CN109993390B

CN109993390B - Alarm association and order dispatching optimization method, device, equipment and medium

Info

Publication number: CN109993390B
Application number: CN201711494844.6A
Authority: CN
Inventors: 廖振松; 王冼; 熊胜; 汤卫东; 杨晶蕾
Original assignee: China Mobile Communications Group Co Ltd; China Mobile Group Hubei Co Ltd
Current assignee: China Mobile Communications Group Co Ltd; China Mobile Group Hubei Co Ltd
Priority date: 2017-12-31
Filing date: 2017-12-31
Publication date: 2021-06-25
Anticipated expiration: 2037-12-31
Also published as: CN109993390A

Abstract

The embodiment of the invention provides an alarm association and dispatch optimization method, device, equipment and medium, wherein the alarm association and dispatch optimization method based on a dependency tree comprises the steps of generating a participle set Seg for alarm description, forming a path according to the probability of the occurrence of the Seg set Seg, and forming a probability hierarchical tree; forming an alarm simultaneous occurrence record set based on the sliding window t; constructing a frequency growth tree, namely an alarm dependency tree, and determining a frequent mode and a frequency dependency mode of each node on each path; constructing a node probability list and a path probability list; the invention can mine all attribute characteristics of each incidence relation of the alarm records, can provide a quantitative basis for judging the reliability of the incidence relation, and finally achieves the purpose of improving the work order dispatching efficiency.

Description

Alarm association and order dispatching optimization method, device, equipment and medium

Technical Field

The invention relates to the field of network performance alarm and big data association mining, in particular to an alarm association and dispatch optimization method based on a dependency tree, and particularly relates to an alarm association and dispatch optimization method, device, equipment and medium based on a dependency tree.

Background

Since the centralized construction of network management, the China Mobile generates massive alarm information for devices and systems every day, and centralizes the alarm information. The alarm information covers the aspects of equipment failure, network hidden danger, user perception, complaint early warning and the like. Meanwhile, with the rapid development of the communication network, the interconnection of the communication network, the fusion of various standards, the integration of services, the diversification of equipment systems and other factors, the structure of the mobile network becomes more and more complex, and the generated alarm information has numerous sources, so that huge workload is brought to the work of maintaining and eliminating the faults of the network. Meanwhile, the massive alarm information also cannot completely realize the unification of alarm coding and description due to the complexity, which brings some obstacles to alarm analysis.

Aiming at the characteristics of a mobile communication network, it can be expected that network faults mostly have a linkage effect, the generated alarm information has implicit relevance, the relevance cannot be fully extracted by the existing mining means, the workload of network maintenance can be reduced if the accuracy and the efficiency of mining can be improved, and the waste of repeated alarm dispatching is avoided. Therefore, the prior art has the technical problem of low dispatching efficiency.

Disclosure of Invention

The embodiment of the invention provides an alarm association and dispatching optimization method, device, equipment and medium, which provides all attribute characteristics covering mining association relation on one hand, and provides a quantitative basis for judging the reliability of association relation on the other hand, and finally achieves the purpose of improving the dispatching efficiency of work orders.

In a first aspect, an embodiment of the present invention provides a method for alarm association and dispatch optimization based on a dependency tree, including:

formatting and word segmentation are carried out on the alarm description, and a final word segmentation set Seg is generated;

forming paths according to the probability of the participles in the final participle set appearing in the alarm description, and combining the paths to form a probability hierarchical tree;

setting a sliding window t;

merging alarm events in the alarm records based on the sliding window t to form an alarm simultaneous occurrence record set;

calculating word segmentation word frequency in the alarm simultaneous occurrence record set, constructing a frequency growth tree, namely an alarm dependency tree, based on the probability hierarchical tree, and determining a final frequent mode;

determining a frequency-dependent mode of each node on each path in the frequent mode based on the final frequent mode and the frequency growth tree;

constructing a node probability list and a path probability list for the frequency dependence mode of each node on each path in the frequent mode;

and acquiring all alarms to be dispatched in a sliding window interval for the alarms to be dispatched in the alarm event to be dispatched, traversing the alarm dependency tree to form an alarm link by combining the node probability list and the path probability list, and dispatching the alarm based on the formed intersection level of each alarm link.

In a second aspect, an embodiment of the present invention provides a dependency tree-based alarm association and dispatch optimization apparatus, including:

the participle set generating module is used for formatting and participling the alarm description to generate a final participle set Seg;

a probability hierarchical tree generating module, configured to form paths according to probabilities of the participles in the final participle set appearing in the alarm description, and combine the paths to form a probability hierarchical tree;

the sliding window setting module is used for setting a sliding window t;

the alarm simultaneous occurrence record set generation module is used for merging the alarm events in the alarm records based on the sliding window t to form an alarm simultaneous occurrence record set;

the frequency growth tree and frequent pattern generation module is used for calculating word segmentation word frequency in the alarm simultaneous occurrence record set, constructing a frequency growth tree based on the probability hierarchical tree and determining a final frequent pattern;

a frequency-dependent pattern generation module, configured to determine a frequency-dependent pattern of each node on each path in the frequent pattern based on the final frequent pattern and the frequency growth tree;

a probability list generating module, configured to construct a node probability list for the frequency-dependent mode of each node on each path in the frequent mode, and construct a path probability list;

and the dispatching module is used for acquiring all the alarms to be dispatched in the sliding window interval for the alarms to be dispatched in the alarms to be dispatched, traversing the alarm dependent tree to form alarm links, and dispatching the alarm based on the formed intersection level of each alarm link.

The embodiment of the invention provides alarm association and dispatching optimization equipment based on a dependency tree, which comprises the following steps: at least one processor, at least one memory, and computer program instructions stored in the memory, which when executed by the processor, implement the method of the first aspect of the embodiments described above.

In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, on which computer program instructions are stored, which, when executed by a processor, implement the method of the first aspect in the foregoing embodiments.

The alarm association and dispatch optimization method, device, equipment and medium based on the dependency tree provided by the embodiment of the invention can be used for mining all attribute characteristics of each association relation of alarm records, providing a quantitative basis for judging the reliability of the association relation and finally achieving the purpose of improving the dispatch efficiency of the worksheet.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required to be used in the embodiments of the present invention will be briefly described below, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.

Fig. 1 is a flowchart illustrating an alarm association and dispatch optimization method based on a dependency tree according to an embodiment of the present invention.

FIG. 2 shows a schematic flow chart of step 1 in the embodiment shown in FIG. 1;

FIG. 3 shows a schematic flow chart of step 2 in the embodiment shown in FIG. 1;

FIG. 4 is a schematic diagram showing the structure of the probability hierarchy tree in the embodiment shown in FIG. 1;

FIG. 5 shows a schematic flow chart of step 4 in the embodiment shown in FIG. 1;

FIG. 6 shows a schematic flow chart of step 5 in the embodiment shown in FIG. 1;

FIG. 7 is a diagram illustrating the frequent item list LSeg and the frequency spanning tree in the embodiment of FIG. 6;

FIG. 8 shows a schematic flow chart of step 8 in the embodiment shown in FIG. 1;

FIG. 9 is a schematic structural diagram illustrating an alarm association and dispatch optimization apparatus based on a dependency tree according to an embodiment of the present invention;

fig. 10 is a schematic structural diagram of the participle set generating module 1001 in the embodiment shown in fig. 9;

FIG. 11 is a diagram illustrating the structure of the probability hierarchy tree generating module 1002 in the embodiment shown in FIG. 9;

FIG. 12 is a diagram illustrating the structure of the alarm concurrency record set generation module 1004 in the embodiment of FIG. 9;

FIG. 13 is a schematic structural diagram of the frequency growth tree and frequent pattern generation module 1005 in the embodiment shown in FIG. 9;

FIG. 14 is a block diagram of the dispatch module 1008 in the embodiment of FIG. 9;

FIG. 15 is a diagram illustrating a hardware structure of a dependency tree-based alarm association and dispatch optimization device according to an embodiment of the present invention;

Detailed Description

Features and exemplary embodiments of various aspects of the present invention will be described in detail below, and in order to make objects, technical solutions and advantages of the present invention more apparent, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not to be construed as limiting the invention. It will be apparent to one skilled in the art that the present invention may be practiced without some of these specific details. The following description of the embodiments is merely intended to provide a better understanding of the present invention by illustrating examples of the present invention.

It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.

The embodiment of the invention provides an alarm association and dispatch optimization method based on a dependency tree, and FIG. 1 is a flow chart of the alarm association and dispatch optimization method based on the dependency tree, as shown in FIG. 1, comprising the following steps,

step 1: and formatting and segmenting the alarm description to generate a final segmentation set Seg.

In view of the numerous formats of alarm systems, alarm codes, alarm descriptions and the equipment and system codes and names involved, there is a lack of uniform specification. In view of this, the alarm description is formatted and participled to generate a final participle set Seg.

Alternatively, as shown in fig. 2, step 1 may include:

step 1.1: performing regular matching on the ith alarm description DESI based on the segmentation character set to form an ith segmentation word set SEGi;

in general, a set of separators may be, but is not limited to: { \ s |, |; i # | _ is prepared. . . . . }.

Step 1.2: counting the number of times that all alarm description adjacent words appear simultaneously, constructing a hidden Markov model and the transition probability of the hidden Markov model, and determining a first word segmentation set Seg' I based on the transition probability;

step 1.3: and judging whether the participles in the Seg ' I set are subsets or complete sets of the participles in the SEGi, and if the participles in the Seg ' I set are the subsets or complete sets of the participles in the SEGi, taking the Seg ' I as the final participle set Seg. Generally, the term relates to, but is not limited to, alarm-related areas, networks, addresses, devices, components, and the like.

Step 2: forming paths according to the probability of the participles in the final participle set appearing in the alarm description, and combining the paths to form a probability hierarchical tree;

alternatively, as shown in fig. 3, step 2 may include:

step 2.1: counting the frequency Pi of the ith participle Segi in the final participle set;

step 2.2: traversing the alarm description DESI, sequencing the probabilities of the participles contained in the alarm description, taking a sequencing index k of the participles contained in the alarm description as the hierarchy of the participles contained in the alarm description, and forming a path Lk;

step 2.3: if the same Segi belongs to different levels on different paths, counting the probability of the level where the same Segi is located, and taking the level with the highest probability as the level of the same Segi;

step 2.4: the levels of the nodes on the path indexes to which the same Segi belongs are adjusted in sequence when the path indexes to which the same Segi belongs are inconsistent with the levels of the same Segi;

step 2.5: and merging the paths of the adjusted path indexes of the same Segi to form a probability hierarchical tree, wherein the probability hierarchical tree structure is shown in FIG. 4.

And step 3: setting a sliding window t;

and 4, step 4: merging alarm events in the alarm records based on the sliding window t to form an alarm simultaneous occurrence record set;

alternatively, as shown in fig. 5, step 4 may include:

step 4.1: sequencing the alarm events based on alarm records, and taking the unique value of the alarm events as a time sequence tj;

step 4.2: determining a time interval [ tj-t, tj + t ] by using the time sequence tj and the sliding window t;

step 4.3: merging the alarm events in the time interval, and constructing an alarm simultaneous occurrence record set DESj. In general, the alarm concurrency record set DESj may include, but is not limited to, the following specific examples: { xxx network element connection interruption, xxx radio unit service unavailable alarm }.

And 5: calculating word segmentation word frequency in the alarm simultaneous occurrence record set, constructing a frequency growth tree, namely an alarm dependency tree, based on the probability hierarchical tree, and determining a frequent mode;

alternatively, as shown in fig. 6, step 5 may include:

step 5.1: extracting alarm word segmentation of all alarm events in the DESj to form a word segmentation set SEGj;

step 5.2: calculating word frequencies of participles in the SEGj based on all alarm descriptions, and sequencing the word frequencies of the participles in the SEGj to form a frequent item list LSeg;

step 5.3: constructing a frequency growth tree based on the probability hierarchical tree and the frequent item list LSeg; fig. 7 shows a schematic diagram of the frequent item list LSeg and the frequency spanning tree, and of course, the structures of the frequent item list LSeg and the frequency spanning tree, the contents contained therein, and the occurrence frequency of the contents are determined by alarm events, which is only shown schematically in this figure.

Step 5.4: and traversing the frequency growth tree to obtain the frequency of each frequent mode, and if the frequency of the frequent mode is greater than the minimum support threshold e, taking the frequent mode as the final frequent mode. Wherein, the frequent mode is the alarm occurring at the same time, for example: { dynamic loop power failure, link loss, and too high bit error rate }, where the probability of the occurrence of the three is the frequency of the frequent pattern.

Step 6: determining a frequency dependence mode of each node on each path in the frequent mode based on the frequent mode and the frequency growth tree; wherein the frequency dependence of the path Li is shown in equation 1.

If the path Li is composed of several Segi, j, and if the probability of occurrence of the node Segi, j is Pi, j, the probability matrix of the path Li is shown in table 1, and table 1 shows the probability distribution of four-path nodes.

TABLE 1

Seg0

Seg1

Seg2

Seg3

……

Segm

L0

P00

P01

0

P03

……

P0m

L1

0

P11

0

P13

……

P1m

L2

0

P22

P23

……

P2m

L3

0

P32

P23

……

0

……

Ln

Pn0

0

……

Pnm

And 7: constructing a node probability list and a path probability list for the frequency dependence mode of each node on each path in the frequent mode; wherein the content of the first and second substances,

the node probability list is { Segi, P (Segi) };

the path probability is listed as

And 8: and acquiring all alarms in a sliding window interval for the alarm event to be dispatched, traversing the alarm dependent tree to form alarm links, and dispatching the alarm based on the formed intersection level of each alarm link.

Alternatively, as shown in fig. 8, step 8 may include:

step 8.1: for the alarm event to be dispatched, extracting an occurrence event t0 of the alarm event to be dispatched, and constructing a sliding window interval [ t0-t, t0+ t ];

step 8.2: traversing the alarm dependency tree for all alarm events to be dispatched, the occurrence time of which is within [ t0-t, t0+ t ];

step 8.3: if the alarm dependency tree is successfully traversed, determining a successfully traversed alarm set W as (L ' i, Pi), wherein L ' i is a path, Pi is a path probability, comparing the number N of the intersected levels of the paths L ' i to which the alarms belong in the set W, and dispatching the alarm event to be dispatched on the lowest intersected layer if N is greater than a set threshold;

step 8.4: if traversing the alarm dependency tree fails, adding a new path L 'k for the alarm event to be dispatched, wherein the traversing is unsuccessful, calculating the probability P' k of the path L 'k according to the probability Pi of the successfully traversed path and the maximum probability of the nodes on the same layer, sequencing the alarm event to be dispatched according to the probability P' k, and dispatching the dispatching in sequence.

In this embodiment, a method based on a dependency tree is adopted, an alarm dependency tree is generated by means of a dependency relationship between alarms of mobile network devices, alarm paths associated with each other are extracted, and time correlation, frequency correlation and path correlation between alarms are mined based on a large amount of alarm information on the alarm paths, and are used as a basis for alarm association analysis to trace the sources of the alarms and make a reasonable alarm work order distribution basis.

Another embodiment of the present invention further provides a device for alarm association and dispatch optimization based on a dependency tree, and fig. 9 is a schematic structural diagram of an embodiment of the device for alarm association and dispatch optimization based on a dependency tree, as shown in fig. 9, including the following modules,

a segmentation set generation module 1001, configured to format and segment the alarm description to generate a final segmentation set Seg;

optionally, as shown in fig. 10, the word segmentation set generation module 1001 may include:

the regular matching submodule 10011 is configured to perform regular matching on the ith alarm description DESi based on the segmenter set to form a segmentation participle set SEGi;

a hidden markov model construction submodule 10012, configured to count the number of times that all alarm description neighboring words occur simultaneously, construct a hidden markov model and a transition probability of the hidden markov model, and determine a first word set Seg' I based on the transition probability;

the participle set judgment sub-module 10013 is configured to judge whether the participles in the Seg ' I set are subsets or complete sets of the participles in the Seg I set, and if the participles in the Seg ' I set are the subsets or complete sets of the participles in the Seg I set, take the Seg ' I as the final participle set Seg.

A probability hierarchical tree generating module 1002, configured to form paths according to probabilities that the participles in the final participle set appear in the alarm description, and combine the paths to form a probability hierarchical tree;

optionally, as shown in fig. 11, the probability hierarchy tree generating module 1002 may include:

a word segmentation frequency statistics submodule 10021, configured to count a frequency Pi of an ith word segmentation Segi in the final word segmentation set;

the path generation sub-module 10022 is configured to traverse the alarm description DESi, sort the probabilities of the participles included in the alarm description, use a sorting index k of the participles included in the alarm description as the hierarchy to which the participles included in the alarm description belong, and form a path Lk;

the word segmentation level generation sub-module 10023 is configured to determine whether the levels of the same Segi on different paths are the same, obtain the level to which the same Segi belongs if the levels are the same, and count the probability of the level in which the same Segi belongs if the levels are different, where the level with the highest probability is used as the level of the same Segi;

a node hierarchy generating submodule 10024, configured to determine that the hierarchies of the path indexes to which the same Segi belong are inconsistent with the segmentation hierarchy generating submodule 10023, and sequentially adjust the hierarchies of the remaining nodes on the path indexes to which the same Segi belongs;

the probability hierarchical tree generation sub-module 10025 is configured to combine the paths determined by the node hierarchical generation sub-module 10024 to form a probability hierarchical tree, where the probability hierarchical tree structure is shown in fig. 4.

A sliding window setting module 1003, configured to set a sliding window t;

an alarm simultaneous occurrence record set generating module 1004, configured to merge alarm events in the alarm records based on the sliding window t to form an alarm simultaneous occurrence record set;

optionally, as shown in fig. 12, the alarm simultaneous occurrence record set generating module 1004 may include:

the time extraction submodule 10041 is configured to sort the alarm events based on the alarm records, and take a unique value of the alarm event as a time sequence tj;

time interval generation submodule 10042: determining a time interval [ tj-t, tj + t ] by using the time sequence tj extracted by the time extraction submodule 10041 and the sliding window t set by the sliding window setting module 1003;

the alarm simultaneous occurrence record set generating submodule 10043 is configured to merge the alarm events in the time interval, and construct an alarm simultaneous occurrence record set DESj.

A frequency growth tree and frequent pattern generation module 1005, configured to calculate word segmentation word frequencies in the alarm simultaneous occurrence record set, construct a frequency growth tree based on the probability hierarchical tree, use the frequency growth tree as an alarm dependency tree, and determine a final frequent pattern;

optionally, as shown in fig. 13, the frequency growth tree and frequent pattern generating module 1005 may include:

the alarm participle set generating submodule 10051 is configured to extract alarm participles of all alarm events in the DESj to form a participle set SEGj; optionally, the alarm participle set generating sub-module 10051 may complete generation of a participle set SEGj by using the participle set generating module 1001.

A frequent item list generating submodule 10052, configured to calculate word frequencies of the seg in the SEGj generated by the alarm word segmentation set generating submodule 10051 based on all the alarm descriptions, and sort the word frequencies of the seg to form a frequent item list LSeg;

a frequency growth tree generation submodule 10053, configured to construct a frequency growth tree based on the probability hierarchical tree constructed by the probability hierarchical tree generation submodule 10025 and the frequent item list LSeg formed by the frequent item list generation submodule 10052; fig. 7 shows a schematic diagram of the frequent item list LSeg and the frequency spanning tree, and of course, the structures of the frequent item list LSeg and the frequency spanning tree, the contents contained therein, and the occurrence frequency of the contents are determined by alarm events, which is only shown schematically in this figure.

The frequent pattern generation sub-module 10054 is configured to traverse the frequency growth tree generation sub-module 10053 to construct a frequency growth tree, obtain the frequency of each frequent pattern, and if the frequency of the frequent pattern is greater than the minimum support threshold e, take the frequent pattern as the final frequent pattern. Wherein, the frequent mode is the alarm occurring at the same time, for example: { dynamic loop power failure, link loss, and too high bit error rate }, where the probability of the occurrence of the three is the frequency of the frequent pattern.

A frequency-dependent pattern generating module 1006, configured to determine a frequency-dependent pattern of each node on each path in the frequent pattern based on the final frequent pattern and the frequency growth tree; the frequency dependence of the path Li is shown in formula 1, and the probability matrix of the path Li is shown in table 1.

A probability list generating module 1007, configured to construct a node probability list for the frequency dependent mode of each node on each path in the frequent mode, and construct a path probability list; wherein the content of the first and second substances,

the node probability list is { Segi, P (Segi) };

route summaryThe rate list is

And the dispatching module 1008 is configured to obtain all alarms to be dispatched in the sliding window interval for the alarm event to be dispatched, traverse the alarm dependency tree to form an alarm link in combination with the node probability list and the path probability list, and dispatch the alarm based on the formed intersection level of each alarm link.

Optionally, as shown in fig. 14, the dispatch module 1008 may include:

the sliding window construction submodule 10081 is configured to, for an alarm event to be dispatched, extract an occurrence event t0 of the alarm event to be dispatched, and construct a sliding window interval [ t0-t, t0+ t ]; optionally, the sliding window construction sub-module 10081 may construct a sliding window interval using the time interval generation sub-module 10042.

The alarm dependency tree traversal submodule 10082 is configured to traverse the alarm dependency tree for all to-be-dispatched alarm events whose occurrence times are within the sliding window interval [ t0-t, t0+ t ] generated by the sliding window construction submodule 10081, start the first dispatch submodule 10083 if traversing the alarm dependency tree is successful, and start the second dispatch submodule 10084 if traversing the alarm dependency tree is unsuccessful;

a first order assignment sub-module 10083, configured to determine that a successfully traversed alarm set W is (L ' i, Pi), where L ' i is a path and Pi is a path probability, compare the number N of intersecting levels of the paths L ' i to which each alarm in the set W belongs, and if N is greater than a set threshold, assign an order to the alarm event at the lowest intersecting layer;

the second dispatching submodule 10084 is configured to add a new path L 'k to the alarm event to be dispatched, which is unsuccessful in traversal, calculate a probability P' k of the path L 'k according to the probability Pi of the successfully traversed path and the maximum probability of the node on the same layer, sort the alarm event to be dispatched according to the probability P' k, and dispatch the alarm event in sequence.

In the embodiment, the alarm path tree is generated by adopting a path tree-based method, not only all alarm records are summarized and analyzed, but also the hierarchical relationship among the records, including the regional relationship, the network element hierarchical relationship and the alarm coding hierarchical relationship, is covered, and meanwhile, the attribute characteristics required by the alarm association relationship mining are represented by adopting a data structure with low overhead, so that the algorithm is easy to apply to the corresponding mining scene. In addition, the method for tracing the alarm source based on the excavated association relationship can reasonably utilize the association relationship to combine the homologous alarms within the sliding time range, solve the problem of repeated dispatching more deeply and further improve the order output efficiency of the alarm work order.

In addition, any one of the alarm association and dispatch optimization methods based on the dependency tree described in the embodiments of the present invention with reference to fig. 1 to 8 may be implemented by alarm association and dispatch optimization devices based on the dependency tree, respectively. Fig. 15 is a schematic diagram illustrating a hardware structure of a device for alarm association and dispatch optimization based on a dependency tree according to an embodiment of the present invention.

The dependency tree based alarm association and dispatch optimization device may include a processor 1501 and a memory 1502 having stored thereon computer program instructions.

Specifically, the processor 1501 may include a Central Processing Unit (CPU), or an Application Specific Integrated Circuit (ASIC), or may be configured as one or more Integrated circuits implementing embodiments of the present invention.

The memory 1502 may include mass storage for data or instructions. By way of example, and not limitation, the memory 1502 may include a Hard Disk Drive (HDD), floppy Disk Drive, flash memory, optical Disk, magneto-optical Disk, tape, or Universal Serial Bus (USB) Drive or a combination of two or more of these. The memory 1502 may include removable or non-removable (or fixed) media, where appropriate. The memory 1502 may be internal or external to the data processing device, where appropriate. In a particular embodiment, the memory 1502 is a non-volatile solid-state memory. In a particular embodiment, the memory 1502 includes Read Only Memory (ROM). Where appropriate, the ROM may be mask-programmed ROM, Programmable ROM (PROM), Erasable PROM (EPROM), Electrically Erasable PROM (EEPROM), electrically rewritable ROM (EAROM), or flash memory or a combination of two or more of these.

The processor 1501 reads and executes the computer program instructions stored in the memory 1502 to implement any of the alarm association and dispatch optimization methods based on dependency trees in the above embodiments.

In one example, the dependency tree based alarm association and dispatch optimization device may also include a communication interface 1503 and a bus 1510. As shown in fig. 15, the processor 1501, the memory 1502, and the communication interface 1503 are connected to each other via a bus 1510 to complete communication therebetween.

The communication interface 1503 is mainly used for implementing communication among modules, apparatuses, units and/or devices in the embodiment of the present invention.

Bus 1510 comprises hardware, software, or both coupling the components of the dependency tree based alarm association and dispatch optimization device to each other. By way of example, and not limitation, a bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hypertransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an infiniband interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a video electronics standards association local (VLB) bus, or other suitable bus or a combination of two or more of these. Bus 1510 may include one or more buses, where appropriate. Although specific buses have been described and shown in the embodiments of the invention, any suitable buses or interconnects are contemplated by the invention.

The alarm association and dispatch optimization equipment based on the dependency tree can execute the alarm association and dispatch optimization method based on the dependency tree in the embodiment of the invention based on the acquired network management performance index of the cell to be tested, thereby realizing the combination of any alarm association and dispatch optimization method based on the dependency tree in the embodiment.

In addition, in combination with the alarm association and dispatch optimization method based on the dependency tree in the above embodiments, the embodiments of the present invention may provide a computer-readable storage medium to implement. The computer readable storage medium having stored thereon computer program instructions; the computer program instructions, when executed by a processor, implement any of the above embodiments of a dependency tree based alarm association and dispatch optimization method.

It is to be understood that the invention is not limited to the specific arrangements and instrumentality described above and shown in the drawings. A detailed description of known methods is omitted herein for the sake of brevity. In the above embodiments, several specific steps are described and shown as examples. However, the method processes of the present invention are not limited to the specific steps described and illustrated, and those skilled in the art can make various changes, modifications and additions or change the order between the steps after comprehending the spirit of the present invention.

The functional blocks shown in the above-described structural block diagrams may be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, it may be, for example, an electronic circuit, an Application Specific Integrated Circuit (ASIC), suitable firmware, plug-in, function card, or the like. When implemented in software, the elements of the invention are the programs or code segments used to perform the required tasks. The program or code segments may be stored in a machine-readable medium or transmitted by a data signal carried in a carrier wave over a transmission medium or a communication link. A "machine-readable medium" may include any medium that can store or transfer information. Examples of a machine-readable medium include electronic circuits, semiconductor memory devices, ROM, flash memory, Erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, Radio Frequency (RF) links, and so forth. The code segments may be downloaded via computer networks such as the internet, intranet, etc.

It should also be noted that the exemplary embodiments mentioned in this patent describe some methods or systems based on a series of steps or devices. However, the present invention is not limited to the order of the above-described steps, that is, the steps may be performed in the order mentioned in the embodiments, may be performed in an order different from the order in the embodiments, or may be performed simultaneously.

As described above, only the specific embodiments of the present invention are provided, and it can be clearly understood by those skilled in the art that, for convenience and brevity of description, the specific working processes of the system, the module and the unit described above may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again. It should be understood that the scope of the present invention is not limited thereto, and any person skilled in the art can easily conceive various equivalent modifications or substitutions within the technical scope of the present invention, and these modifications or substitutions should be covered within the scope of the present invention.

Claims

1. A method for alarm association and dispatch optimization based on a dependency tree is characterized by comprising the following steps:

setting a sliding window t;

acquiring all alarms to be dispatched in a sliding window interval for the alarms to be dispatched in the alarm event to be dispatched, traversing the alarm dependency tree to form an alarm link by combining the node probability list and the path probability list, and dispatching the alarm based on the formed intersection level of each alarm link;

the formatting and word segmentation of the alarm description comprises:

performing regular matching on the ith alarm description DESI based on the segmentation character set to form an ith segmentation word set SEGi;

counting the number of times that all alarm description adjacent words appear simultaneously, constructing a hidden Markov model and the transition probability of the hidden Markov model, and determining a first word segmentation set Seg' I based on the transition probability;

judging whether the participles in the Seg ' I set are subsets or complete sets of the participles in the SEGi, and if the participles in the Seg ' I set are the subsets or complete sets of the participles in the SEGi, taking the Seg ' I as the final participle set Seg; forming a path according to the probability of the participles in the final participle set appearing in the alarm description, and combining the paths to form a probability hierarchical tree, wherein the probability hierarchical tree comprises the following steps:

counting the frequency Pi1 of the ith participle Segi in the final participle set;

traversing the alarm description DESI, sequencing the probabilities of the participles contained in the alarm description DESI, taking a sequencing index k of the participles contained in the alarm description DESI as the hierarchy of the participles contained in the alarm description, and forming a path Lk;

if the same Segi belongs to different levels on different paths, counting the probability of the level where the same Segi is located, and taking the level with the highest probability as the level of the same Segi;

if the path index to which the same Segi belongs is not consistent with the levels of the same Segi, sequentially adjusting the levels of nodes on the path index to which the same Segi belongs;

merging the paths of the adjusted path indexes of the same Segi to form a probability hierarchical tree;

calculating word segmentation word frequency in the alarm simultaneous occurrence record set, constructing a frequency growth tree based on the probability hierarchical tree, and determining a final frequent mode by taking the frequency growth tree as an alarm dependency tree, wherein the method comprises the following steps of:

extracting alarm word segmentation of all alarm events in the DESj to form a word segmentation set SEGj;

calculating word frequencies of participles in the SEGj based on all alarm descriptions, and sequencing the word frequencies of the participles in the SEGj to form a frequent item list LSeg;

constructing a frequency growth tree based on the probability hierarchical tree and the frequent item list LSeg;

and traversing the frequency growth tree to obtain the frequency of each frequent mode, and if the frequency of the frequent mode is greater than the minimum support threshold e, taking the frequent mode as the final frequent mode.

2. The method of claim 1, wherein merging alarm events in alarm records based on a sliding window t to form an alarm simultaneous record set comprises:

sequencing the alarm events based on alarm records, and taking the unique value of the alarm events as a time sequence tj;

determining a time interval [ tj-t, tj + t ] by using the time sequence tj and the sliding window t;

merging the alarm events in the time interval, and constructing an alarm simultaneous occurrence record set DESj.

3. The method of claim 1, wherein the obtaining of all alarms in a sliding window interval for the alarm event to be dispatched, traversing the alarm dependency tree to form alarm links in combination with the node probability list and the path probability list, and dispatching based on the formed intersection level of each alarm link comprises:

for the alarm event to be dispatched, extracting an occurrence event t0 of the alarm event to be dispatched, and constructing a sliding window interval [ t0-t, t0+ t ];

traversing the alarm dependency tree for all alarm events to be dispatched, the occurrence time of which is within [ t0-t, t0+ t ];

if the alarm dependency tree is successfully traversed, determining a successfully traversed alarm set W as (L ' i, Pi), wherein L ' i is a path, Pi is a path probability, comparing the number N of the intersected levels of the paths L ' i to which the alarms belong in the set W, and dispatching the alarm event to be dispatched on the lowest intersected layer if N is greater than a set threshold;

if traversing the alarm dependency tree fails, adding a new path L 'k for the alarm event to be dispatched, wherein the traversing is unsuccessful, calculating the probability P' k of the path L 'k according to the probability Pi of the successfully traversed path and the maximum probability of the nodes on the same layer, sequencing the alarm event to be dispatched according to the probability P' k, and dispatching the dispatching in sequence.

4. An alarm association and dispatch optimization device based on a dependency tree is characterized by comprising:

the sliding window setting module is used for setting a sliding window t;

the dispatching module is used for acquiring all the alarms to be dispatched in the sliding window interval for the alarms to be dispatched in the alarms to be dispatched, traversing the alarm dependent tree to form alarm links, and dispatching the alarm based on the formed intersection level of each alarm link;

the word segmentation set generation module is configured to format and segment the alarm description to generate a final word segmentation set Seg, and includes:

judging whether the participles in the Seg ' I set are subsets or complete sets of the participles in the SEGi, and if the participles in the Seg ' I set are the subsets or complete sets of the participles in the SEGi, taking the Seg ' I as the final participle set Seg;

the probability hierarchical tree generating module is configured to form a path according to a probability that a participle in the final participle set appears in an alarm description, and combine the path to form a probability hierarchical tree, including:

traversing the alarm description DESI, sequencing the probabilities of the participles contained in the alarm description DESI, taking a sequencing index k of the participles contained in the alarm description DESI as the hierarchy of the participles contained in the alarm description DESI, and forming a path Lk;

the frequency growth tree and frequent pattern generation module is configured to calculate word segmentation word frequencies in the alarm simultaneous occurrence record set, construct a frequency growth tree based on the probability hierarchical tree, and determine a final frequent pattern by using the frequency growth tree as an alarm dependency tree, where the frequency growth tree and frequent pattern generation module include:

5. An alarm association and order dispatching optimization device based on a dependency tree is characterized by comprising: at least one processor, at least one memory, and computer program instructions stored in the memory that, when executed by the processor, implement the method of any of claims 1-3.

6. A computer-readable storage medium having computer program instructions stored thereon, which when executed by a processor implement the method of any one of claims 1-3.