CN114765575B - Network fault cause prediction method and device and electronic equipment - Google Patents

Abstract

The present invention provides a method, device and electronic device for predicting the cause of a network fault, which solves the problem of low accuracy in the existing prediction of the cause of a network fault. The method of the present invention comprises: obtaining a classification feature vector in a fault work order, the classification feature vector comprising a first-class feature vector and a second-class feature vector; obtaining a target fault cause category to which the fault work order belongs according to the first-class feature vector and a first classification prediction model; obtaining a target fault cause subcategory of the fault work order in the target fault cause category according to the second-class feature vector and a second classification prediction model corresponding to the target fault cause category. The present invention adopts a two-step prediction method, i.e., first predicting a major category of fault causes, and then predicting a subdivided category of fault causes in the major category of fault causes, which can effectively reduce the number of categories predicted in each step and improve the accuracy of the prediction results.

Description

A network failure cause prediction method, device and electronic equipment

Technical Field

The present invention relates to the field of artificial intelligence technology, and in particular to a method, device and electronic equipment for predicting the cause of a network failure.

Background technique

In the network system, there are many types of network elements and the network structure is complex. Various faults will inevitably occur during the operation of the network. After the fault occurs, the network operation and maintenance personnel need to troubleshoot the fault, find out the cause of the fault, and then take corresponding treatment measures to help the existing network resume operation.

Specifically, during the operation of the existing network, after a fault occurs, the network equipment will generate an alarm and report it to the network management system. The network management system dispatches an order to the operation and maintenance personnel based on the received alarm and certain dispatching rules. The operation and maintenance personnel will investigate the cause of the fault based on the alarm and other information, and then take corresponding treatment measures based on the cause of the fault. After the fault is resolved, the fault cause and treatment measures will be returned to the corresponding work order.

In the existing fault cause prediction technology solutions, there are many categories of fault causes, some of which are relatively similar, and the accuracy is low when directly predicted.

Summary of the invention

The purpose of the present invention is to provide a method, device and electronic device for predicting the cause of a network failure, so as to solve the problem of low accuracy in predicting the cause of a network failure.

In order to achieve the above object, the present invention provides a method for predicting the cause of a network failure, comprising:

Obtaining a classification feature vector in the fault work order, wherein the classification feature vector includes a first-category feature vector and a second-category feature vector;

Obtaining a target fault cause category to which the fault work order belongs according to the first type of feature vector and the first classification prediction model;

A target fault cause subcategory of the fault work order in the target fault cause category is obtained according to the second type feature vector and a second classification prediction model corresponding to the target fault category.

The step of obtaining the classification feature vector in the fault work order includes:

Obtain a pending fault work order, wherein the fields of the fault work order include an alarm title, a network element name, a network element type, and a fault occurrence time;

Based on the correspondence between the fields of the fault work order and the feature vector and/or the feature extraction model, the classification feature vector in the fault work order is extracted.

Wherein, the classification feature vector includes:

A first feature vector for characterizing the alarm title;

A second feature vector for characterizing the fault cause category corresponding to the alarm title;

A third characteristic vector for characterizing the network element type;

A fourth eigenvector for characterizing a fault cause category corresponding to the network element type;

A fifth eigenvector for characterizing the alarm information associated with the fault work order;

a sixth feature vector for characterizing a subcategory of a fault cause corresponding to the alarm title; and a seventh feature vector for characterizing a subcategory of a fault cause corresponding to a network element type;

The first type of feature vectors includes: the first feature vector, the second feature vector, the third feature vector, the fourth feature vector and the fifth feature vector;

The second type of feature vectors includes: the first feature vector, the second feature vector, the third feature vector, the fourth feature vector, the fifth feature vector, the sixth feature vector and the seventh feature vector.

Wherein, obtaining the target fault cause category to which the fault work order belongs according to the first type of feature vector and the first classification prediction model includes:

Classifying the first type of feature vectors by using the first classification prediction model to obtain probability values of each fault cause category;

The fault cause category corresponding to the maximum probability value among the probability values of each fault cause category is determined as the target fault cause category to which the fault work order belongs.

Wherein, obtaining the target fault cause subcategory of the fault work order in the target fault cause category according to the second type feature vector and the second classification prediction model corresponding to the target fault cause category includes:

Classifying the second type of feature vectors by using the second classification prediction model to obtain probability values of each fault cause subcategory of the fault work order in the target fault cause category;

The fault cause subcategory corresponding to the maximum probability value among the probability values of each fault cause subcategory is determined as the target fault cause subcategory.

Wherein, the method further comprises:

Acquire multiple historical fault work orders and multiple historical alarm information, where the fields of each of the historical fault work orders include an alarm title, a network element name, a network element type, a fault occurrence time, a fault cause category, and a fault cause subcategory corresponding to the fault cause category, and the fields of each of the historical alarm information include an alarm title, a network element name, and an alarm start time;

According to the fields of the historical fault work order and the fields of the historical alarm information, a classification feature vector is obtained, the classification feature vector comprising: a first feature vector for characterizing the alarm title, a second feature vector for characterizing the fault cause category corresponding to the alarm title, a third feature vector for characterizing the network element type, a fourth feature vector for characterizing the fault cause category corresponding to the network element type, a fifth feature vector for characterizing the alarm information associated with the fault work order, a sixth feature vector for characterizing the fault cause subcategory corresponding to the alarm title, and a seventh feature vector for characterizing the fault cause subcategory corresponding to the network element type;

Model training is performed based on the first feature vector, the second feature vector, the third feature vector, the fourth feature vector, the fifth feature vector, and the category label of the fault cause category to obtain a first classification prediction model.

Wherein, after obtaining the classification feature vector according to the fields of the historical fault work order and the fields of the historical alarm information, the method further includes:

According to the fault cause category, the plurality of historical fault work orders are grouped to obtain a plurality of groups of historical fault work order data;

According to the category labels and classification feature vectors of the fault cause subcategories corresponding to each group of historical fault work order data, model training is performed on each group of historical fault work order data to obtain multiple second classification prediction models.

The present invention also provides a network failure cause prediction device, comprising:

A first acquisition module is used to acquire a classification feature vector in the fault work order, wherein the classification feature vector includes a first-category feature vector and a second-category feature vector;

A first fault cause prediction module, used for obtaining a target fault cause category to which the fault work order belongs according to the first type of feature vector and a first classification prediction model;

The second fault cause prediction module is used to obtain a target fault cause subcategory of the fault work order in the target fault cause category according to the second type feature vector and a second classification prediction model corresponding to the target fault cause category.

The present invention also provides an electronic device, comprising a processor and a transceiver, wherein the transceiver receives and sends data under the control of the processor, and the processor is used to perform the following operations:

Obtaining a classification feature vector in the fault work order, wherein the classification feature vector includes a first-category feature vector and a second-category feature vector;

Obtaining a target fault cause category to which the fault work order belongs according to the first type of feature vector and the first classification prediction model;

According to the second type of feature vector and the second classification prediction model, a target fault cause subcategory of the fault work order in the target fault cause category is obtained.

Wherein, the processor is further used for:

Obtain a pending fault work order, wherein the fields of the fault work order include an alarm title, a network element name, a network element type, and a fault occurrence time;

Based on the correspondence between the fields of the fault work order and the feature vector and/or the feature extraction model, the classification feature vector in the fault work order is extracted.

Wherein, the classification feature vector includes:

A first feature vector for characterizing the alarm title;

A second feature vector for characterizing the fault cause category corresponding to the alarm title;

A third characteristic vector for characterizing the network element type;

A fourth eigenvector for characterizing a fault cause category corresponding to the network element type;

A fifth eigenvector for characterizing the alarm information associated with the fault work order;

A sixth feature vector for characterizing a subcategory of a fault cause corresponding to the alarm title; and

A seventh eigenvector for characterizing a subcategory of a fault cause corresponding to a network element type;

The first type of feature vectors includes: the first feature vector, the second feature vector, the third feature vector, the fourth feature vector and the fifth feature vector;

The second type of feature vectors includes: the first feature vector, the second feature vector, the third feature vector, the fourth feature vector, the fifth feature vector, the sixth feature vector and the seventh feature vector.

Wherein, the processor is further used for:

Classifying the first type of feature vectors by using the first classification prediction model to obtain probability values of each fault cause category;

The fault cause category corresponding to the maximum probability value among the probability values of each fault cause category is determined as the target fault cause category to which the fault work order belongs.

Wherein, the processor is further used for:

Classifying the second type of feature vectors by using the second classification prediction model to obtain probability values of each fault cause subcategory of the fault work order in the target fault cause category;

The fault cause subcategory corresponding to the maximum probability value among the probability values of each fault cause subcategory is determined as the target fault cause subcategory.

Wherein, the processor is further used for:

Acquire multiple historical fault work orders and multiple historical alarm information, where the fields of each of the historical fault work orders include an alarm title, a network element name, a network element type, a fault occurrence time, a fault cause category, and a fault cause subcategory corresponding to the fault cause category, and the fields of each of the historical alarm information include an alarm title, a network element name, and an alarm start time;

According to the fields of the historical fault work order and the fields of the historical alarm information, a classification feature vector is obtained, the classification feature vector comprising: a first feature vector for characterizing the alarm title, a second feature vector for characterizing the fault cause category corresponding to the alarm title, a third feature vector for characterizing the network element type, a fourth feature vector for characterizing the fault cause category corresponding to the network element type, a fifth feature vector for characterizing the alarm information associated with the fault work order, a sixth feature vector for characterizing the fault cause subcategory corresponding to the alarm title, and a seventh feature vector for characterizing the fault cause subcategory corresponding to the network element type;

Model training is performed based on the first feature vector, the second feature vector, the third feature vector, the fourth feature vector, the fifth feature vector, and the category label of the fault cause category to obtain a first classification prediction model.

Wherein, the processor is further used for:

According to the fault cause category, the plurality of historical fault work orders are grouped to obtain a plurality of groups of historical fault work order data;

According to the category labels and classification feature vectors of the fault cause subcategories corresponding to each group of historical fault work order data, model training is performed on each group of historical fault work order data to obtain multiple second classification prediction models.

The present invention also provides an electronic device, comprising a memory, a processor, and a program stored in the memory and executable on the processor; when the processor executes the program, the network failure cause prediction method as described above is implemented.

The present invention also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps in the network fault cause prediction method as described above are implemented.

The above technical solution of the present invention has at least the following beneficial effects:

In an embodiment of the present invention, a classification feature vector in a fault work order is obtained, and the classification feature vector includes a first-category feature vector and a second-category feature vector; based on the first-category feature vector and a first classification prediction model, a target fault cause category to which the fault work order belongs is obtained; based on the second-category feature vector and a second classification prediction model corresponding to the target fault cause category, a target fault cause subcategory of the fault work order in the target fault cause category is obtained. In this way, through a two-step prediction method, that is, first predicting a major category of fault causes, and then predicting a subdivided category of fault causes in the major category of fault causes, the number of categories predicted in each step can be effectively reduced, thereby improving the accuracy of the prediction results.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram showing a flow chart of a method for predicting network failure causes according to an embodiment of the present invention;

FIG2 is a schematic diagram showing the model training process of the first classification prediction model and the second classification prediction model according to an embodiment of the present invention;

FIG3 is a second flow chart of a method for predicting network failure causes according to an embodiment of the present invention;

FIG4 is a schematic diagram showing a module of a device for predicting network failure causes according to an embodiment of the present invention;

FIG5 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.

Detailed ways

In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

Aiming at the problem of low accuracy in current prediction of network fault causes, the present invention provides a network fault cause prediction method, device and electronic equipment.

As shown in Figure 1, it is a schematic diagram of the flow of a method for predicting network failure causes provided by an embodiment of the present invention. The method specifically includes:

Step 101, obtaining a classification feature vector in a fault work order, wherein the classification feature vector includes a first-category feature vector and a second-category feature vector;

In this step, the fault work order is generated based on the received alarm information and in accordance with the preset dispatching rules. It is a new work order, that is, the cause of the fault has not yet been recorded on the fault work order.

Step 102, obtaining a target fault cause category to which the fault work order belongs according to the first type feature vector and the first classification prediction model;

In this step, the first classification prediction model is a pre-trained model. The first type of feature vector of the fault work order is taken as input and input into the first classification prediction model to output the target fault cause category to which the fault work order belongs, that is, the major category of fault cause to which the fault work order belongs.

The first classification prediction model is trained based on historical fault work orders and alarm data.

Step 103: Obtain a target fault cause subcategory of the fault work order in the target fault cause category according to the second type feature vector and a second classification prediction model corresponding to the target fault cause category.

In this step, the second classification prediction model is a pre-trained model.

Here, the second type of feature vector of the fault work order is used as input to the second classification prediction model, and the target fault cause subcategory of the fault work order in the target fault cause category is output, that is, the category of the fault cause subdivision in the fault cause category.

It should be noted that since historical fault work orders include the fault causes and handling measures recorded by the operation and maintenance personnel after the fault is resolved, and contain a lot of operation and maintenance experience, we mine the information contained in the historical fault work orders and train the machine learning model to obtain the first classification prediction model and the second classification prediction model. Then, the fault cause is automatically predicted based on the work order information and alarm information in the new dispatch, thereby saving the operation and maintenance personnel the time to troubleshoot the cause of the fault.

The network fault cause prediction method of the embodiment of the present invention obtains the classification feature vector in the fault work order, and the classification feature vector includes a first type of feature vector and a second type of feature vector; according to the first type of feature vector and the first classification prediction model, the target fault cause category to which the fault work order belongs is obtained; according to the second type of feature vector and the second classification prediction model corresponding to the target fault cause category, the target fault cause subcategory of the fault work order in the target fault cause category is obtained. In this way, through a two-step prediction method, that is, first predicting the main category of fault causes, and then predicting the subdivided categories of fault causes in the main category of fault causes, the number of categories predicted in each step can be effectively reduced, and the accuracy of the prediction results can be improved.

As an optional implementation, step 101 of the embodiment of the present invention may specifically include:

Obtain a pending fault work order, wherein the fields of the fault work order include an alarm title, a network element name, a network element type, and a fault occurrence time;

In this step, after a network failure occurs, an alarm message is generated. Based on the received alarm message, the electronic device generates a pending fault work order according to a preset dispatching rule.

Generally, the pending fault worksheet includes but is not limited to fields such as alarm title, network element name, network element type, and fault occurrence time. It should be noted that the pending fault worksheet does not record the cause of the network fault and the corresponding treatment measures.

Based on the correspondence between the fields of the fault work order and the feature vector and/or the feature extraction model, the classification feature vector in the fault work order is extracted.

Optionally, the classification feature vector includes:

A first feature vector for characterizing the alarm title;

A second feature vector for characterizing the fault cause category corresponding to the alarm title;

A third characteristic vector for characterizing the network element type;

A fourth eigenvector for characterizing a fault cause category corresponding to the network element type;

A fifth eigenvector for characterizing the alarm information associated with the fault work order;

A sixth feature vector for characterizing a subcategory of a fault cause corresponding to the alarm title; and

A seventh eigenvector for characterizing a subcategory of a fault cause corresponding to a network element type;

The first type of feature vectors includes: the first feature vector, the second feature vector, the third feature vector, the fourth feature vector and the fifth feature vector;

The second type of feature vectors includes: the first feature vector, the second feature vector, the third feature vector, the fourth feature vector, the fifth feature vector, the sixth feature vector and the seventh feature vector.

The first feature vector, the second feature vector and the sixth feature vector are all obtained according to the corresponding relationship between the alarm title of the fault work order and the feature vector.

That is to say, the alarm title has a first corresponding relationship with the feature vector representing itself, and through the first corresponding relationship, the first feature vector representing the alarm title of the fault work order is obtained; the alarm title has a second corresponding relationship with the feature vector representing the fault cause category corresponding to the alarm title, and through the second corresponding relationship, the second feature vector representing the fault cause category corresponding to the alarm title of the fault work order is obtained; the alarm title has a third corresponding relationship with the feature vector representing the fault cause subcategory corresponding to the alarm title, and through the third corresponding relationship, the sixth feature vector representing the fault cause subcategory corresponding to the alarm title of the fault work order is obtained.

The third eigenvector, the fourth eigenvector and the seventh eigenvector are all obtained according to the corresponding relationship between the network element type of the fault work order and the eigenvector.

That is to say, the network element type has a fourth corresponding relationship with the feature vector representing itself, and through the fourth corresponding relationship, the third feature vector representing the network element type of the fault work order is obtained; the network element type has a fifth corresponding relationship with the feature vector representing the fault cause category corresponding to the network element type, and through the fifth corresponding relationship, the fourth feature vector representing the fault cause category corresponding to the network element type of the fault work order is obtained; the network element type has a sixth corresponding relationship with the feature vector representing the fault cause subcategory corresponding to the network element type, and through the sixth corresponding relationship, the seventh feature vector representing the fault cause subcategory corresponding to the network element type of the fault work order is obtained.

It should be pointed out that the fifth feature vector is obtained based on the feature extraction model. Specifically, first, extract the alarm information associated with the fault work order to obtain m alarms, and pass each alarm information through the first feature extraction model (such as the CBOW model of word2vec) to obtain the corresponding vector; then, obtain the first mean vec_cbow of the m vectors; then, pass each alarm information through the second feature extraction model (such as the Skip-grams model of word2vec) to obtain the corresponding vector; then, obtain the second mean vec_sg of the m vectors; finally, concatenate the first mean vec_cbow and the second mean vec_sg to obtain the fifth feature vector.

It should be noted that, when the alarm information meets the first condition and the second condition, it is determined that the alarm information is the alarm information associated with the fault work order.

Here, the first condition is that the alarm start time _t2 of the alarm information is between ( _t1 - _tA , _t1 + _tB ), where _t1 represents the fault occurrence time of the fault work order, and _tA and _tB are preset time values.

That is to say, the alarm start time of the alarm information is between a period of time before and a period of time after the fault occurrence time of the fault work order.

The second condition is that the network element name in the alarm information is the same as the network element name in the fault work order.

Here, word2vec can quickly and effectively express a word into a vector form based on a given corpus through an optimized training model, providing a new tool for applied research in the field of natural language processing. Word2vec relies on the Skip-grams model or the Continuous Bag of Words (CBOW) model to build neural word embeddings.

As an optional implementation, step 102 of the method of the embodiment of the present invention, obtaining the target fault cause category to which the fault work order belongs according to the first type of feature vector and the first classification prediction model, may include:

Classifying the first type of feature vectors by using the first classification prediction model to obtain probability values of each fault cause category;

Here, each fault cause category is each fault cause category to which the fault work order belongs, that is, each major fault cause category to which the fault work order belongs.

It should be noted that based on the first type of feature vector, through the classification of the first classification prediction model, the major category of fault cause to which the fault work order belongs may correspond to many types, and the most likely major category of fault cause can be determined by comparing and measuring the probability values.

The fault cause category corresponding to the maximum probability value among the probability values of each fault cause category is determined as the target fault cause category to which the fault work order belongs.

Through this implementation, the target fault cause category to which the fault work order belongs can be predicted.

As an optional implementation, in step 103 of the method of the embodiment of the present invention, obtaining the target fault cause subcategory of the fault work order in the target fault cause category according to the second type of feature vector and the second classification prediction model corresponding to the target fault cause category includes:

Classifying the second type of feature vectors by using the second classification prediction model to obtain probability values of each fault cause subcategory of the fault work order in the target fault cause category;

In this step, it should be noted that the second classification prediction model is determined according to the target fault cause category to which the fault work order belongs. In other words, different fault cause categories correspond to different second classification prediction models.

The fault cause subcategory corresponding to the maximum probability value among the probability values of each fault cause subcategory is determined as the target fault cause subcategory.

This implementation is similar to the above-mentioned determination of the target fault cause category of the fault work order, and the most likely fault cause subcategory can be determined by comparing and measuring the probability values.

From the above description, it can be seen that the key to the accuracy of predicting the cause of the fault work order lies in the classification prediction model. How to train a good classification prediction model? As an optional implementation method, the method of the embodiment of the present invention may also include:

Acquire multiple historical fault work orders and multiple historical alarm information, where the fields of each of the historical fault work orders include an alarm title, a network element name, a network element type, a fault occurrence time, a fault cause category, and a fault cause subcategory corresponding to the fault cause category, and the fields of each of the historical alarm information include an alarm title, a network element name, and an alarm start time;

Here, the "multiple" in the multiple historical fault work orders and the multiple historical alarm information can be understood as a large number. It should be noted that these historical fault work orders and historical alarm information are valid data, that is, there are no empty fields in the above historical fault work orders and historical alarm information.

Among a large number of historical fault tickets and a large amount of historical alarm information, first, remove the data containing empty fields; then, perform regularization matching on the alarm titles in the filtered historical fault tickets and the alarm information, and extract the alarm content. For example, for "xxx" with "yyy alarm", extract the "yyy alarm" part; finally, format the fault occurrence time and alarm start time and convert them into a unified time format, such as datetime64 format.

According to the fields of the historical fault work order and the fields of the historical alarm information, a classification feature vector is obtained, the classification feature vector comprising: a first feature vector for characterizing the alarm title, a second feature vector for characterizing the fault cause category corresponding to the alarm title, a third feature vector for characterizing the network element type, a fourth feature vector for characterizing the fault cause category corresponding to the network element type, a fifth feature vector for characterizing the alarm information associated with the fault work order, a sixth feature vector for characterizing the fault cause subcategory corresponding to the alarm title, and a seventh feature vector for characterizing the fault cause subcategory corresponding to the network element type;

In this step, the first feature vector, the second feature vector and the sixth feature vector are obtained according to the alarm title field of the historical fault work order.

Specifically, historical fault work orders are processed as follows:

1) Perform one-hot encoding on the alarm title of the historical fault work order to obtain a one-hot vector; store the alarm title and the corresponding one-hot vector as the key and value of the dictionary, which is recorded as dict_1.

The one-hot vector here is the first feature vector used to characterize the alarm title.

2) Obtain the number of times each major category of fault cause appears in the alarm title in the historical fault work order, and perform normalization to obtain the vector corresponding to the alarm title; store the alarm title and the corresponding vector as the key and value of the dictionary, and the dictionary is recorded as dict_2.

Here, the vector is the second feature vector used to characterize the fault cause category corresponding to the alarm title.

For example, among all the work orders, there are 4 work orders with alarm title A. The alarm titles and fault causes of these 4 work orders are as follows:

Alarm title A Fault cause category 1

Alarm title A Fault cause category 1

Alarm title A Fault cause category 3

Alarm title A Fault cause category 4

Then the vector corresponding to the alarm title A is [2/4, 0, 1/4, 1/4, 0, ···], and the dimension of the vector is the number of fault cause categories.

3) One-hot encode the network element type of the historical fault work order to obtain a one-hot vector; store the network element type and the corresponding one-hot vector as the key and value of the dictionary, and the dictionary is recorded as dict_3.

The one-hot vector here is the third eigenvector used to characterize the alarm title.

4) Obtain the number of times each major type of fault cause appears on the network element type in the historical fault work order, and perform normalization processing to obtain the vector corresponding to the network element type; store the network element type and its corresponding vector as the key and value of the dictionary, and the dictionary is recorded as dict_4.

Here, the vector is the fourth eigenvector used to characterize the fault cause category corresponding to the network element type.

For example, among all the work orders, there are 4 work orders with network element type A. The network element types and fault causes in these 4 work orders are as follows:

Network element type A fault cause category 1

Network element type A fault cause category 1

Network element type A fault cause category 3

Network element type A fault cause category 4

Then the vector corresponding to the network element type A is [2/4, 0, 1/4, 1/4, 0, ···], and the dimension of the vector is the number of fault cause categories.

5) For the fifth eigenvector used to characterize the alarm information associated with the fault work order

The fault tickets here refer to historical fault tickets.

First, for each historical fault work order, extract the associated alarm information.

Here, when the alarm information satisfies the first condition and the second condition, it is determined that the alarm information is the alarm information associated with the historical fault work order.

Here, the first condition is that the alarm start time _t2 of the alarm information is between ( _t1 - _tA , _t1 + _tB ), where _t1 represents the fault occurrence time of the historical fault work order, and _tA and _tB are preset time values.

That is to say, the alarm start time of the alarm information is between a period of time before and a period of time after the fault occurrence time of the historical fault work order.

The second condition is that the network element name in the alarm information is the same as the network element name in the historical fault work order.

Afterwards, the alarm information associated with each historical fault work order is sorted in the order of the alarm start time, and the alarm title of each alarm information is extracted and used as a word to form an alarm sentence.

Here, the alarm statement is used to describe a series of ordered alarm information generated on the network element within a period of time when the historical fault work order fault occurs.

Then, the alarm statements corresponding to each historical fault work order are combined into a document as corpus, and the corpus is used to train two wrod2vec models, the CBOW model and the Skip-gram model, respectively, to obtain two vector representations of each alarm information; the trained CBOW model model_cbow and Skip-gram model model_sg are saved;

Finally, for each historical fault work order, the alarm title in the alarm statement is queried for its alarm vector, and then the alarm vectors are averaged. The CBOW model and the Skip-gram model vectorize and average the alarm title respectively. The two vectors obtained by the two models are concatenated as the feature vector that matches the historical fault work order to the alarm information, that is, the fifth feature vector.

6) Obtain the number of times each fault cause subcategory (i.e., the category of fault cause subdivision) appears in the alarm title in the historical fault work order, and perform normalization processing to obtain the vector corresponding to the alarm title; store the alarm title and the corresponding vector as the key and value, and the dictionary is recorded as dict_5.

Here, the vector is the sixth feature vector used to characterize the fault cause subcategory corresponding to the alarm title.

7) Obtain the number of times each fault cause subcategory (i.e., the category of fault cause subdivision) appears on the network element type in the historical fault work order, and perform normalization processing to obtain the vector corresponding to the network element type; store the network element type and the corresponding vector as the key and value, and the dictionary is recorded as dict_6.

Here, the vector is the seventh characteristic vector used to characterize the fault cause subcategory corresponding to the network element type.

Model training is performed based on the first feature vector, the second feature vector, the third feature vector, the fourth feature vector, the fifth feature vector, and the category label of the fault cause category to obtain a first classification prediction model.

It should be noted that, optionally, the category label of the fault cause category is obtained by digitally encoding the fault cause category of the historical fault work order, that is, using numbers 1 to N to identify N types of fault cause categories as category labels.

Here, the first eigenvector, the second eigenvector, the third eigenvector, the fourth eigenvector and the fifth eigenvector are taken as inputs and input into a preset classification model, and the classification results, i.e., the category labels, are output, and the category labels in the classification results are compared with the corresponding actual category labels. The parameters in the preset classification model are continuously adjusted to narrow the difference between the category labels in the classification results and the corresponding actual category labels, so that the difference is narrowed to a preset range, or the preset classification model reaches the minimum convergence position.

Here, the preset classification model used in model training is the GBDT model or the XGBoost model.

Here, the GBDT (Gradient Boosting Decision Tree) model is an additive model that trains a set of CART (Classification and Regression Trees) in series, and finally sums up the prediction results of all regression trees to obtain a strong learner. Each new tree fits the negative gradient direction of the current loss function.

The XGBoost (Extreme Gradient Boosting) model also generates models serially and takes the sum of all models as output.

Here, the trained first classification prediction model model_1 is saved.

Furthermore, after obtaining the classification feature vector according to the fields of the historical fault work order and the fields of the historical alarm information, the method further includes:

According to the fault cause category, the plurality of historical fault work orders are grouped to obtain a plurality of groups of historical fault work order data;

Here, all data, that is, all historical fault work orders are grouped according to the fault cause categories to obtain multiple groups of historical fault work order data.

Here, different groups of historical fault work order data correspond to different fault cause categories.

According to the category labels and classification feature vectors of the fault cause subcategories corresponding to each group of historical fault work order data, model training is performed on each group of historical fault work order data to obtain multiple second classification prediction models.

It should be noted that, assuming that there are N types of fault cause categories, A ¹ , ···, ^AN , then in the first set of data, the fault cause categories, that is, the major categories of fault causes are all A ¹ , and the labels of the first set of data are its fault cause subcategories. Assuming that the fault cause subcategories corresponding to the major category of fault cause A ¹ , that is, the categories of fault cause subdivision, have a total of n_1 types, then the labels of the first set of data are To/> There are n_1 labels in total.

Here, the classification feature vector specifically refers to a first feature vector, a second feature vector, a third feature vector, a fourth feature vector, a fifth feature vector, a sixth feature vector, and a seventh feature vector.

A model is trained using each set of historical fault work order data, that is, the classification feature vectors in each set of historical fault work orders. The preset classification model used during model training is the GBDT model or the XGBoost model.

Here, the trained N second classification prediction models model_2_1 to model_2_N are saved.

Here, the specific training process of the first classification prediction model and the second classification prediction model can refer to Figure 2.

The following is an example, as shown in FIG3 , to specifically illustrate the implementation process of the method of the embodiment of the present invention.

S1: Receive the work order to be predicted.

Here, the work order to be predicted is a new work order, and the work order to be predicted includes four fields: alarm title, network element name, network element type, and fault occurrence time.

It should be noted that the field of the fault cause subcategory (ie, fault cause subdivision category) of the work order to be predicted is predicted based on the above four fields and the alarm information associated with the work order.

S2: Extract the feature vector of the first-level classification of the work order.

Specifically, 1) one-hot feature of the alarm title: take the alarm title in the work order as the key, and query the feature vector vec_1 corresponding to the alarm title in the dictionary dict_1, that is, the first feature vector.

2) Fault cause distribution characteristics of alarm titles: The alarm title in the work order is used as the key, and the feature vector vec_2 corresponding to the alarm title, that is, the second feature vector, is searched in the dictionary dict_2.

3) One-hot feature of network element type: Use the network element type of the work order as the key and query the feature vector vec_3 corresponding to the network element type in the dictionary dict_3, that is, the third feature vector.

4) Distribution characteristics of major fault causes by network element type: The network element type of the work order is used as the key, and the feature vector vec_4 corresponding to the network element type, i.e., the fourth feature vector, is searched in the dictionary dict_4.

5) Word2vec features of work orders associated with alarms:

First, extract the alarm information associated with the work order. The extraction method is the same as that in the training phase. Assuming that there are h alarms associated, for each alarm, use the wrod2vec model CBOW model to obtain its vector, and then find the mean vec_cbow of the h vectors; then, for each alarm, use the Skip-grams model to obtain its vector, and find the mean vec_sg of the h vectors; finally, concatenate the mean vec_cbow and the mean vec_sg to obtain the feature vector vec_5, which is the fifth feature vector.

6) Distribution characteristics of fault cause segmentation on alarm title: Take the alarm title in the work order as the key and query the feature vector vec_6 corresponding to the alarm title in the dictionary dict_5.

7) Distribution characteristics of fault cause segmentation by network element type: The network element type in the work order is used as the key, and the feature vector vec_7 corresponding to the network element type is searched in the dictionary dict_6.

Here, the above vec_1, vec_2, vec_3, vec_4 and vec_5 belong to the feature vectors of the first level classification, that is, the first type of feature vectors in the above embodiment.

S3: Input the feature vector of the first-level classification into model_1 for classification.

Here, the extracted feature vectors vec_1, vec_2, vec_3, vec_4, and vec_5 are concatenated and then input into model_1 for classification to obtain the probabilities p_1, ···, p_N belonging to each major category of fault causes.

S4: Select the fault cause category i with the highest probability in the prediction results.

The prediction result is the probability p_1,...,p_N of belonging to each major category of fault causes. The category i (1≤i≤N) with the largest probability value is the category to which the work order belongs in the first classification step.

S5: Extract the feature vector of the secondary classification of the work order.

The above vec_1, vec_2, vec_3, vec_4, vec_5, vec_6 and vec_7 belong to the feature vectors of the secondary classification, that is, the second type of feature vectors in the above embodiment. The specific extraction process is detailed in the description of part S2, which will not be repeated here.

S6: Input the feature vector of the secondary classification into model_2_i for classification.

Here, the extracted feature vectors vec_1, vec_2, vec_3, vec_4, vec_5, vec_6 and vec_7 are concatenated and then input into model_2_i for classification to obtain the probability of each fault cause subdivision in the fault cause category i.

S7: Select the fault cause segment j with the highest probability in the prediction results.

The prediction result is the probability of each fault cause subdivided into the fault cause category i. The category j (1≤j≤n_i) with the largest probability value is the category to which the work order belongs in the second step classification, that is, the final fault cause subdivision category.

The network fault cause prediction method of the embodiment of the present invention obtains the classification feature vector in the fault work order, and the classification feature vector includes a first type of feature vector and a second type of feature vector; according to the first type of feature vector and the first classification prediction model, the target fault cause category to which the fault work order belongs is obtained; according to the second type of feature vector and the second classification prediction model corresponding to the target fault cause category, the target fault cause subcategory of the fault work order in the target fault cause category is obtained. In this way, through a two-step prediction method, that is, first predicting the main category of fault causes, and then predicting the subdivided categories of fault causes in the main category of fault causes, the number of categories predicted in each step can be effectively reduced, and the accuracy of the prediction results can be improved.

As shown in FIG4 , an embodiment of the present invention further provides a network fault cause prediction device, the device comprising:

A first acquisition module 401 is used to acquire a classification feature vector in a fault work order, wherein the classification feature vector includes a first-category feature vector and a second-category feature vector;

A first fault cause prediction module 402, configured to obtain a target fault cause category to which the fault work order belongs according to the first type of feature vector and a first classification prediction model;

The second fault cause prediction module 403 is used to obtain a target fault cause subcategory of the fault work order in the target fault cause category according to the second type feature vector and a second classification prediction model corresponding to the target fault cause category.

Optionally, the first acquisition module 401 includes:

A first acquisition unit is used to acquire a fault work order to be processed, wherein the fields of the fault work order include an alarm title, a network element name, a network element type, and a fault occurrence time;

The feature extraction unit is used to extract the classification feature vector in the fault work order based on the correspondence between the fields of the fault work order and the feature vector and/or the feature extraction model.

Optionally, the classification feature vector includes:

A first feature vector for characterizing the alarm title;

A second feature vector for characterizing the fault cause category corresponding to the alarm title;

A third characteristic vector for characterizing the network element type;

A fourth eigenvector for characterizing a fault cause category corresponding to the network element type;

A fifth eigenvector for characterizing the alarm information associated with the fault work order;

A sixth feature vector for characterizing a subcategory of a fault cause corresponding to the alarm title; and

A seventh eigenvector for characterizing a subcategory of a fault cause corresponding to a network element type;

The first type of feature vectors includes: the first feature vector, the second feature vector, the third feature vector, the fourth feature vector and the fifth feature vector;

The second type of feature vectors includes: the first feature vector, the second feature vector, the third feature vector, the fourth feature vector, the fifth feature vector, the sixth feature vector and the seventh feature vector.

Optionally, the first fault cause prediction module 402 includes:

A first processing unit, configured to classify the first type of feature vectors by using the first classification prediction model to obtain probability values of each fault cause category;

The second processing unit is used to determine the fault cause category corresponding to the maximum probability value among the probability values of each fault cause category as the target fault cause category to which the fault work order belongs.

Optionally, the second fault cause prediction module 403 includes:

A third processing unit is used to classify the second type of feature vector by using the second classification prediction model to obtain the probability value of each fault cause subcategory of the fault work order in the target fault cause category;

The fourth processing unit is configured to determine the fault cause subcategory corresponding to the maximum probability value among the probability values of the fault cause subcategories as the target fault cause subcategory.

Optionally, the device further comprises:

A second acquisition module is used to acquire multiple historical fault work orders and multiple historical alarm information, wherein the fields of each of the historical fault work orders include an alarm title, a network element name, a network element type, a fault occurrence time, a fault cause category, and a fault cause subcategory corresponding to the fault cause category, and the fields of each of the historical alarm information include an alarm title, a network element name, and an alarm start time;

A first processing module, configured to obtain a classification feature vector according to a field of the historical fault work order and a field of the historical alarm information, wherein the classification feature vector includes: a first feature vector for characterizing the alarm title, a second feature vector for characterizing a fault cause category corresponding to the alarm title, a third feature vector for characterizing the network element type, a fourth feature vector for characterizing a fault cause category corresponding to the network element type, a fifth feature vector for characterizing the alarm information associated with the fault work order, a sixth feature vector for characterizing a fault cause subcategory corresponding to the alarm title, and a seventh feature vector for characterizing a fault cause subcategory corresponding to the network element type;

The first model training module is used to perform model training according to the first feature vector, the second feature vector, the third feature vector, the fourth feature vector, the fifth feature vector and the category label of the fault cause category to obtain a first classification prediction model.

Optionally, the device further comprises:

A second processing module is used to group the multiple historical fault work orders according to the fault cause category to obtain multiple groups of historical fault work order data;

The second model training module is used to perform model training on each group of historical fault work order data according to the category label and classification feature vector of the fault cause subcategory corresponding to each group of historical fault work order data, so as to obtain multiple second classification prediction models.

The network fault cause prediction device of the embodiment of the present invention obtains the classification feature vector in the fault work order, and the classification feature vector includes a first type of feature vector and a second type of feature vector; according to the first type of feature vector and the first classification prediction model, the target fault cause category to which the fault work order belongs is obtained; according to the second type of feature vector and the second classification prediction model corresponding to the target fault cause category, the target fault cause subcategory of the fault work order in the target fault cause category is obtained. In this way, through a two-step prediction method, that is, first predicting the main category of fault causes, and then predicting the subdivided category of fault causes in the main category of fault causes, the number of categories predicted in each step can be effectively reduced, and the accuracy of the prediction result can be improved.

It should be noted here that the above-mentioned device provided in the embodiment of the present invention can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects that are the same as the method embodiment in this embodiment will not be described in detail here.

In order to better achieve the above purpose, as shown in FIG5 , an embodiment of the present invention further provides an electronic device, including a processor 500 and a transceiver 510, wherein the transceiver 510 receives and sends data under the control of the processor, and the processor 500 is used to perform the following process:

Obtaining a classification feature vector in the fault work order, wherein the classification feature vector includes a first-category feature vector and a second-category feature vector;

Obtaining a target fault cause category to which the fault work order belongs according to the first type of feature vector and the first classification prediction model;

A target fault cause subcategory of the fault work order in the target fault cause category is obtained according to the second type of feature vector and a second classification prediction model corresponding to the target fault cause category.

Optionally, the processor 500 is further configured to:

Obtain a pending fault work order, wherein the fields of the fault work order include an alarm title, a network element name, a network element type, and a fault occurrence time;

Based on the correspondence between the fields of the fault work order and the feature vector and/or the feature extraction model, the classification feature vector in the fault work order is extracted.

Optionally, the classification feature vector includes:

A first feature vector for characterizing the alarm title;

A second feature vector for characterizing the fault cause category corresponding to the alarm title;

A third characteristic vector for characterizing the network element type;

A fourth eigenvector for characterizing a fault cause category corresponding to the network element type;

A fifth eigenvector for characterizing the alarm information associated with the fault work order;

A sixth feature vector for characterizing a subcategory of a fault cause corresponding to the alarm title; and

A seventh eigenvector for characterizing a subcategory of a fault cause corresponding to a network element type;

The first type of feature vectors includes: the first feature vector, the second feature vector, the third feature vector, the fourth feature vector and the fifth feature vector;

The second type of feature vectors includes: the first feature vector, the second feature vector, the third feature vector, the fourth feature vector, the fifth feature vector, the sixth feature vector and the seventh feature vector.

Optionally, the processor 500 is further configured to:

Classifying the first type of feature vectors by using the first classification prediction model to obtain probability values of each fault cause category;

The fault cause category corresponding to the maximum probability value among the probability values of each fault cause category is determined as the target fault cause category to which the fault work order belongs.

Optionally, the processor 500 is further configured to:

Classifying the second type of feature vectors by using the second classification prediction model to obtain probability values of each fault cause subcategory of the fault work order in the target fault cause category;

The fault cause subcategory corresponding to the maximum probability value among the probability values of each fault cause subcategory is determined as the target fault cause subcategory.

Optionally, the processor 500 is further configured to:

Acquire multiple historical fault work orders and multiple historical alarm information, where the fields of each of the historical fault work orders include an alarm title, a network element name, a network element type, a fault occurrence time, a fault cause category, and a fault cause subcategory corresponding to the fault cause category, and the fields of each of the historical alarm information include an alarm title, a network element name, and an alarm start time;

According to the fields of the historical fault work order and the fields of the historical alarm information, a classification feature vector is obtained, the classification feature vector comprising: a first feature vector for characterizing the alarm title, a second feature vector for characterizing the fault cause category corresponding to the alarm title, a third feature vector for characterizing the network element type, a fourth feature vector for characterizing the fault cause category corresponding to the network element type, a fifth feature vector for characterizing the alarm information associated with the fault work order, a sixth feature vector for characterizing the fault cause subcategory corresponding to the alarm title, and a seventh feature vector for characterizing the fault cause subcategory corresponding to the network element type;

Model training is performed based on the first feature vector, the second feature vector, the third feature vector, the fourth feature vector, the fifth feature vector, and the category label of the fault cause category to obtain a first classification prediction model.

Optionally, the processor 500 is further configured to:

According to the fault cause category, the plurality of historical fault work orders are grouped to obtain a plurality of groups of historical fault work order data;

According to the category labels and classification feature vectors of the fault cause subcategories corresponding to each group of historical fault work order data, model training is performed on each group of historical fault work order data to obtain multiple second classification prediction models.

The electronic device of an embodiment of the present invention obtains a classification feature vector in a fault work order, wherein the classification feature vector includes a first-category feature vector and a second-category feature vector; based on the first-category feature vector and a first classification prediction model, a target fault cause category to which the fault work order belongs is obtained; based on the second-category feature vector and a second classification prediction model, a target fault cause subcategory of the fault work order in the target fault cause category is obtained. In this way, through a two-step prediction method, i.e., first predicting a major category of fault causes, and then predicting a subdivided category of fault causes in the major category of fault causes, the number of categories predicted in each step can be effectively reduced, thereby improving the accuracy of the prediction results.

An embodiment of the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, each process in the network fault cause prediction method embodiment as described above is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

The embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, each process in the network fault cause prediction method embodiment described above is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program code.

The present application is described with reference to the flowchart and/or block diagram of the method, device (system) and computer program product according to the embodiment of the present application. It should be understood that each process and/or box in the flowchart and/or block diagram, and the combination of the process and/or box in the flowchart and/or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the function specified in one process or multiple processes and/or one box or multiple boxes in the flowchart.

These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable storage medium produce a paper product including an instruction device that implements the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing the computer or other programmable device to execute a series of operating steps to produce computer-implemented processing, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims (15)

1. A method for predicting the cause of a network failure, comprising: Obtaining a classification feature vector in the fault work order, wherein the classification feature vector includes a first-category feature vector and a second-category feature vector; Obtaining a target fault cause category to which the fault work order belongs according to the first type of feature vector and the first classification prediction model; Obtaining a target fault cause subcategory of the fault work order in the target fault cause category according to the second type of feature vector and a second classification prediction model corresponding to the target fault cause category; The method further comprises: Acquire multiple historical fault work orders and multiple historical alarm information, where the fields of each of the historical fault work orders include an alarm title, a network element name, a network element type, a fault occurrence time, a fault cause category, and a fault cause subcategory corresponding to the fault cause category, and the fields of each of the historical alarm information include an alarm title, a network element name, and an alarm start time; According to the fields of the historical fault work order and the fields of the historical alarm information, a classification feature vector is obtained, the classification feature vector comprising: a first feature vector for characterizing the alarm title, a second feature vector for characterizing the fault cause category corresponding to the alarm title, a third feature vector for characterizing the network element type, a fourth feature vector for characterizing the fault cause category corresponding to the network element type, a fifth feature vector for characterizing the alarm information associated with the fault work order, a sixth feature vector for characterizing the fault cause subcategory corresponding to the alarm title, and a seventh feature vector for characterizing the fault cause subcategory corresponding to the network element type; Model training is performed based on the first feature vector, the second feature vector, the third feature vector, the fourth feature vector, the fifth feature vector, and the category label of the fault cause category to obtain a first classification prediction model. 2. The method according to claim 1, characterized in that the step of obtaining the classification feature vector in the fault work order comprises: Obtain a pending fault work order, wherein the fields of the fault work order include an alarm title, a network element name, a network element type, and a fault occurrence time; Based on the correspondence between the fields of the fault work order and the feature vector and/or the feature extraction model, the classification feature vector in the fault work order is extracted. 3. The method according to claim 2, characterized in that the classification feature vector comprises: A first feature vector for characterizing the alarm title; A second feature vector for characterizing the fault cause category corresponding to the alarm title; A third characteristic vector for characterizing the network element type; A fourth eigenvector for characterizing a fault cause category corresponding to the network element type; A fifth eigenvector for characterizing the alarm information associated with the fault work order; A sixth feature vector for characterizing a subcategory of a fault cause corresponding to the alarm title; and A seventh eigenvector for characterizing a subcategory of a fault cause corresponding to a network element type; The first type of feature vectors includes: the first feature vector, the second feature vector, the third feature vector, the fourth feature vector and the fifth feature vector; The second type of feature vectors includes: the first feature vector, the second feature vector, the third feature vector, the fourth feature vector, the fifth feature vector, the sixth feature vector and the seventh feature vector. 4. The method according to claim 1, characterized in that the step of obtaining the target fault cause category to which the fault work order belongs based on the first type of feature vector and the first classification prediction model comprises: Classifying the first type of feature vectors by using the first classification prediction model to obtain probability values of each fault cause category; The fault cause category corresponding to the maximum probability value among the probability values of each fault cause category is determined as the target fault cause category to which the fault work order belongs. 5. The method according to claim 1, characterized in that the step of obtaining the target fault cause subcategory of the fault work order in the target fault cause category according to the second type feature vector and the second classification prediction model corresponding to the target fault cause category comprises: Classifying the second type of feature vectors by using the second classification prediction model to obtain probability values of each fault cause subcategory of the fault work order in the target fault cause category; The fault cause subcategory corresponding to the maximum probability value among the probability values of each fault cause subcategory is determined as the target fault cause subcategory. 6. The method according to claim 1, characterized in that after obtaining the classification feature vector according to the fields of the historical fault work order and the fields of the historical alarm information, the method further comprises: According to the fault cause category, the plurality of historical fault work orders are grouped to obtain a plurality of groups of historical fault work order data; According to the category labels and classification feature vectors of the fault cause subcategories corresponding to each group of historical fault work order data, model training is performed on each group of historical fault work order data to obtain multiple second classification prediction models. 7. A network failure cause prediction device, characterized by comprising: A first acquisition module is used to acquire a classification feature vector in the fault work order, wherein the classification feature vector includes a first-category feature vector and a second-category feature vector; A first fault cause prediction module, used for obtaining a target fault cause category to which the fault work order belongs according to the first type of feature vector and a first classification prediction model; A second fault cause prediction module, configured to obtain a target fault cause subcategory of the fault work order in the target fault cause category according to the second type of feature vector and a second classification prediction model corresponding to the target fault cause category; A second acquisition module is used to acquire multiple historical fault work orders and multiple historical alarm information, wherein the fields of each of the historical fault work orders include an alarm title, a network element name, a network element type, a fault occurrence time, a fault cause category, and a fault cause subcategory corresponding to the fault cause category, and the fields of each of the historical alarm information include an alarm title, a network element name, and an alarm start time; A first processing module, configured to obtain a classification feature vector according to a field of the historical fault work order and a field of the historical alarm information, wherein the classification feature vector includes: a first feature vector for characterizing the alarm title, a second feature vector for characterizing a fault cause category corresponding to the alarm title, a third feature vector for characterizing the network element type, a fourth feature vector for characterizing a fault cause category corresponding to the network element type, a fifth feature vector for characterizing the alarm information associated with the fault work order, a sixth feature vector for characterizing a fault cause subcategory corresponding to the alarm title, and a seventh feature vector for characterizing a fault cause subcategory corresponding to the network element type; The first model training module is used to perform model training according to the first feature vector, the second feature vector, the third feature vector, the fourth feature vector, the fifth feature vector and the category label of the fault cause category to obtain a first classification prediction model. 8. An electronic device, comprising a processor and a transceiver, wherein the transceiver receives and sends data under the control of the processor, wherein the processor is configured to perform the following operations: Obtaining a classification feature vector in the fault work order, wherein the classification feature vector includes a first-category feature vector and a second-category feature vector; Obtaining a target fault cause category to which the fault work order belongs according to the first type of feature vector and the first classification prediction model; According to the second type of feature vector and the second classification prediction model, a target fault cause subcategory of the fault work order in the target fault cause category is obtained; The processor is further configured to: Acquire multiple historical fault work orders and multiple historical alarm information, where the fields of each of the historical fault work orders include an alarm title, a network element name, a network element type, a fault occurrence time, a fault cause category, and a fault cause subcategory corresponding to the fault cause category, and the fields of each of the historical alarm information include an alarm title, a network element name, and an alarm start time; According to the fields of the historical fault work order and the fields of the historical alarm information, a classification feature vector is obtained, the classification feature vector comprising: a first feature vector for characterizing the alarm title, a second feature vector for characterizing the fault cause category corresponding to the alarm title, a third feature vector for characterizing the network element type, a fourth feature vector for characterizing the fault cause category corresponding to the network element type, a fifth feature vector for characterizing the alarm information associated with the fault work order, a sixth feature vector for characterizing the fault cause subcategory corresponding to the alarm title, and a seventh feature vector for characterizing the fault cause subcategory corresponding to the network element type; Model training is performed based on the first feature vector, the second feature vector, the third feature vector, the fourth feature vector, the fifth feature vector, and the category label of the fault cause category to obtain a first classification prediction model. 9. The electronic device according to claim 8, wherein the processor is further configured to: Obtain a pending fault work order, wherein the fields of the fault work order include an alarm title, a network element name, a network element type, and a fault occurrence time; Based on the correspondence between the fields of the fault work order and the feature vector and/or the feature extraction model, the classification feature vector in the fault work order is extracted. 10. The electronic device according to claim 9, wherein the classification feature vector comprises: A first feature vector for characterizing the alarm title; A second feature vector for characterizing the fault cause category corresponding to the alarm title; A third characteristic vector for characterizing the network element type; A fourth eigenvector for characterizing a fault cause category corresponding to the network element type; A fifth eigenvector for characterizing the alarm information associated with the fault work order; A sixth feature vector for characterizing a subcategory of a fault cause corresponding to the alarm title; and A seventh eigenvector for characterizing a subcategory of a fault cause corresponding to a network element type; The first type of feature vectors includes: the first feature vector, the second feature vector, the third feature vector, the fourth feature vector and the fifth feature vector; The second type of feature vectors includes: the first feature vector, the second feature vector, the third feature vector, the fourth feature vector, the fifth feature vector, the sixth feature vector and the seventh feature vector. 11. The electronic device according to claim 8, wherein the processor is further configured to: Classifying the first type of feature vectors by using the first classification prediction model to obtain probability values of each fault cause category; The fault cause category corresponding to the maximum probability value among the probability values of each fault cause category is determined as the target fault cause category to which the fault work order belongs. 12. The electronic device according to claim 8, wherein the processor is further configured to: Classifying the second type of feature vectors by using the second classification prediction model to obtain probability values of each fault cause subcategory of the fault work order in the target fault cause category; The fault cause subcategory corresponding to the maximum probability value among the probability values of each fault cause subcategory is determined as the target fault cause subcategory. 13. The electronic device according to claim 8, wherein the processor is further configured to: According to the fault cause category, the plurality of historical fault work orders are grouped to obtain a plurality of groups of historical fault work order data; According to the category labels and classification feature vectors of the fault cause subcategories corresponding to each group of historical fault work order data, model training is performed on each group of historical fault work order data to obtain multiple second classification prediction models. 14. An electronic device comprising a memory, a processor, and a program stored in the memory and executable on the processor; wherein the processor implements the network fault cause prediction method according to any one of claims 1 to 6 when executing the program. 15. A computer-readable storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the program implements the steps in the network fault cause prediction method according to any one of claims 1 to 6.