CN111193627A - Information processing method, device, equipment and storage medium - Google Patents
Information processing method, device, equipment and storage medium Download PDFInfo
- Publication number
- CN111193627A CN111193627A CN201911422642.XA CN201911422642A CN111193627A CN 111193627 A CN111193627 A CN 111193627A CN 201911422642 A CN201911422642 A CN 201911422642A CN 111193627 A CN111193627 A CN 111193627A
- Authority
- CN
- China
- Prior art keywords
- objects
- alarm
- alarm object
- determining
- performance data
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
Abstract
The invention discloses an information processing method, an information processing device, information processing equipment and a storage medium. The method comprises the following steps: acquiring first alarm information, wherein the first alarm information comprises identification information of a first alarm object; according to the identification information of the first alarm object, determining the related object of the first alarm object from a pre-configured database, wherein the database comprises: the first alarm object, the associated object and the association relation between the first alarm object and the associated object; determining a second alarm object sending alarm information in the associated objects; and determining a root alarm object of the first alarm object according to the incidence relation between the first alarm object and the second alarm object. The embodiment of the invention acquires the incidence relation between the objects in the telecommunication network, and determines the source alarm object of the alarm object according to the incidence relation between the objects when the alarm is generated, thereby improving the speed of positioning the alarm source.
Description
Technical Field
The present invention relates to the field of information processing, and in particular, to an information processing method, apparatus, device, and storage medium.
Background
At present, the alarms of the mobile support system are mutually independent, and if the relation between the alarms needs to be analyzed, the master-slave relation of the alarms configured by manual experience is mainly relied on.
However, when a large amount of alarms are encountered, the relationship between the alarms is artificially analyzed, the workload is huge, all alarms cannot be completely covered, and the root alarms of the alarms cannot be quickly positioned, so that the alarm positioning is slow, the fault resolution is not timely, and the normal operation of the system is influenced.
Therefore, how to quickly analyze the source of the generation of the positioning alarm becomes a problem to be solved.
Disclosure of Invention
The embodiment of the invention provides an information processing method, an information processing device, information processing equipment and a storage medium, which can determine a root alarm object of an alarm object through the incidence relation between objects by acquiring the incidence relation between the objects in a telecommunication network and when an alarm is generated, so that the speed of positioning the alarm source is improved.
In a first aspect, the present application provides an information processing method, including: acquiring first alarm information, wherein the first alarm information comprises identification information of a first alarm object; according to the identification information of the first alarm object, determining the related object of the first alarm object from a pre-configured database, wherein the database comprises: the first alarm object, the associated object and the association relation between the first alarm object and the associated object; determining a second alarm object sending alarm information in the associated objects; and determining a root alarm object of the first alarm object according to the incidence relation between the first alarm object and the second alarm object.
In one possible implementation, the method further comprises: a configuration database, wherein the configuration database comprises: respectively determining performance data of a plurality of objects in a telecommunication network within a preset time period; determining the similarity of any two objects according to the performance data of any two objects in a preset time period; respectively determining the incidence relation of any two objects according to the similarity of any two objects; a plurality of objects and associations are stored in a database.
In one possible implementation, determining the similarity between any two objects according to the performance data of any two objects within a preset time period includes: respectively determining object vectors of any two objects in a preset time period according to performance data of any two objects in the preset time period; and calculating the object vector by using a cosine similarity algorithm to determine the similarity of any two objects.
In one possible implementation, determining, according to performance data of any two objects in a preset time period, object vectors of any two objects in the preset time period respectively includes: preprocessing the performance data of a plurality of objects in a preset time period to obtain preprocessed performance data; carrying out positive-too-standardization processing on the preprocessed performance data to obtain the performance data subjected to positive-too-standardization processing; and respectively determining the object vectors of any two objects in a preset time period according to the performance data after just-too-standardized processing.
In one possible implementation, determining the similarity between any two objects according to the performance data of any two objects within a preset time period includes: and performing fitting degree calculation of the performance data of any two objects in a preset time period in the first direction or the second direction, and determining the similarity of any two objects.
In one possible implementation, determining a root alarm object of a first alarm object according to an association relationship between the first alarm object and a second alarm object includes: and under the condition that the first alarm object is determined not to be the root alarm object, determining the root alarm object of the first alarm object from the second alarm object.
In one possible implementation, a configuration database includes: determining the physical relationship and/or deployment relationship of any two objects; and determining the incidence relation of any two objects and the incidence relation type of any two objects according to the physical relation and/or the deployment relation.
In one possible implementation, the preconfigured database further comprises: the association relationship type of the first alarm object and the association object; under the condition that the association relationship type of any two association objects is a first association type, the performance data of the first alarm object depends on the association objects; and under the condition that the association relationship type of any two associated objects is the second association type, the performance data of the first alarm object is influenced by the performance data of the associated objects.
In one possible implementation, determining a root alarm object of the first alarm object includes: determining the incidence relation type of the first alarm object and the second alarm object from a database; under the condition that the type of the association relationship is convergence, sequentially searching the association objects of the second alarm object until the alarm objects with the preset number of layers are determined; the association relations between any two adjacent layers of alarm objects from the first alarm object to the preset layer number of alarm objects are all of a first association type.
In one possible implementation, the pre-processing the performance data of the plurality of objects in a preset time period to obtain the pre-processed performance data includes: the method comprises the steps of denoising abnormal data in the performance data of a plurality of objects in a preset time period, and performing leakage repairing processing on vacant data in the performance data of the plurality of objects in the preset time period.
In a second aspect, an embodiment of the present invention provides an information processing apparatus, including: the acquisition module is used for acquiring first alarm information, and the first alarm information comprises identification information of a first alarm object; a first determining module, configured to determine, according to the identification information of the first alarm object, an associated object of the first alarm object from a preconfigured database, where the database includes: the first alarm object, the associated object and the association relation between the first alarm object and the associated object; the second determination module is used for determining a second alarm object which sends out alarm information in the associated objects; and the third determining module is used for determining a root alarm object of the first alarm object according to the incidence relation between the first alarm object and the second alarm object.
In a third aspect, an embodiment of the present invention provides a computing device, where the device includes: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the computing method as provided by embodiments of the present invention.
In a fourth aspect, an embodiment of the present invention provides a computer storage medium, where computer program instructions are stored, and when the computer program instructions are executed by a processor, the computer program instructions implement the processing method provided by the embodiment of the present invention.
According to the information processing method, the device, the equipment and the computer storage medium, when the alarm is generated, the second alarm object having the association relation with the first alarm object is determined based on the association relation between the objects in the telecommunication network collected in advance, the search for the upper-layer object is continued according to the association relation between the first alarm object and the second alarm object until the root alarm object of the first alarm object is determined, and the speed of positioning the alarm source is improved.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required to be used in the embodiments of the present invention will be briefly described below, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.
FIG. 1 is a flow chart of an information processing method according to an embodiment of the present invention;
FIG. 2 is a schematic diagram of a normalization process according to an embodiment of the present invention;
FIG. 3 is a diagram illustrating index data according to an embodiment of the present invention;
FIG. 4 is a schematic diagram of a cosine algorithm according to an embodiment of the present invention;
FIG. 5 is a schematic diagram of another cosine algorithm provided by the embodiment of the present invention;
FIG. 6 is a schematic diagram of another cosine algorithm provided by the embodiment of the present invention;
FIG. 7 is a schematic diagram of vector similarity according to an embodiment of the present invention;
FIG. 8 is a schematic diagram of another vector similarity provided by the embodiment of the present invention;
FIG. 9 is a schematic diagram of another vector similarity provided by the embodiment of the present invention;
FIG. 10 is a diagram illustrating performance data provided by an embodiment of the present invention;
FIG. 11 is a schematic diagram of yet another performance data provided by an embodiment of the present invention;
FIG. 12 is a schematic diagram of yet another performance data provided by an embodiment of the present invention;
FIG. 13 is a graphical representation of alternative performance data provided by embodiments of the present invention;
FIG. 14 is a schematic diagram of a root cause analysis of an alarm provided in an embodiment of the present invention;
fig. 15 is a schematic structural diagram of an alarm analysis apparatus according to an embodiment of the present invention;
fig. 16 is a schematic structural diagram of an information processing apparatus according to an embodiment of the present invention;
fig. 17 is a schematic diagram of an exemplary hardware architecture provided by an embodiment of the present invention.
Detailed Description
Features and exemplary embodiments of various aspects of the present invention will be described in detail below, and in order to make objects, technical solutions and advantages of the present invention more apparent, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not to be construed as limiting the invention. It will be apparent to one skilled in the art that the present invention may be practiced without some of these specific details. The following description of the embodiments is merely intended to provide a better understanding of the present invention by illustrating examples of the present invention.
It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.
At present, the alarms of the mobile support system are mutually independent, and if the relation between the alarms needs to be analyzed, the master-slave relation of the alarms is configured completely depending on manual experience. When a large amount of alarms are encountered, the relationship among the alarms is artificially analyzed, the workload is huge, all the alarms cannot be completely covered, and the alarms cannot be quickly positioned and finally generated by the influence of the alarms, so that the alarm positioning is slow, the fault resolution is not timely, and the normal operation of a system is influenced.
In order to solve the problem of difficult alarm positioning at present, the association relationship between alarm factors can be automatically found by utilizing the acquisition relationship, the causal association relationship of the alarm is further perfected, and finally alarm convergence and fault accurate positioning are achieved. Based on this, the embodiment of the invention provides an information processing method.
Fig. 1 is a schematic flow chart of an information processing method according to an embodiment of the present invention.
As shown in fig. 1, the information processing method may include S101-S104, and the method is applied to a server, and specifically as follows:
s101, acquiring first alarm information, wherein the first alarm information comprises identification information of a first alarm object.
S102, according to the identification information of the first alarm object, determining the related object of the first alarm object from a pre-configured database, wherein the database comprises: the first alarm object, the associated object and the association relation of the first alarm object and the associated object.
S103, determining a second alarm object sending alarm information in the associated objects.
And S104, determining a root alarm object of the first alarm object according to the incidence relation between the first alarm object and the second alarm object.
According to the information processing method, the incidence relation among the objects in the telecommunication network is collected, when the alarm is generated, the root alarm object of the alarm object is determined through the incidence relation among the objects, and the speed of positioning the alarm source is improved.
The contents of S101-S102 are described below:
referring first to S101, in one embodiment, first alarm information is obtained, the first alarm information including identification information of a first alarm object. When a large amount of alarm information is received, it is difficult to find the source immediately, so an alarm information is obtained first, and an object corresponding to the alarm information is found, wherein the object can be an index or a physical component, and then the first alarm object can be searched step by step, and finally the source alarm object is found.
Secondly, the process, referred to as S102,
as an implementation manner of the present application, in order to improve the accuracy of the disease detection model, before S102, a configuration database may be further included, and in the step of configuring the database, the method specifically includes: respectively determining performance data of a plurality of objects in a telecommunication network within a preset time period; determining the similarity of any two objects according to the performance data of any two objects in a preset time period; respectively determining the incidence relation of any two objects according to the similarity of any two objects; a plurality of objects and associations are stored in a database. The following describes the procedure of configuring the database in sequence:
in the step of configuring the database, the method may specifically include: determining the physical relationship and/or deployment relationship of any two objects; and determining the incidence relation of any two objects and the incidence relation type of any two objects according to the physical relation and/or the deployment relation.
The collection scheduling program is installed on a related host, objects such as applications, databases, various unknown processes and the like installed on the host can be automatically found through the program system, the host has objects such as a Central Processing Unit (CPU), a memory, a file system, a network and the like, the objects can be pushed to the root cause library through the collection program to become one or one factor of the root cause library, and meanwhile, an association relationship is established through the physical or deployment relationship between the host and the objects.
The database pre-configured in S102 further includes: the association relationship type of the first alarm object and the association object; under the condition that the association relationship type of any two association objects is a first association type, the performance data of the first alarm object depends on the association objects; and under the condition that the association relationship type of any two associated objects is the second association type, the performance data of the first alarm object is influenced by the performance data of the associated objects.
The first association type may be a convergence type, and the second association type may be an impact type. When the performance threshold value generates an alarm, whether the alarm exists in the association factor is searched according to the association relationship among the factors in a database (such as a graph database), and whether the alarm is a root alarm or an alarm needing convergence is calculated according to the association relationship type of the factors. And under the condition that the association relationship type of any two associated objects is a convergence type, the performance data of the first alarm object is influenced by the performance data of the associated objects, but the associated objects are not the occurrence source of the first alarm object. In the case that the association relationship type of any two association objects is a convergence type, the performance data of the first alarm object depends on the association objects, so that the association objects of the first alarm object can be found in sequence and converged by the alarm object of the previous layer until the root alarm object is found.
In the above step of determining the object vectors of any two objects in the preset time period according to the performance data of any two objects in the preset time period, the method specifically includes:
preprocessing the performance data of a plurality of objects in a preset time period to obtain preprocessed performance data; carrying out positive-too-standardization processing on the preprocessed performance data to obtain the performance data subjected to positive-too-standardization processing; and respectively determining the object vectors of any two objects in a preset time period according to the performance data after just-too-standardized processing.
The step of performing forward normalization on the preprocessed performance data to obtain forward normalized performance data may include: then, the positive-phase (z _ score) standardization processing is carried out on the data through the curve of the data of a complete period of a factor time period and the curve with the same other factors, the similarity is calculated through a cosine similarity algorithm, and the relation of the object index factors with high similarity is pushed to a factor database. Fig. 2 shows data before and after the over-normalization process.
The preprocessing the performance data of the plurality of objects in the preset time period to obtain the preprocessed performance data includes: denoising the performance data of the objects in a preset time period, and performing leakage repairing on vacant data in the performance data of the objects in the preset time period.
The factor relation is calculated through the similarity of performance data curves on factors, the performance data in the factor relation sometimes has problems, abnormal data and missing data need to be cleaned and supplemented, and denoising processing can be realized by cleaning the abnormal raised performance data according to an intelligent threshold. The missing data in the performance data of the plurality of objects in the preset time period can be filled by calculating through historical data. Fig. 3 shows the preprocessed performance data, where there are no obvious abnormal bumps or missing points on the data curve, so as to prepare for the subsequent determination of the similarity of the performance data.
In the above step of determining the similarity between any two objects according to the performance data of any two objects in the preset time period, the method may specifically include:
respectively determining object vectors of any two objects in a preset time period according to performance data of any two objects in the preset time period; and calculating the object vector by using a cosine similarity algorithm to determine the similarity of any two objects.
Here, the cosine distance in the cosine similarity algorithm, also called cosine similarity, is a measure for measuring the magnitude of the difference between two individuals by using the cosine value of the angle between two vectors in the vector space.
Wherein, the closer the cosine value is to 1, the closer the included angle is to 0 degree, i.e. the more similar the two vectors are, this is called "cosine similarity". As shown in fig. 4, the angle between the two vectors a and b is small, so that the a vector and the b vector have high similarity. In the extreme case, as shown in fig. 5, the a and b vectors are completely coincident, and the a and b vectors can be considered to be equal, that is, the text represented by the a and b vectors is completely similar or equal. As shown in fig. 6, if the angle between the a and b vectors is large, or in the opposite direction. It can be said that the a-vector and the b-vector have very low similarity, or that the texts represented by the a-and b-vectors are not substantially similar.
The vector space cosine similarity theory is a method for calculating the individual similarity based on the above. The following is a detailed analysis of the inference process in conjunction with fig. 7. As shown in fig. 7, the formula for calculating the cosine constant of the included angle θ is as follows: and cos theta is equal to a/c, wherein the vector a is a square-side vector of the angle theta in the graph 7, c is a hypotenuse vector of the angle theta, and cos theta is a cosine value. However, this is only applicable to right triangles, and the following describes the formula of the cosine theorem in non-right triangles.
As shown in fig. 8, the cosine of the angle between the sides a and b in the triangle is calculated as:
wherein, a, b, c are the vectors a, b, c in the vector triangle of fig. 8, and cos (θ) is the cosine value.
In the triangle represented by the vector, assuming that the a vector is (x1, y1) and the b vector is (x2, y2), i.e. in the vector shown in fig. 9, the cosine theorem can be rewritten in the following form, and the cosine of the angle between vector a and vector b is calculated as follows:
wherein x is1，y1，x2，y2The coordinates of the a and b vectors are respectively the intersection point of the a and b vectors as the starting point in the vector triangle.
If the vectors a and b are not two-dimensional but n-dimensional, the above cosine calculation is still correct. Assuming a and b are two n-dimensional vectors, the cosine of the angle between a and b is:
wherein x isi，yiCoordinate values of the ith inflection point in the n dimension are shown, and a and b are vector coordinates.
The closer the cosine value is to 1, the closer the angle is to 0 degrees, i.e. the more similar the two vectors are, the angle is equal to 0, i.e. the two vectors are equal, which is called "cosine similarity".
In the above step of determining the similarity between any two objects according to the performance data of any two objects in the preset time period, the method may specifically include:
and performing fitting degree calculation of the performance data of any two objects in a preset time period in the first direction or the second direction, and determining the similarity of any two objects.
For example: array 1 values are 10, 40, 50, 70; array 2 has values of 1, 4, 5, 7.
The similarity of the curves was calculated to be 100% similar. If the calculated curves for 1, 4, 5, 90 of modified array 2 are 78% similar.
Wherein, the fitting degree calculation of the performance data of any two objects in the preset time period can take the change data of the host cpu, the database connection number and the application interface calling number along with the time and draw a curve chart, as shown in fig. 10, fig. 11 and fig. 12 respectively,
the vertical axis intervals of the three indexes are uniformly compressed in the range of [0, 1], corresponding phase shifts are carried out, and then the three indexes are drawn into a graph, as shown in fig. 13, the curve coincidence degree of the three indexes is very high as can be seen from fig. 13, and the pairwise similarity calculated by adopting a cosine algorithm is respectively as follows: 94%, 96% and 93%. The cosine algorithm has high fitness.
If the change data of the host CPU, the database connection number and the application interface calling number along with the time is not shown in a graph and is drawn on a graph, and the data is in a wrong peak condition, the performance data can be operated in a first direction (such as left shift) or a second direction (such as right shift) so as to clearly analyze the trend similarity of the performance data of multiple indexes.
Then, the process, referred to as S103,
finally, the process, referred to as S104,
in the step related to S104, the method may specifically include:
and under the condition that the first alarm object is determined not to be the root alarm object, determining the root alarm object of the first alarm object from the second alarm object.
And under the condition that the first alarm object is the root alarm object, taking the first alarm object as the root alarm object. And under the condition that the first alarm object is not the root alarm object, determining the root alarm object of the first alarm object from the second alarm objects.
In the above step of determining a root alarm object of the first alarm object, the method may specifically include:
determining the incidence relation type of the first alarm object and the second alarm object from a database; under the condition that the type of the association relationship is convergence, sequentially searching the association objects of the second alarm object until the alarm objects with the preset number of layers are determined; and the incidence relation between any two adjacent layers of alarm objects between the first alarm object and the alarm object with the preset layer number is a second incidence type.
The following describes the steps of determining the root cause alarm object of the first alarm object with reference to fig. 14, if an alarm is generated by a factor 2, it can be deduced through the relationship between the factor 2 and the factor 1 that the factor 2 is the root cause of the factor 1, so that the alarm on the factor is converged, and it is described that the alarm on the factor 2 is the root cause alarm of the factor 1, and the alarm on the factor 2 is also converged for the dependency relationship between the factor 3 and the factor 2, and the alarm on the factor 3 is the root cause alarm of the factor 2, and the same method is used for analyzing that the alarm on the factor 4 is the root cause alarm, so that the cause of the fault is located, and the alarms 1 to 3 are all converged by the alarm 4. It can also be found through the type of association that a problem with factor 2 affects factor 5, but is not a fatal effect.
In summary, the information processing method provided by the embodiment of the invention can automatically discover and perfect the object factors in the root cause library through the object discovery and factor discovery by the acquisition program, discover the association relationship between the object factors, and improve the automation degree of relationship discovery and the accuracy of object association relationship.
In addition, based on the information processing method, an embodiment of the present invention further provides an information processing apparatus, which is specifically described in detail with reference to fig. 15.
Fig. 15 is a schematic structural diagram of an alarm analysis apparatus according to an embodiment of the present invention;
as shown in fig. 15, the apparatus 1500 may include:
first, collecting root cause object and incidence relation analysis device
The collection scheduling program is installed on the related host computer, objects such as applications, databases, various unknown processes and the like installed on the host computer can be automatically found through the program system, the host computer has objects such as a CPU (central processing unit), a memory, a file system, a network and the like, the objects can be pushed to the root cause library through the collection program to become a factor of the root cause library, and meanwhile, an association relation is established through the physical or deployment relation between the host computer and the objects.
Second, index curve similarity calculation method device
The object factors and simple physical relationships have been discovered by the above collection root factor object and association analysis device system, but many association relationships cannot be discovered, for example, relationships between applications and applications need to be manually configured to maintain association relationships, for example, an association relationship between an interface call volume of an application and a database connection number cannot be physically discovered by a collection method.
Third, alarm root cause derivation device
When the performance threshold value generates an alarm, whether the alarm exists in the association factor is searched according to the association relationship among the factors in a database (such as a graph database), and whether the alarm is a root alarm or an alarm needing convergence is calculated according to the association relationship type of the factors.
In summary, the alarm analysis device provided by the embodiment of the invention can automatically discover and perfect the object factors in the root cause library through the object discovery and factor discovery of the acquisition program, discover the association relationship between the object factors, and improve the automation degree of relationship discovery and the accuracy of object association relationship.
In addition, based on the information processing method, an embodiment of the present invention further provides an information processing apparatus, which is specifically described in detail with reference to fig. 16.
Fig. 16 is a schematic structural diagram of an information processing apparatus according to an embodiment of the present invention;
as shown in fig. 16, the apparatus 1600 may comprise:
the obtaining module 1610 is configured to obtain first warning information, where the first warning information includes identification information of a first warning object.
A first determining module 1620, configured to determine an associated object of the first alarm object from a preconfigured database according to the identification information of the first alarm object, where the database includes: the first alarm object, the associated object and the association relation of the first alarm object and the associated object.
The first determining module 1620 is further configured to respectively determine performance data of a plurality of objects in the telecommunication network within a preset time period; determining the similarity of any two objects according to the performance data of any two objects in a preset time period; respectively determining the incidence relation of any two objects according to the similarity of any two objects; a plurality of objects and associations are stored in a database.
As an example, the first determining module 1620 is specifically configured to determine, according to performance data of any two objects in a preset time period, object vectors of any two objects in the preset time period respectively; and calculating the object vector by using a cosine similarity algorithm to determine the similarity of any two objects.
As an example, the first determining module 1620 is specifically configured to perform preprocessing on performance data of a plurality of objects within a preset time period to obtain preprocessed performance data; carrying out positive-too-standardization processing on the preprocessed performance data to obtain the performance data subjected to positive-too-standardization processing; and respectively determining the object vectors of any two objects in a preset time period according to the performance data after just-too-standardized processing.
As an example, the first determining module 1620 is specifically configured to perform denoising processing on performance data of a plurality of objects in a preset time period and/or performing leakage repairing processing on vacant data in the performance data of the plurality of objects in the preset time period.
As an example, the first determining module 1620 is specifically configured to perform a fitness calculation in a first direction or a second direction on performance data of any two objects within a preset time period, and determine a similarity between any two objects.
The first determining module 1620 is further configured to determine a physical relationship and/or a deployment relationship between any two objects; and determining the incidence relation of any two objects and the incidence relation type of any two objects according to the physical relation and/or the deployment relation.
The pre-configured database related to the embodiment of the invention comprises: the association relationship type of the first alarm object and the association object; under the condition that the association relationship type of any two association objects is a first association type, the performance data of the first alarm object depends on the association objects; and under the condition that the association relationship type of any two associated objects is the second association type, the performance data of the first alarm object is influenced by the performance data of the associated objects.
The second determining module 1630 is configured to determine a second alarm object sending the alarm information in the associated object.
The third determining module 1640 is configured to determine a root alarm object of the first alarm object according to the association relationship between the first alarm object and the second alarm object.
As an example, the third determination module 1640 is specifically configured to determine a root alarm object for the first alarm object from among the second alarm objects if it is determined that the first alarm object is not the root alarm object.
As an example, the third determining module 1640 is specifically configured to determine the association relationship type of the first alarm object and the second alarm object from the database; under the condition that the type of the association relationship is convergence, sequentially searching the association objects of the second alarm object until the alarm objects with the preset number of layers are determined; the association relations between any two adjacent layers of alarm objects from the first alarm object to the preset layer number of alarm objects are all of a first association type.
In summary, the information processing apparatus provided in the embodiment of the present invention can discover objects and factors through the acquisition program, automatically discover and perfect object factors in the root cause library, discover an association relationship between the object factors, and improve the degree of automation of relationship discovery and the accuracy of object association relationship.
Fig. 17 is a schematic diagram of a hardware structure provided in the embodiment of the present invention.
The apparatus may include a processor 1701 and a memory 1702 in which computer program instructions are stored.
Specifically, the processor 1701 may include a Central Processing Unit (CPU), or an Application Specific Integrated Circuit (ASIC), or may be configured as one or more Integrated circuits implementing embodiments of the present invention.
The processor 1701 realizes any one of the information processing methods in the above-described embodiments by reading and executing computer program instructions stored in the memory 1702.
In one example, the device may also include a communication interface 1703 and a bus 1710. As shown in fig. 17, the processor 1701, the memory 1702, and the communication interface 1703 are connected via a bus 1710 to perform communication with each other.
The communication interface 1703 is mainly used to implement communication between modules, apparatuses, units and/or devices in the embodiment of the present invention.
The bus 1710 includes hardware, software, or both to couple the components of the device to one another. By way of example, and not limitation, a bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hypertransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an infiniband interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a video electronics standards association local (VLB) bus, or other suitable bus or a combination of two or more of these. Bus 1710 may include one or more buses, where appropriate. Although specific buses have been described and shown in the embodiments of the invention, any suitable buses or interconnects are contemplated by the invention.
The processing device may execute the information processing method in the embodiment of the present invention, thereby implementing the information processing method described in conjunction with fig. 1 to 14.
In addition, in combination with the information processing method in the above embodiments, the embodiments of the present invention may be implemented by providing a computer storage medium. The computer storage medium having computer program instructions stored thereon; the computer program instructions, when executed by a processor, implement any of the information processing methods in the embodiments described above.
It is to be understood that the embodiments of the invention are not limited to the particular configurations and processes described above and shown in the drawings. A detailed description of known methods is omitted herein for the sake of brevity. In the above embodiments, several specific steps are described and shown as examples. However, the method processes of the embodiments of the present invention are not limited to the specific steps described and illustrated, and those skilled in the art can make various changes, modifications and additions or change the order between the steps after comprehending the spirit of the embodiments of the present invention.
The functional blocks shown in the above-described structural block diagrams may be implemented as software, and the elements of the embodiments of the present invention are programs or code segments used to perform desired tasks. The program or code segments may be stored in a machine-readable medium or transmitted by a data signal carried in a carrier wave over a transmission medium or a communication link. A "machine-readable medium" may include any medium that can store or transfer information. Examples of a machine-readable medium include circuits, semiconductor memory devices, ROM, flash memory, Erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, Radio Frequency (RF) links, and so forth. The code segments may be downloaded via computer networks such as the internet, intranet, etc.
It should also be noted that the exemplary embodiments mentioned in this patent describe some methods or systems based on a series of steps or devices. However, the embodiments of the present invention are not limited to the order of the above steps, that is, the steps may be performed in the order mentioned in the embodiments, may be performed in an order different from the order in the embodiments, or may be performed simultaneously.
As described above, only the specific embodiments of the present invention are provided, and it can be clearly understood by those skilled in the art that, for convenience and brevity of description, the specific working processes of the system, the module and the unit described above may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again. It should be understood that the scope of the present invention is not limited thereto, and any person skilled in the art can easily conceive various equivalent modifications or substitutions within the technical scope of the present invention, and these modifications or substitutions should be covered within the scope of the present invention.
Claims (13)
1. An information processing method, characterized in that the method comprises:
acquiring first alarm information, wherein the first alarm information comprises identification information of a first alarm object;
determining an associated object of the first alarm object from a pre-configured database according to the identification information of the first alarm object, wherein the database comprises: the first alarm object, the association object and the association relationship between the first alarm object and the association object;
determining a second alarm object sending alarm information in the associated objects;
and determining a root alarm object of the first alarm object according to the incidence relation between the first alarm object and the second alarm object.
2. The method of claim 1, further comprising: a configuration database, the configuration database comprising:
respectively determining performance data of a plurality of objects in a telecommunication network within a preset time period;
determining the similarity of any two objects according to the performance data of the any two objects in a preset time period;
respectively determining the incidence relation of any two objects according to the similarity of any two objects;
storing the plurality of objects and the incidence relation in the database.
3. The method according to claim 2, wherein the determining the similarity between any two objects according to the performance data of the any two objects in a preset time period comprises:
respectively determining object vectors of any two objects in a preset time period according to performance data of the any two objects in the preset time period;
and calculating the object vector by using a cosine similarity algorithm to determine the similarity of any two objects.
4. The method according to claim 3, wherein the determining the object vectors of any two objects in the preset time period according to the performance data of any two objects in the preset time period respectively comprises:
preprocessing the performance data of the plurality of objects in a preset time period to obtain preprocessed performance data;
carrying out positive-too-standardization processing on the preprocessed performance data to obtain the performance data subjected to positive-too-standardization processing;
and respectively determining the object vectors of any two objects in a preset time period according to the performance data after just-too-normalization processing.
5. The method according to claim 2, wherein the determining the similarity between any two objects according to the performance data of the any two objects in a preset time period comprises:
and performing fitting degree calculation of the performance data of any two objects in a preset time period in a first direction or a second direction, and determining the similarity of any two objects.
6. The method according to claim 1, wherein the determining a root alarm object of the first alarm object according to the association relationship between the first alarm object and the second alarm object comprises:
and under the condition that the first alarm object is determined not to be the root alarm object, determining the root alarm object of the first alarm object from the second alarm object.
7. The method of claim 2, wherein the configuration database further comprises:
determining the physical relationship and/or deployment relationship of any two objects;
and determining the incidence relation of any two objects and the incidence relation type of any two objects according to the physical relation and/or the deployment relation.
8. The method of claim 1, wherein the preconfigured database further comprises: the association relationship type of the first alarm object and the association object;
under the condition that the association relationship type of any two association objects is a first association type, the performance data of the first alarm object depends on the association objects;
and under the condition that the association relationship type of any two associated objects is a second association type, the performance data of the first alarm object is influenced by the performance data of the associated objects.
9. The method of claim 8, wherein determining a root alarm object of the first alarm object comprises:
determining the incidence relation type of the first alarm object and the second alarm object from the database;
under the condition that the type of the incidence relation is convergence, sequentially searching the incidence objects of the second alarm object until the alarm object with the preset layer number is determined;
and the incidence relation between any two adjacent layers of alarm objects between the first alarm object and the alarm object with the preset layer number is a second incidence type.
10. The method according to claim 4, wherein the preprocessing the performance data of the plurality of objects within a preset time period to obtain preprocessed performance data comprises:
and denoising the performance data of the objects in a preset time period, and performing leakage repairing on vacant data in the performance data of the objects in the preset time period.
11. An information processing apparatus characterized by comprising:
the system comprises an acquisition module, a processing module and a processing module, wherein the acquisition module is used for acquiring first alarm information, and the first alarm information comprises identification information of a first alarm object;
a first determining module, configured to determine, according to the identification information of the first alarm object, an associated object of the first alarm object from a preconfigured database, where the database includes: the first alarm object, the association object and the association relationship between the first alarm object and the association object;
the second determining module is used for determining a second alarm object which sends alarm information in the associated objects;
and the third determining module is used for determining a root alarm object of the first alarm object according to the incidence relation between the first alarm object and the second alarm object.
12. A computing device, the device comprising: a processor and a memory storing computer program instructions;
the processor, when executing the computer program instructions, implements an information processing method as claimed in any one of claims 1 to 10.
13. A computer storage medium, characterized in that the computer storage medium has stored thereon computer program instructions which, when executed by a processor, implement the information processing method according to any one of claims 1 to 10.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911422642.XA CN111193627B (en) | 2019-12-31 | 2019-12-31 | Information processing method, device, equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911422642.XA CN111193627B (en) | 2019-12-31 | 2019-12-31 | Information processing method, device, equipment and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111193627A true CN111193627A (en) | 2020-05-22 |
| CN111193627B CN111193627B (en) | 2022-08-12 |
Family
ID=70710582
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201911422642.XA Active CN111193627B (en) | 2019-12-31 | 2019-12-31 | Information processing method, device, equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111193627B (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111710409A (en) * | 2020-05-29 | 2020-09-25 | 吾征智能技术(北京)有限公司 | Intelligent screening system based on abnormal change of human sweat |
| CN114285730A (en) * | 2020-09-18 | 2022-04-05 | 华为技术有限公司 | Method and device for determining fault root cause and related equipment |
| EP4170975A4 (en) * | 2020-06-24 | 2023-11-29 | ZTE Corporation | Tree model construction method, apparatus and device, and storage medium |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101577648A (en) * | 2009-06-26 | 2009-11-11 | 杭州华三通信技术有限公司 | Method for determining root cause of network fault and analytic equipment thereof |
| CN102291247A (en) * | 2010-06-18 | 2011-12-21 | 中兴通讯股份有限公司 | Alarm association diagram generation method and device and association alarm determination method and device |
| CN104348667A (en) * | 2014-11-11 | 2015-02-11 | 上海新炬网络技术有限公司 | Fault positioning method based on warning information |
| CN109450677A (en) * | 2018-10-29 | 2019-03-08 | 中国联合网络通信集团有限公司 | A kind of localization method and device of root failure |
| CN109951306A (en) * | 2017-12-20 | 2019-06-28 | 中国移动通信集团湖北有限公司 | Processing method, device, equipment and the medium of alarm |
| CN110321268A (en) * | 2019-06-12 | 2019-10-11 | 平安科技（深圳）有限公司 | A kind of alarm information processing method and device |
-
2019
- 2019-12-31 CN CN201911422642.XA patent/CN111193627B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101577648A (en) * | 2009-06-26 | 2009-11-11 | 杭州华三通信技术有限公司 | Method for determining root cause of network fault and analytic equipment thereof |
| CN102291247A (en) * | 2010-06-18 | 2011-12-21 | 中兴通讯股份有限公司 | Alarm association diagram generation method and device and association alarm determination method and device |
| CN104348667A (en) * | 2014-11-11 | 2015-02-11 | 上海新炬网络技术有限公司 | Fault positioning method based on warning information |
| CN109951306A (en) * | 2017-12-20 | 2019-06-28 | 中国移动通信集团湖北有限公司 | Processing method, device, equipment and the medium of alarm |
| CN109450677A (en) * | 2018-10-29 | 2019-03-08 | 中国联合网络通信集团有限公司 | A kind of localization method and device of root failure |
| CN110321268A (en) * | 2019-06-12 | 2019-10-11 | 平安科技（深圳）有限公司 | A kind of alarm information processing method and device |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111710409A (en) * | 2020-05-29 | 2020-09-25 | 吾征智能技术(北京)有限公司 | Intelligent screening system based on abnormal change of human sweat |
| EP4170975A4 (en) * | 2020-06-24 | 2023-11-29 | ZTE Corporation | Tree model construction method, apparatus and device, and storage medium |
| CN114285730A (en) * | 2020-09-18 | 2022-04-05 | 华为技术有限公司 | Method and device for determining fault root cause and related equipment |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111193627B (en) | 2022-08-12 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111193627B (en) | Information processing method, device, equipment and storage medium | |
| CN108182515B (en) | Intelligent rule engine rule output method, equipment and computer readable storage medium | |
| CN110263824B (en) | Model training method, device, computing equipment and computer readable storage medium | |
| CN116126945B (en) | Sensor running state analysis method and system based on data analysis | |
| CN111444294A (en) | Track completion method and device and electronic equipment | |
| CN114968727B (en) | Database through infrastructure fault positioning method based on artificial intelligence operation and maintenance | |
| CN109874104B (en) | User position positioning method, device, equipment and medium | |
| CN111737377B (en) | Method and device for identifying drift trajectory, computing equipment and storage medium | |
| CN116304909A (en) | Abnormality detection model training method, fault scene positioning method and device | |
| CN107579944B (en) | Artificial intelligence and MapReduce-based security attack prediction method | |
| CN111540202B (en) | Similar bayonet determining method and device, electronic equipment and readable storage medium | |
| CN114443483A (en) | Test method and device of artificial intelligence system, electronic equipment and medium | |
| CN109639526A (en) | Network Data Control method, apparatus, equipment and medium | |
| CN112055837A (en) | Industrial equipment matching method and device | |
| CN110515758B (en) | Fault positioning method and device, computer equipment and storage medium | |
| CN109409411B (en) | Problem positioning method and device based on operation and maintenance management and storage medium | |
| US9473368B1 (en) | Network graph representation of physically connected network | |
| US11847544B2 (en) | Preventing data leakage in automated machine learning | |
| CN113780239A (en) | Iris recognition method, iris recognition device, electronic equipment and computer readable medium | |
| CN116295466A (en) | Map generation method, map generation device, electronic device, storage medium and vehicle | |
| CN114331349A (en) | Scientific research project management method and system based on Internet of things technology | |
| CN113449062A (en) | Track processing method and device, electronic equipment and storage medium | |
| CN113255539A (en) | Multi-task fusion face positioning method, device, equipment and storage medium | |
| CN114554535A (en) | Method, device, equipment and storage medium for intelligently identifying common coverage cell pairs | |
| CN115600131B (en) | Automatic test system based on graphical test platform |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |