CN109951306B - Alarm processing method, device, equipment and medium - Google Patents
Alarm processing method, device, equipment and medium Download PDFInfo
- Publication number
- CN109951306B CN109951306B CN201711384399.8A CN201711384399A CN109951306B CN 109951306 B CN109951306 B CN 109951306B CN 201711384399 A CN201711384399 A CN 201711384399A CN 109951306 B CN109951306 B CN 109951306B
- Authority
- CN
- China
- Prior art keywords
- alarm
- paths
- path
- alarms
- tree
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Landscapes
- Alarm Systems (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention provides a method, a device, equipment and a medium for processing an alarm, wherein the method for processing the alarm comprises the following steps: forming an alarm tree of alarm records in the alarm log in a path form based on the dependency relationship between the alarms and the attribute information of the alarms; acquiring a plurality of paths of which the path overlapping probability in the alarm tree meets a preset condition within a preset time length of a plurality of sliding windows, and determining the paths as associated paths with an association relationship among the paths; and determining the alarm with the earliest time sequence in the associated paths as the alarm source of the associated paths, and performing work order distribution processing operation on the alarm determined as the alarm source. The invention solves the problem that the excavated alarm association relation in the related technology can not make an explanation and reasoning basis, so that the summary judgment has no quantitative standard.
Description
Technical Field
The present invention relates to the field of communications technologies, and in particular, to a method, an apparatus, a device, and a medium for processing an alarm.
Background
In current communication network management, devices and systems generate massive alarm information every day and perform centralized summarization. The alarm information covers the aspects of equipment failure, network hidden danger, user perception, complaint early warning and the like. Meanwhile, with the rapid development of the communication network, the interconnection of the communication network, the fusion of various standards, the integration of services, the diversification of equipment systems and other factors, the structure of the mobile network becomes more and more complex, and the generated alarm information has numerous sources, so that huge workload is brought to the work of maintaining and eliminating the faults of the network. Meanwhile, the massive alarm information also cannot completely realize the unification of alarm coding and description due to the complexity, which brings some obstacles to alarm analysis. Aiming at the characteristics of a mobile communication network, it can be expected that network faults mostly have a linkage effect, the generated alarm information has implicit relevance, the relevance cannot be fully extracted by the existing mining means, the workload of network maintenance can be reduced if the accuracy and the efficiency of mining can be improved, and the waste of repeated alarm dispatching is avoided. The existing technical scheme is rare and has defects in improving the dispatching efficiency aiming at the alarm association rule mining.
The method comprises the steps of establishing a training sample set according to a service expert, adopting a training method of the neural network to establish a model of the neural network, storing the model in a neural network model library, and calling a corresponding neural network model by adopting a module of an intelligent alarm filter during application and analysis to calculate an association relation. However, the method adopts a neural network data mining algorithm, so that the mining capability of the association rule is more prominent, but the mined association relation has no capability of making explanation and reasoning basis, the summary evaluation of the association relation has no quantitative standard, many influencing factors cannot be eliminated, and the accuracy is difficult to guarantee.
In view of the above problems in the related art, no effective solution exists at present.
Disclosure of Invention
The embodiment of the invention provides a method, a device, equipment and a medium for processing an alarm, which solve the problem that the association relation of the excavated alarm in the related technology cannot make an explanation and reasoning basis, so that the conclusion judgment has no quantitative standard.
In a first aspect, an embodiment of the present invention provides a method for processing an alarm, where the method includes: forming an alarm tree of alarm records in the alarm log in a path form based on the dependency relationship between the alarms and the attribute information of the alarms; acquiring a plurality of paths of which the path overlapping probability meets a preset condition in the alarm tree within a preset time length of a plurality of sliding windows, and determining the paths as associated paths with an association relationship among the paths; and determining the alarm with the earliest time sequence in the associated path as the alarm source of the associated path, and performing work order distribution processing operation on the alarm determined as the alarm source.
In a second aspect, an embodiment of the present invention provides an apparatus for processing an alarm, where the apparatus includes: the forming module is used for forming an alarm tree of the alarm records in the alarm log in a path form based on the dependency relationship among the alarms and the attribute information of the alarms; the determining module is used for acquiring a plurality of paths of which the path overlapping probability meets a preset condition in the alarm tree within a plurality of preset sliding window durations, and determining the paths as associated paths with associated relations among the paths; and the processing module is used for determining the alarm with the earliest time sequence in the associated path as the alarm source of the associated path and performing work order distribution processing operation on the alarm determined as the alarm source.
In a third aspect, an embodiment of the present invention provides an apparatus for processing an alarm, including: at least one processor, at least one memory, and computer program instructions stored in the memory, which when executed by the processor, implement the method of the first aspect of the embodiments described above.
In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, on which computer program instructions are stored, which, when executed by a processor, implement the method of the first aspect in the foregoing embodiments.
The alarm processing method, the alarm processing device, the alarm processing equipment and the alarm processing medium provided by the embodiment of the invention form an alarm tree in a path form for alarm records in an alarm log based on the dependency relationship among alarms and the attribute information of the alarms, acquire a plurality of paths of which the path overlapping probability meets the preset condition in a plurality of preset sliding window durations, and determine the plurality of paths as associated paths with the associated relationship among the paths, thereby determining the alarm with the earliest time sequence in the associated paths as the alarm source of the associated paths, and performing work order dispatching processing operation on the alarm determined as the alarm source, that is, all the attribute characteristics of the associated relationship provide a quantitative basis for judging the reliability of the associated relationship by the above mode of the embodiment, finally realizing the improvement of the dispatching efficiency of the work order, solving the problem that the alarm associated relationship excavated in the related technology cannot be interpreted and inferred, leading to the problem that the summary judgment has no quantification standard.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required to be used in the embodiments of the present invention will be briefly described below, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.
FIG. 1 is a flow diagram of a method of processing an alert according to one embodiment of the invention;
FIG. 2 is a diagram of an alarm tree structure according to one embodiment of the present invention;
FIG. 3 is a schematic diagram of an alert source setup according to one embodiment of the present invention;
FIG. 4 is a schematic diagram of an apparatus for processing alarms according to one embodiment of the present invention;
FIG. 5 is a schematic diagram of an alternative configuration of an alert processing apparatus according to one embodiment of the present invention;
fig. 6 is a hardware configuration diagram of an alarm processing device according to an embodiment of the present invention.
Detailed Description
Features and exemplary embodiments of various aspects of the present invention will be described in detail below, and in order to make objects, technical solutions and advantages of the present invention more apparent, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not to be construed as limiting the invention. It will be apparent to one skilled in the art that the present invention may be practiced without some of these specific details. The following description of the embodiments is merely intended to provide a better understanding of the present invention by illustrating examples of the present invention.
It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.
The present invention will be described in detail with reference to examples thereof;
example 1
Fig. 1 is a flowchart of an alarm processing method according to an embodiment of the present invention, and as shown in fig. 1, the method includes the steps of:
step S102: forming an alarm tree of alarm records in the alarm log in a path form based on the dependency relationship between the alarms and the attribute information of the alarms;
step S104: acquiring a plurality of paths of which the path overlapping probability in the alarm tree meets a preset condition within a preset time length of a plurality of sliding windows, and determining the paths as associated paths with an association relationship among the paths;
step S106: and determining the alarm with the earliest time sequence in the associated paths as the alarm source of the associated paths, and performing work order distribution processing operation on the alarm determined as the alarm source.
Through the above steps S102 to S106, a warning tree is formed in the form of paths of the warning records in the warning log based on the dependency relationship between the warnings and the attribute information of the warnings, and multiple paths in which the path overlapping probability in the warning tree meets the preset condition are obtained within the preset duration of multiple sliding windows, and the multiple paths are determined as associated paths having an association relationship between the paths, so that the warning with the earliest time sequence in the associated paths can be determined as the warning source of the associated paths, and the work order distribution processing operation is performed on the warning determined as the warning source, that is, through the above manner of this embodiment, all the attribute features of the association relationship give a basis for quantitatively judging the reliability of the association relationship, thereby finally realizing the improvement of the work order distribution efficiency, and solving the problem that the warning association relationship excavated in the related art cannot be interpreted and inferred, leading to the problem that the summary judgment has no quantification standard.
In an optional implementation manner of this embodiment, the manner for forming the alarm tree in the form of a path of the alarm records in the alarm log based on the dependency relationship between the alarms and the attribute information of the alarms, which is referred to in step 102 in this embodiment, may be:
step 102-1: establishing a four-level administrative division dictionary for indicating an alarm place according to the region attribution of the alarm, and establishing a four-level network dictionary for indicating an alarm network element according to the network element level of the alarm;
step 102-2: and forming an alarm tree consisting of a plurality of paths by taking the alarm codes, the alarm types, the alarm titles, the alarm descriptions and the alarm time in the alarm records and taking the four-level administrative division dictionary and the four-level network dictionary as the nodes of the paths.
For the above step S102-1 and step S102-2, in a specific application scenario in this embodiment, the following may be performed: analyzing the alarm log based on the alarm code CiAlarm processing team AiAnd alarm network element EiEstablishing a basic network topology library and an alarm path L by using the regional attribution dictionary and the network element level dictionaryi. Wherein, the steps of this mode can include:
step S11: a four-level prefecture dictionary is built according to regional affiliation, as shown in table 1.
TABLE 1
It should be noted that, for the subsequent path operation to be simpler, it is not only necessary to ensure that the overall code is unique, but also each level of code is unique.
Step S12: establishing a four-level network dictionary according to the network element hierarchy, as shown in table 2:
TABLE 2
Step S13: and acquiring the prefix grade of the alarm code by adopting a maximum matching method, such as AAAA-BBBB-CCCC, wherein the prefixes of the secondary alarm codes are Pre0 ═ AAAA and Pre1 ═ BBBB respectively.
Step S14: traversing based on the alarm records and the coding rules to form an alarm tree, such as an alarm coding dictionary table shown in table 3.
| Alarm point | Alarm network element | Type of alarm | Warning title | Alarm description | Alarm coding | Time of alarm |
| Flood mountain area | eNode-B | Fault of moving ring | DH0000 | DH0000 | 000010 |
TABLE 3
Based on the steps S11 to S14, an alarm tree is formed in the present embodiment, fig. 2 is a schematic diagram of an alarm tree structure according to the embodiment of the present invention, and as shown in fig. 2, the path Li of the alarm in the steps S1 to S4 represents a 10-001-005-B01-001-003-.
After forming the alarm tree in the form of a path for the alarm records in the alarm log based on the dependency relationship between the alarms and the attribute information of the alarms in step S102 in this embodiment, the method of this embodiment may further include:
step S108: acquiring a path with completely repeated paths in the alarm tree;
step S110: and carrying out deduplication processing on the completely repeated paths.
Based on the manner of the step S102 in the specific application scenario, the steps S108 and S110 in the specific application scenario may be: obtaining all paths of the alarm log, removing the repeated paths to form a path set L, and calculating the path L of the path setiThe distribution probability of (2); the method comprises the following specific steps:
step S21: according to the mode of the step S102 in the specific application scene, generating an alarm path L for each record of the alarm logiAnd consolidated into an alarm path set L, where L ═ L1，L2...Li...Lm}。
Step S22: removing repeated paths in the alarm path set L by adopting an array deduplication method to obtain a path set L ', wherein the repeated paths refer to the identical nodes of the two paths and the identical sequence of the nodes in the paths, and L' { L ═ L1，L2...Li...Ln}。
As known from the naming rule of the path, the same alarm attribution, the same network element attribution level, and the same alarm coding level can be regarded as the same alarm having a common path.
Step S23: traversing the set of paths L', for the paths L in the set of paths LiCounting the number of records for converting the path tree into L' in the alarm log, and recording as NiCalculating a path LiThe calculation formula of the distribution probability of (2) is:
step S24: and setting a minimum distribution probability p, deleting paths with the distribution probability lower than the minimum distribution probability from the path set L 'so as to filter out small probability events in the alarm, avoid abnormal results generated in the subsequent incidence relation mining, and finally obtain the path set L'.
In another optional implementation manner of this embodiment, when two preset sliding windows are preferred in this embodiment, the manner of obtaining multiple paths in the alarm tree, where the path overlapping probability satisfies the preset condition, and determining the multiple paths as associated paths having an association relationship between the paths in step S104 in this embodiment may be:
step S104-1: acquiring the overlapping times of any two paths in the alarm tree in two preset sliding windows;
step S104-2: determining the overlapping probability in a preset mode based on the overlapping times;
step S104-3: and under the condition that the overlapping probability meets a preset condition, determining any two paths as associated paths with an associated relationship between the paths.
As for the manner in the above step S104-1 to step S104-3, in a specific application scenario of the present embodiment, the following may be performed: setting a sliding window duration to t1And t2And calculating the overlapping probability of the alarm path in the sliding window, which comprises the following steps:
step S31: setting a sliding window duration to t1And t2Traversing the path set L 'and obtaining any two paths L' thereofm、L″nIn a sliding time window t1And t2Number of lower overlaps, denoted as Wmn1、Wmn2The overlap being defined as path LmCorresponding alarm record occurrence time and path LnAnd recording the path overlapping times of the path set L' shown in the following table 4 when the time difference of the corresponding alarm record occurrence time is less than the time length of the sliding window:
TABLE 4
Step S32: path L ″)mAnd path L ″)nProbability of overlap occurring in sliding window t1And t2The following are calculated by the following formulas, respectively:
also, shown in table 5 below is a path set L ″ path overlap probability table:
TABLE 5
And analyzing incidence relation among the paths according to the overlapping probability of the paths, wherein the mode of traversing the path set to obtain the warning source is as follows:
step S41: according to the duration t in the sliding window1And t2Analyzing the incidence relation among the paths by the probability of overlapping among the paths, wherein the judgment formula of the incidence relation is as follows:
if q ismn1、qmn2Satisfies the above formula route LmAnd L ″)nHave an associative relationship.
Step S42: the alarms corresponding to the paths with the incidence relation have the same alarm source, the paths with the incidence relation are traversed, and the alarm record with the first bit of time sequence is used as the alarm source of the incidence relation. Fig. 3 is a schematic diagram of the establishment of a warning source according to an embodiment of the present invention, as shown in fig. 3.
Further, as for the manner of performing the work order dispatch processing operation on the alarm determined as the alarm source in step S106 of the present embodiment, it may be:
step S106-1: determining whether an alarm work order is generated within a preset time period before the occurrence time of the alarm determined as the alarm source;
step S106-2: ignoring the operation of dispatching the work order under the condition of generating the work order;
step S106-3: and in the case that the work order is not generated, the operation of dispatching the work order is performed on the alarm determined as the alarm source.
Step S106-4: and under the condition that the alarm with the earliest time sequence in the associated path does not have an alarm source, the operation of dispatching the work order is carried out on the alarm.
For the manner in the above step S106-1 to step S106-4, in a specific application scenario, the following may be:
extracting the occurrence time of the alarm, backtracking and checking whether the alarm source of the alarm generates an alarm work order, skipping if the work order is generated, otherwise dispatching the work order, and specifically comprising the following steps:
step S51: and extracting the path of the alarm and inquiring an alarm source according to the incidence relation of the alarm.
Step S52: if there is no warning source, the work order is dispatched to the warning and the process is terminated, and if there is a warning source, the process goes to step S53.
Step S53: extracting the alarm occurrence time, traversing the sliding window duration t before the time point1And if all alarms in the time period occur to the alarm source alarm and dispatch the work order, the alarm is ignored, otherwise, the work order is dispatched to the alarm.
Example 2
In this embodiment, a device for processing an alarm is further provided, where the device is used to implement the foregoing embodiments and preferred embodiments, and details are not repeated for what has been described. As used below, the term "module" may be a combination of software and/or hardware that implements a predetermined function. Although the means described in the embodiments below are preferably implemented in software, an implementation in hardware, or a combination of software and hardware is also possible and contemplated.
Fig. 4 is a schematic structural diagram of an apparatus for processing an alarm according to an embodiment of the present invention, as shown in fig. 4, the apparatus includes: a forming module 42, configured to form an alarm tree in the form of a path for the alarm records in the alarm log based on the dependency relationship between the alarms and the attribute information of the alarms; a determining module 44, coupled to the forming module 42, configured to obtain multiple paths in the alarm tree, where the path overlapping probability meets a preset condition, within a preset duration of multiple sliding windows, and determine the multiple paths as associated paths having an association relationship among the paths; and the processing module 46 is coupled to the determining module 44 and configured to determine the alarm with the earliest time sequence in the associated path as the alarm source of the associated path, and perform work order dispatching processing operation on the alarm determined as the alarm source.
Optionally, the forming module 42 includes: the establishment unit is used for establishing a four-level district-county dictionary for indicating an alarm place according to the region attribution of the alarm and establishing a four-level network dictionary for indicating an alarm network element according to the network element hierarchy of the alarm; and the forming unit is coupled and linked with the establishing unit and is used for forming an alarm tree consisting of a plurality of paths by taking the alarm codes, the alarm types, the alarm titles, the alarm descriptions and the alarm time in the alarm records and the nodes of the four-level district-county dictionary and the four-level network dictionary as the paths.
Optionally, in a case where there are two sliding windows, the determining module 44 includes: the acquisition unit is used for acquiring the overlapping times of any two paths in the alarm tree in two preset sliding windows; the first determining unit is coupled and linked with the acquiring unit and used for determining the overlapping probability in a preset mode based on the overlapping times; and the second determining unit is coupled and linked with the first determining unit and used for determining any two paths as associated paths with an associated relationship between the paths under the condition that the overlapping probability meets a preset condition.
Optionally, the processing module 46 includes: a third determination unit for determining whether an alarm work order has been generated for a preset time period before the occurrence time of the alarm determined as the alarm source; the first execution unit is used for neglecting the operation of dispatching the work order under the condition that the work order is generated; the second execution unit is used for dispatching the work order for the alarm determined as the alarm source under the condition that the work order is not generated; and the third execution unit is used for executing the operation of dispatching the work order on the alarm under the condition that the alarm with the earliest time sequence in the associated path does not have an alarm source.
Fig. 5 is a schematic diagram of an alternative structure of an alarm processing apparatus according to an embodiment of the present invention, and as shown in fig. 5, the apparatus of this embodiment may further include: a second obtaining module 52, coupled to the forming module 42, for obtaining a path with a completely repeated path in the alarm tree after the forming module 42 forms the alarm tree in the form of a path for the alarm records in the alarm log based on the dependency relationship between the alarms and the attribute information of the alarms; and a deduplication unit 54, coupled to the second obtaining module 52, and coupled to the second obtaining module, for performing deduplication processing on the completely repeated path.
In addition, the method for processing an alarm according to the embodiment of the present invention described with reference to fig. 1 may be implemented by an alarm processing device. Fig. 6 is a schematic diagram of a hardware structure of an alarm processing device according to an embodiment of the present invention.
The processing device of the alert may comprise a processor 601 and a memory 602 storing computer program instructions.
Specifically, the processor 601 may include a Central Processing Unit (CPU), or an Application Specific Integrated Circuit (ASIC), or may be configured as one or more Integrated circuits implementing embodiments of the present invention.
The processor 601 may implement any one of the alarm processing methods in the above embodiments by reading and executing the computer program instructions stored in the memory 602.
In one example, the processing device of the alert may also include a communication interface 603 and a bus 610. As shown in fig. 6, the processor 601, the memory 602, and the communication interface 603 are connected via a bus 610 to complete communication therebetween.
The communication interface 603 is mainly used for implementing communication between modules, apparatuses, units and/or devices in the embodiments of the present invention.
The bus 610 includes hardware, software, or both to couple the elements of the processing device of the alarm to each other. By way of example, and not limitation, a bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hypertransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an infiniband interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a video electronics standards association local (VLB) bus, or other suitable bus or a combination of two or more of these. Bus 610 may include one or more buses, where appropriate. Although specific buses have been described and shown in the embodiments of the invention, any suitable buses or interconnects are contemplated by the invention.
In addition, in combination with the method for processing an alarm in the foregoing embodiments, embodiments of the present invention may provide a computer-readable storage medium to implement the method. The computer readable storage medium having stored thereon computer program instructions; the computer program instructions, when executed by a processor, implement the method of processing an alert of any of the above embodiments.
It is to be understood that the invention is not limited to the specific arrangements and instrumentality described above and shown in the drawings. A detailed description of known methods is omitted herein for the sake of brevity. In the above embodiments, several specific steps are described and shown as examples. However, the method processes of the present invention are not limited to the specific steps described and illustrated, and those skilled in the art can make various changes, modifications and additions or change the order between the steps after comprehending the spirit of the present invention.
The functional blocks shown in the above-described structural block diagrams may be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, it may be, for example, an electronic circuit, an Application Specific Integrated Circuit (ASIC), suitable firmware, plug-in, function card, or the like. When implemented in software, the elements of the invention are the programs or code segments used to perform the required tasks. The program or code segments may be stored in a machine-readable medium or transmitted by a data signal carried in a carrier wave over a transmission medium or a communication link. A "machine-readable medium" may include any medium that can store or transfer information. Examples of a machine-readable medium include electronic circuits, semiconductor memory devices, ROM, flash memory, Erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, Radio Frequency (RF) links, and so forth. The code segments may be downloaded via computer networks such as the internet, intranet, etc.
It should also be noted that the exemplary embodiments mentioned in this patent describe some methods or systems based on a series of steps or devices. However, the present invention is not limited to the order of the above-described steps, that is, the steps may be performed in the order mentioned in the embodiments, may be performed in an order different from the order in the embodiments, or may be performed simultaneously.
As described above, only the specific embodiments of the present invention are provided, and it can be clearly understood by those skilled in the art that, for convenience and brevity of description, the specific working processes of the system, the module and the unit described above may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again. It should be understood that the scope of the present invention is not limited thereto, and any person skilled in the art can easily conceive various equivalent modifications or substitutions within the technical scope of the present invention, and these modifications or substitutions should be covered within the scope of the present invention.
Claims (9)
1. A method for processing an alarm, the method comprising:
forming alarm trees by alarm records in the alarm logs in a path form based on the dependency relationship among the alarms and the attribute information of the alarms;
acquiring a plurality of paths of which the path overlapping probability meets a preset condition in the alarm tree within a preset time length of a plurality of sliding windows, and determining the paths as associated paths with an association relationship among the paths;
and determining the alarm with the earliest time sequence in the associated path as the alarm source of the associated path, and performing work order distribution processing operation on the alarm determined as the alarm source.
2. The method of claim 1, wherein the forming the alarm tree of the alarm records in the alarm log in the form of paths based on the dependencies between the alarms and the attribute information of the alarms comprises:
establishing a four-level administrative division dictionary for indicating an alarm place according to the region attribution of the alarm, and establishing a four-level network dictionary for indicating an alarm network element according to the network element level of the alarm;
and forming an alarm tree consisting of a plurality of paths by taking the alarm codes, the alarm types, the alarm titles, the alarm descriptions and the alarm time in the alarm records and the nodes of the four-level administrative division dictionary and the four-level network dictionary as paths.
3. The method according to claim 1, wherein when there are two of the preset plurality of sliding windows, within a preset duration of the two sliding windows, obtaining a plurality of paths in the alarm tree whose path overlapping probability satisfies a preset condition, and determining the plurality of paths as associated paths having an association relationship among the paths comprises:
acquiring the overlapping times of any two paths in the alarm tree in two preset sliding windows;
determining the overlapping probability in a preset mode based on the overlapping times;
and under the condition that the overlapping probability meets a preset condition, determining the two random paths as associated paths with an associated relationship between the paths.
4. The method of claim 1, wherein the performing work order dispatch processing operations on alarms determined to be alarm sources comprises:
determining whether an alarm work order is generated within a preset time period before the alarm occurrence time determined as the alarm source;
ignoring the operation of dispatching the work order under the condition of generating the work order;
and in the case that the work order is not generated, the operation of dispatching the work order is performed on the alarm determined as the alarm source.
5. The method of claim 1 or 4, further comprising:
and under the condition that the alarm with the earliest time sequence in the associated path does not have an alarm source, executing the operation of dispatching the work order on the alarm.
6. The method of any one of claims 1 to 4, wherein after forming the alarm tree of alarm records in the alarm log in the form of paths based on the dependencies between the alarms and the attribute information of the alarms, the method further comprises:
acquiring a path with completely repeated paths in the alarm tree;
and carrying out deduplication processing on the completely repeated paths.
7. An apparatus for processing an alert, the apparatus comprising:
the forming module is used for forming an alarm tree of the alarm records in the alarm log in a path form based on the dependency relationship among the alarms and the attribute information of the alarms;
the determining module is used for acquiring a plurality of paths of which the path overlapping probability meets a preset condition in the alarm tree within a plurality of preset sliding window durations, and determining the paths as associated paths with associated relations among the paths;
and the processing module is used for determining the alarm with the earliest time sequence in the associated path as the alarm source of the associated path and performing work order distribution processing operation on the alarm determined as the alarm source.
8. An apparatus for processing an alert, comprising: at least one processor, at least one memory, and computer program instructions stored in the memory that, when executed by the processor, implement the method of any of claims 1-6.
9. A computer-readable storage medium having computer program instructions stored thereon, which when executed by a processor implement the method of any one of claims 1-6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711384399.8A CN109951306B (en) | 2017-12-20 | 2017-12-20 | Alarm processing method, device, equipment and medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711384399.8A CN109951306B (en) | 2017-12-20 | 2017-12-20 | Alarm processing method, device, equipment and medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109951306A CN109951306A (en) | 2019-06-28 |
| CN109951306B true CN109951306B (en) | 2022-04-01 |
Family
ID=67005700
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201711384399.8A Active CN109951306B (en) | 2017-12-20 | 2017-12-20 | Alarm processing method, device, equipment and medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109951306B (en) |
Families Citing this family (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111162945B (en) * | 2019-12-30 | 2022-08-12 | 中国移动通信集团江苏有限公司 | Method, device, equipment and storage medium for determining alarm association relationship |
| CN111193627B (en) * | 2019-12-31 | 2022-08-12 | 中国移动通信集团江苏有限公司 | Information processing method, device, equipment and storage medium |
| CN113839802A (en) * | 2020-06-24 | 2021-12-24 | 中兴通讯股份有限公司 | Tree model construction method, device, equipment and storage medium |
| CN114513398B (en) * | 2020-10-27 | 2023-12-15 | 北京华为数字技术有限公司 | Network equipment alarm processing method, device, equipment and storage medium |
| CN112583644B (en) * | 2020-12-14 | 2022-10-18 | 华为技术有限公司 | Alarm processing method, device, equipment and readable storage medium |
| CN116526415B (en) * | 2023-06-26 | 2023-09-19 | 国网山东省电力公司禹城市供电公司 | Power equipment protection device and control method thereof |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7945817B1 (en) * | 2004-04-30 | 2011-05-17 | Sprint Communications Company L.P. | Method and system for automatically recognizing alarm patterns in a communications network |
| CN102291247A (en) * | 2010-06-18 | 2011-12-21 | 中兴通讯股份有限公司 | Alarm association diagram generation method and device and association alarm determination method and device |
| CN103945422A (en) * | 2013-01-22 | 2014-07-23 | 中国移动通信集团山东有限公司 | Method and equipment for controlling work order |
| CN106034051A (en) * | 2015-03-12 | 2016-10-19 | 腾讯科技（深圳）有限公司 | Network monitoring data processing method and network monitoring data processing device |
| CN106656590A (en) * | 2016-12-14 | 2017-05-10 | 北京亿阳信通科技有限公司 | Method and device for processing network equipment alarm message storm |
-
2017
- 2017-12-20 CN CN201711384399.8A patent/CN109951306B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7945817B1 (en) * | 2004-04-30 | 2011-05-17 | Sprint Communications Company L.P. | Method and system for automatically recognizing alarm patterns in a communications network |
| CN102291247A (en) * | 2010-06-18 | 2011-12-21 | 中兴通讯股份有限公司 | Alarm association diagram generation method and device and association alarm determination method and device |
| CN103945422A (en) * | 2013-01-22 | 2014-07-23 | 中国移动通信集团山东有限公司 | Method and equipment for controlling work order |
| CN106034051A (en) * | 2015-03-12 | 2016-10-19 | 腾讯科技（深圳）有限公司 | Network monitoring data processing method and network monitoring data processing device |
| CN106656590A (en) * | 2016-12-14 | 2017-05-10 | 北京亿阳信通科技有限公司 | Method and device for processing network equipment alarm message storm |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109951306A (en) | 2019-06-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109951306B (en) | Alarm processing method, device, equipment and medium | |
| CN108156037B (en) | Alarm correlation analysis method, device, equipment and medium | |
| CN111126824A (en) | Multi-index association model training method and multi-index anomaly analysis method | |
| CN110647446A (en) | Log fault association and prediction method, device, equipment and storage medium | |
| CN112769605B (en) | Heterogeneous multi-cloud operation and maintenance management method and hybrid cloud platform | |
| CN104518905A (en) | Fault locating method and fault locating device | |
| CN109992484B (en) | Network alarm correlation analysis method, device and medium | |
| CN111176953B (en) | Abnormality detection and model training method, computer equipment and storage medium | |
| CN109993390B (en) | Alarm association and order dispatching optimization method, device, equipment and medium | |
| CN104158682A (en) | Synchronous Digital Hierarchy (SDH) fault positioning method based on contribution degree | |
| CN111756560A (en) | Data processing method, device and storage medium | |
| CN111162945B (en) | Method, device, equipment and storage medium for determining alarm association relationship | |
| CN111489074A (en) | Data processing method, device, equipment and storage medium | |
| CN109064211B (en) | Marketing business data analysis method and device and server | |
| CN109936813A (en) | Recognition methods, device, equipment and the medium of high-speed railway user | |
| CN110582091B (en) | Method and apparatus for locating wireless quality problems | |
| CN107517474B (en) | Network analysis optimization method and device | |
| CN116506276A (en) | Mining method and system for relevance of alarm data | |
| CN110120893B (en) | Method and device for positioning network system security problem | |
| CN113032774B (en) | Training method, device and equipment of anomaly detection model and computer storage medium | |
| CN109557419B (en) | Power transmission line detection method | |
| CN114745256B (en) | Server alarm tracing method, device and storage medium | |
| CN114629785B (en) | Alarm position detection and prediction method, device, equipment and medium | |
| CN118400291B (en) | Communication information monitoring method and system | |
| CN112232444B (en) | Method, device, equipment and storage medium for determining geographic position data of object |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |