) | Risk detection method, device, equipment and storage medium | |
| Kas et al. | Incremental algorithm for updating betweenness centrality in dynamically growing networks | |
| CN106375339B (en) | Attack mode detection method based on event sliding window | |
| JP2018507464A (en) | Transaction risk detection method and apparatus | |
| CN111199474A (en) | Risk prediction method and device based on network diagram data of two parties and electronic equipment | |
| CN109447658A (en) | The generation of anti-fraud model and application method, device, equipment and storage medium | |
| CN111209317A (en) | Knowledge graph abnormal community detection method and device | |
| CN111090681A (en) | Group mining method, device, equipment and storage medium | |
| US20130211873A1 (en) | Determining a churn risk | |
| CN105912588A (en) | Visualization processing method and system for big data based on memory calculations | |
| CN106878038A (en) | Fault Locating Method and device in a kind of communication network | |
| CN109993390A (en) | Alarm association and worksheet processing optimization method, device, equipment and medium | |
| CN113220907A (en) | Business knowledge graph construction method and device, medium and electronic equipment | |
| CN102982048A (en) | Method and device for assessing junk information mining rule | |
| CN114782159A (en) | Illegal financial activity detection method, system, electronic device and medium | |
| CN109993391A (en) | Distributing method, device, equipment and the medium of network O&M task work order | |
| CN106776902A (en) | The analysis method and device of path locus | |
| CN112925899B (en) | Ordering model establishment method, case clue recommendation method, device and medium | |
| CN104035985B (en) | A kind of method for digging towards Fundamental Geographic Information System abnormal data | |
| Candelieri et al. | Supporting resilience management of water distribution networks through network analysis and hydraulic simulation | |
| CN111162945B (en) | Method, device, equipment and storage medium for determining alarm association relationship | |
| Canastro et al. | Root cause analysis in 5g/6g networks | |
| Castiñeira et al. | A new approach for fast evaluations of large portfolios of oil and gas fields | |
| CN114240179A (en) | Financial process mining method based on event map and related device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |