CN114866400A - Alarm rule reasoning method based on cache space optimization - Google Patents
Alarm rule reasoning method based on cache space optimization Download PDFInfo
- Publication number
- CN114866400A CN114866400A CN202210464267.0A CN202210464267A CN114866400A CN 114866400 A CN114866400 A CN 114866400A CN 202210464267 A CN202210464267 A CN 202210464267A CN 114866400 A CN114866400 A CN 114866400A
- Authority
- CN
- China
- Prior art keywords
- node
- alarm
- class
- rule
- nodes
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 55
- 238000005457 optimization Methods 0.000 title claims abstract description 11
- 230000002457 bidirectional effect Effects 0.000 claims description 9
- 230000003213 activating effect Effects 0.000 claims description 8
- 238000004064 recycling Methods 0.000 claims description 4
- 238000012360 testing method Methods 0.000 claims description 3
- 238000002372 labelling Methods 0.000 abstract 1
- 238000010219 correlation analysis Methods 0.000 description 8
- 238000004458 analytical method Methods 0.000 description 5
- 238000012545 processing Methods 0.000 description 5
- 238000004891 communication Methods 0.000 description 4
- 238000011084 recovery Methods 0.000 description 4
- 238000010586 diagram Methods 0.000 description 3
- 230000007547 defect Effects 0.000 description 2
- 238000011161 development Methods 0.000 description 2
- 238000012423 maintenance Methods 0.000 description 2
- 230000015654 memory Effects 0.000 description 2
- 238000004364 calculation method Methods 0.000 description 1
- 238000001514 detection method Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000010606 normalization Methods 0.000 description 1
- 238000007781 pre-processing Methods 0.000 description 1
- 238000003672 processing method Methods 0.000 description 1
- 230000002250 progressing effect Effects 0.000 description 1
- 230000001960 triggered effect Effects 0.000 description 1
- 230000003936 working memory Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N5/00—Computing arrangements using knowledge-based models
- G06N5/04—Inference or reasoning models
Abstract
The invention relates to the field of network alarm, in particular to an alarm rule reasoning method based on cache space optimization. Compared with other rule reasoning algorithms, the HAL mainly emphasizes the definition of the class instead of the rule, and the class can be basically determined in the system initialization stage and cannot be frequently changed along with the inflow of data like the rule, so that the HAL is more suitable for data with high real-time performance and strong dynamic performance like alarm data. By timely recovering partial matching intermediate results generated in the process of alarm rule reasoning and matching the alarm instance with the class node according to the priority, the problems that the cache space of the traditional heuristic labeling link matching algorithm is large in occupation and the matching speed is low in the alarm rule matching process are solved, and the cache pressure in the process of alarm rule reasoning is reduced.
Description
Technical Field
The invention relates to the field of network alarm, in particular to an alarm rule reasoning method based on cache space optimization.
Background
With the development of the era and the continuous update of information technology, the kinds of services provided by the internet are also continuously increasing. The trend of network devices toward diversified types and decentralized geographic locations is also progressing. This situation increases the complexity of the network and increases the difficulty of network management. When a fault occurs in the network, the corresponding device node usually sends out an alarm message. However, due to the connectivity of the network, cascading exists between failures, that is, a failure generated by a device may cause other nodes adjacent to the device to also fail, which results in that the root cause failure and alarm data are not in a one-to-one correspondence relationship. Although the alarm data may not be sent out by the same equipment, the alarm data is caused by the same source fault in nature, and therefore, potential relevance exists between the alarm data caused by the same source fault. Therefore, it is very important how to quickly perform correlation analysis on the massive alarm data and extract the key information related to the root fault from the massive alarm data.
The rule reasoning in the alarm correlation analysis process refers to repeatedly comparing the currently generated alarm information with historical data in a knowledge base or a rule base after analyzing the currently generated alarm information, so as to reason out an alarm capable of reflecting the root cause of the fault. In the process of alarm rule inference, the logical structure of 'IF … THEN' is not simply followed, but the inference engine obtains a corresponding inference result according to the level, the area, the time interval of the current alarm and the comprehensive matching situation of the historical knowledge base. Therefore, the inference process of the alarm rule is also regarded as a process of pattern matching once.
The process of alarm rule reasoning is as follows: and giving an alarm rule database, performing mode matching on the alarm examples and the alarm rules according to the current state, and putting the alarm rules which can be satisfied (namely, the alarm rules of which the examples can be matched can be found in each condition part) into an alarm conflict set to become activated alarm rules. Since the rule matching process is a dynamic process, the instances can be modified, added or deleted in each matching process, and thus the alarm conflict set can be updated continuously.
In the process of performing root alarm reasoning according to rules generated by alarm correlation analysis, a matching network containing rule nodes is usually established. The reasoning process is that firstly, the alarm instance transmitted into the network is matched with the mode condition node of the rule, and when all the conditions are successfully matched, the corresponding rule node is activated. But because the matching process has a combined nature, a series of intermediate results of partial matches are cached during each rule inference. For the data with relatively complex structure and large quantity of alarms, the results of partial matching occupy more cache space, which has a certain influence on the space utilization rate of the algorithm. Meanwhile, massive alarm instance data can occupy more matching time.
In order to solve the development state of the prior art, the existing patents and documents are searched, compared and analyzed, and the following technical information with high relevance to the invention is screened out:
patent scheme 1: CN102724071B electric power communication fault early warning analysis method and system based on network model and rule model, discloses an electric power communication fault early warning analysis method and system based on network model and rule model, the method: (1) establishing a network model for fault early warning analysis; (2) establishing a fault early warning analysis rule model by combining a network model; (3) reading and analyzing all established rule models, and sending the rule models to a rule reasoning engine; (4) collecting communication network alarm and performance information to carry out normalization processing, and then sending the information to a rule reasoning engine; (5) the rule reasoning engine performs reasoning according to the performance early warning rule model and gives out early warning signals according to a rule conclusion part; (6) the rule reasoning engine performs reasoning according to the business influence range rule model and provides influenced business and business influence degree; (7) and giving a fault handling suggestion according to the early warning handling expert experience library. The invention can automatically and real-timely give out early warning prompt before the fault occurs, and give out early warning service influence range and early warning processing suggestion, thereby providing a technical means for stable operation of the power communication network. The method has the following defects: the scheme aims to analyze fault early warning by establishing a fault early warning rule base, acquire current system information, input the current system information into a rule reasoning engine, obtain early warning information through rule reasoning and provide a corresponding solution. However, in an actual network application scenario, the number of fault types is large, the corresponding rule base is also huge, inference efficiency in the huge rule base is low, results cannot be obtained in time, corresponding processing is performed, and a method for optimizing the rule inference process is needed.
Patent scheme 2: CN104363129B A network event correlation analysis and dynamic early warning method, relate to a network event correlation analysis and dynamic early warning method, the method is mainly according to the requirement of the network fault management, carry on the correlation analysis preconditioning to the network event at first, form the alarm event, then choose the preferred reasoning mode through the inference mode selector, use the preferred reasoning mode and suboptimal reasoning mode to process the alarm event sequentially, until the processing is successful; and if the two reasoning modes fail to process, providing dynamic early warning for network operation and maintenance personnel. The method can adaptively select a proper priority reasoning mode, greatly improve the reasoning efficiency, continuously optimize the case base and the rule base in the processing process of the network event and reduce the technical requirements on network operation and maintenance personnel. The method has the following defects: the scheme provides a network event correlation analysis and dynamic early warning method, correlation analysis preprocessing is carried out on network events to form warning events, then a processing method is obtained through a reasoning mode, and three recently used rules are preferentially selected for reasoning in the reasoning process. This method also fails to provide an effective solution to the problem of slow inference speed when the rule base is large, and although there is a priority inference mechanism, this mechanism has a limited effect when there are many kinds of faults.
Disclosure of Invention
The invention provides a network-based intermediate result recovery mechanism for partial matching and a node matching mechanism according to priority aiming at the problems that the intermediate result of partial matching generated in the alarm reasoning process occupies a cache space and the matching time is long, so as to improve the utilization rate of the cache space and reduce the consumption of the matching time.
The technical scheme adopted by the invention is as follows:
an alarm rule reasoning method based on cache space optimization comprises the following steps:
s1, distributing rule nodes for each alarm rule, distributing class nodes for each alarm class, if the alarm rule contains variable binding about the alarm class, establishing an intermediate node for the corresponding alarm rule as a child node of the rule node, and establishing a connection relation and initializing the priority of the class nodes;
s2, checking the newly arrived alarm event, matching with the class node according to the priority, recalculating the priority of the successfully matched class node, transmitting to the corresponding intermediate node, and activating the corresponding alarm rule node if no intermediate node exists;
s3, for the alarm rule with completely matched conditions, activating the corresponding alarm rule node and executing the operation of the rule conclusion part, and recycling the cache space occupied by the intermediate node; when the condition is not matched, continuing to wait for a new alarm event; if there are alarm events in the network that have not been traversed, step S2 is executed, otherwise, the process is ended.
Further, step S1 specifically includes:
s11, distributing rule nodes for each alarm rule, distributing class nodes for each alarm class, if the alarm rule contains variable binding about the alarm class, establishing an intermediate node for the corresponding alarm rule, and using the intermediate node as a child node of the corresponding rule node;
s12, establishing connection between the class node and the intermediate node, if a certain alarm rule does not contain alarm class binding, the class node is directly connected with the alarm rule node; setting a bidirectional pointer field and a counter at each intermediate node; the bidirectional pointer is used for enabling the intermediate node to define the data source and the data destination, the preorder node of the pointer points to the father node, the posterior node points to the child node, wherein the preorder node is a class node or a superior intermediate node, and the posterior node is a subordinate intermediate node or a regular node;
and S13, registering corresponding test conditions in the class nodes, and initializing the weight w and the priority E of the class nodes.
Further, step S2 specifically includes:
s21, traversing all new alarm event instances which come or have not been traversed, matching with the class nodes according to the priority, updating the E value of each point when the matching of the new alarm instances and the class nodes is successful, and E i The E value representing the ith class node, namely the requirements of other class nodes on the current class node, is calculated by the following steps:
W i the w value of the ith class node is represented as the number of matched alarm rules under the current class node, and if the jth class node has a requirement on the ith node, E ij ＝W j Otherwise, setting 0, namely on the premise that the jth class node is successfully matched with a certain alarm instance,once the ith class node is successfully matched, all condition elements of the kth rule node or the intermediate node can be successfully matched;
informing all nodes connected with the class node of the matching result of the class node, and setting the alarm example of each new network as E i The value arrangement sequence is subjected to descending order and is matched with the class nodes;
s22, if the alarm event is matched with the class node of the alarm rule, checking whether the class node is connected with the intermediate node, if so, transmitting the updated information to the intermediate node when adding or deleting the event; if not, checking whether the class node meets the condition of rule matching, and if so, activating the corresponding rule node.
Further, in step S3, the step of recovering the cache space occupied by the intermediate node specifically includes:
the counter of the middle node is used for determining when the node can be recycled, the initial value is 1, the value of the counter increases along with the increase of the number of the child nodes, the class node only has a subsequent pointer, and the regular node only has a preamble pointer; after a certain rule is matched, traversing upwards by taking a corresponding rule node as a root, and subtracting 1 from the counter value of the passing intermediate node to indicate that the rule is matched; when the value of the intermediate node counter is decremented to 0, the corresponding intermediate node is immediately cleared from the cache.
Compared with the prior art, the invention has the following advantages:
(1) the invention improves HAL matching algorithm to make it suitable for rule matching inference of massive and complex alarm events.
(2) In the alarm rule reasoning, the characteristic that the matching time of the alarm instance and the class node is too long is optimized, the matching sequence of the class nodes is sequenced in a mode of continuously updating the priority of the class nodes, the matching time of the alarm event transmitted into the network is reduced, the alarm data is accelerated to flow from the class nodes to the rule nodes to complete rule matching, and the operation of a rule conclusion part is executed.
(3) And aiming at intermediate results generated by partial matching in the reasoning process, adding a counter and a bidirectional pointer field to the intermediate nodes, and timely and effectively recovering the intermediate nodes meeting the conditions. Under the scene of generating a large amount of alarm data, the improved recovery mechanism with partial matching in the HAL can improve the quality of the mined alarm association rule and reduce the cache pressure in the inference process of the alarm rule so as to improve the cache utilization rate.
Drawings
FIG. 1 is a flow chart of a method according to an embodiment of the present invention.
Fig. 2 is a flowchart illustrating a priority calculation process according to an embodiment of the present invention.
FIG. 3 is a diagram illustrating an intermediate node recycling mechanism according to an embodiment of the present invention.
FIG. 4 is a network diagram of nodes generated according to rules in accordance with an embodiment of the present invention.
Fig. 5 is a schematic diagram of node allocation according to an embodiment of the present invention.
Detailed Description
The invention is further explained below with reference to the drawings.
First, the present invention needs to account for variables used in HAL rule inference methods based on cache space optimization. The variables used were as follows:
·E i : the requirement of other class nodes on the current class node, namely the event is the waiting matching value of some other node to be matched so as to meet the condition set of some rule node or intermediate node.
·w i : and the number of matched alarm rules under the current class node is represented.
The invention designs a HAL alarm rule reasoning method based on cache optimization.
The scheme of the invention is explained in detail below with reference to fig. 1. Fig. 1 shows a detailed flow chart of the proposed method of the present invention.
The steps are described as follows
S1: and distributing corresponding rule nodes, intermediate nodes or class nodes for each alarm rule and each alarm class.
S2: and checking the newly arrived alarm event, matching with the mode condition node (class node) of the rule according to the priority, and determining whether the alarm event meets the matching condition of the alarm rule in the current network.
S3: for the alarm rules with completely matched conditions, activating corresponding alarm rule nodes and executing the operation of the rule conclusion part, and recovering the cache space occupied by the middle node according to the recovery mode of the partial matching result provided by the text; when the condition is not matched, continuing to wait for a new alarm event; if the network still has the alarm event which is not traversed at this time, go to step S2; otherwise, the algorithm ends.
By the method, the partially matched intermediate result nodes can be timely and reasonably recovered in the matching process of the alarm rule.
Wherein, step S1 specifically includes:
s11, distributing rule nodes for each alarm rule, distributing class nodes for each alarm class, if the rule contains variable binding about the alarm class, establishing an intermediate node for the rule, and using the intermediate node as a child node of the rule node.
As shown in fig. 5; suppose that there are two alarm rules R1 and R2 to be matched in the current network, where rule R1 relates to A, B and C types of alarms, and rule R2 relates to A, B and D types of alarms. In the matching process of the two rules, besides the class node and the rule node, intermediate nodes (a, B), (a, B, C) and (a, B, D) which store partial matching results are generated, and the nodes and the matching paths are shown in the following figure, wherein the solid line node indicates that data meeting the conditions can be found from the working memory at this time, and the dotted line node indicates that data meeting the conditions does not exist in the memory at this time. In the following graph (a), the rule R1 can be matched because there is the required data in memory at this time, and the node (a, B, C) can find the instance satisfying the condition from its parent nodes (a, B) and C; and rule R2 may not have completed the match because node (a, B, D) cannot find the corresponding instance from its parent node D.
And S12, establishing bidirectional connection between the alarm class and the intermediate node, and if the rule does not contain class binding, the alarm class node is directly connected with the alarm rule node in a bidirectional way. Each intermediate node is provided with a bidirectional pointer field and a counter. The bidirectional pointer is used for enabling the intermediate node to define the source and the destination of data, the front node of the pointer points to the father node of the intermediate node, the back node points to the child nodes of the intermediate node, wherein the front node type can be a class node or an upper-level intermediate node, and the back node type can be a lower-level intermediate node or a regular node.
And S13, registering corresponding test conditions in the nodes of the alarm class. And initializes the w and E values of the class nodes.
Wherein, step S2 specifically includes:
s21, traversing all new alarm event instances which come or have not been traversed, matching with regular mode condition nodes (class nodes) according to the priority, wherein the priority is represented by E, and when the alarm instances which are newly added are successfully matched with the class nodes, the E value of each point is updated, and E is i And E value representing the ith class node is calculated by the following method:
if the jth class node has a demand for the ith point, E ij ＝w j Otherwise, the value is set to 0, that is, once the ith class node is successfully matched with the alarm instance, all the conditional elements of the kth rule node or the intermediate node can be successfully matched (that is, the sibling node of the currently matched class node) once the ith class node is successfully matched with the alarm instance.
The initial value of w of all the nodes is 0, and w +1 is obtained after a new matched sample is added. And continuously updating the E value of each point to inform all nodes connected with the class of the matching result of the node of the class. The alarm instances for each new joining of the network are as per E i And the value arrangement sequence is subjected to descending order and is matched with the class nodes so as to improve the rule reasoning speed of the alarm instance.
As shown in fig. 2 and 3, after joining the node (a1), the node B of the class is notified of the node (B1) required for detection according to the request of the intermediate node, and at this time, the E value +1 of the node B is searched preferentially;
s22: if the alarm event matches with the regular pattern condition node (class node), checking whether the class node is connected with the intermediate node. If so, the updated information needs to be transmitted to the intermediate node when the event is added or deleted; if there is no intermediate node, then check the alarm class if there is a condition that meets the rule matching condition. If so, the corresponding alarm rule node is activated.
Wherein, step S3 specifically includes:
s31: and for the alarm rule with completely matched conditions, activating the corresponding alarm rule node and executing the operation of the rule conclusion part.
S32, recovering the buffer space occupied by the middle node according to the recovery mode of partial matching result;
the counter of the intermediate node is used for determining when the node can be recycled, the initial value is 1, the value of the counter increases along with the increase of the number of the child nodes, the class node only has a subsequent pointer, and the regular node only has a preamble pointer. And after a certain rule is matched, traversing upwards by taking the node of the rule as a root, and subtracting 1 from the counter value of the passed intermediate node to indicate that the rule is matched completely. When the value of the intermediate node counter is decremented to 0, this indicates that the node may be immediately flushed from the cache. By the method, the partially matched intermediate result nodes can be timely and reasonably recovered in the matching process of the alarm rule.
As shown in FIG. 3, the intermediate nodes (A, B) are triggered by the instances (A1) and (B1), and the joining of the instance (C1) and the intermediate nodes (A, B) also trigger the intermediate nodes (A, B, C), so that all condition elements of the Rule node Rule-one can be matched, at which time the counters of the intermediate nodes (A, B, C) and (A, B) are all-1, and when the value of the counter of the intermediate node is reduced to 0, the node can be immediately cleared from the cache.
S33: when the condition is not matched, continuing to wait for a new alarm event; if the network still has the alarm event which is not traversed at this time, go to step S2; otherwise, the algorithm ends.
Examples of the invention
The specific analytical procedures in the examples of the present invention are as follows
S1: and distributing corresponding rule nodes, intermediate nodes or class nodes for the alarm rules and the alarm classes. The network of nodes generated according to the rules is shown in fig. 4;
here exemplified with the network structure generated by rules 2, 4, 49, 51:
table 1 partial alarm rule table
Table 2 network structure class node correspondence table
S2: and checking the alarm examples in the table below, matching the alarm examples with the mode condition nodes (class nodes) of the rules according to the priority, and determining whether the alarm examples meet the matching conditions of the alarm rules in the current network.
Table 3 partial alarm example table
S3: for alarm rules with perfectly matched conditions, namely: alarm 11 and alarm 1117840660 conform to alarm rule 2, and we can conclude that its root alarm is alarm 1117840662; the alarm 1117840664 conforms to the rule 4, and we can conclude that the root alarm is the alarm 1117840665, and in the process of concluding the root alarm, the cache space occupied by the intermediate node is recycled according to the recycling mode of the partial matching result provided herein.
Claims (4)
1. An alarm rule reasoning method based on cache space optimization is characterized by comprising the following steps:
s1, distributing rule nodes for each alarm rule, distributing class nodes for each alarm class, if the alarm rule contains variable binding about the alarm class, establishing an intermediate node for the corresponding alarm rule as a child node of the rule node, and establishing a connection relation and initializing the priority of the class nodes;
s2, checking the newly arrived alarm event, matching with the class node according to the priority, recalculating the priority of the successfully matched class node, transmitting to the corresponding intermediate node, and activating the corresponding alarm rule node if no intermediate node exists;
s3, for the alarm rule with completely matched conditions, activating the corresponding alarm rule node and executing the operation of the rule conclusion part, and recycling the cache space occupied by the intermediate node; when the condition is not matched, continuing to wait for a new alarm event; if there are alarm events in the network that have not been traversed, step S2 is executed, otherwise, the process is ended.
2. The alarm rule inference method based on cache space optimization according to claim 1, wherein step S1 specifically includes:
s11, distributing rule nodes for each alarm rule, distributing class nodes for each alarm class, if the alarm rule contains variable binding about the alarm class, establishing an intermediate node for the corresponding alarm rule, and using the intermediate node as a child node of the corresponding rule node;
s12, establishing connection between the class node and the intermediate node, if a certain alarm rule does not contain alarm class binding, the class node is directly connected with the alarm rule node; setting a bidirectional pointer field and a counter at each intermediate node; the bidirectional pointer is used for enabling the intermediate node to define the data source and the data destination, the preorder node of the pointer points to the father node, the posterior node points to the child node, wherein the preorder node is a class node or a superior intermediate node, and the posterior node is a subordinate intermediate node or a regular node;
and S13, registering corresponding test conditions in the class nodes, and initializing the weight w and the priority E of the class nodes.
3. The alarm rule inference method based on cache space optimization according to claim 1, wherein step S2 specifically includes:
s21, traversing all new alarm event instances which come or have not been traversed, matching with the class nodes according to the priority, updating the E value of each point when the matching of the new alarm instances and the class nodes is successful, and E i The E value representing the ith class node, namely the requirements of other class nodes on the current class node, is calculated by the following steps:
W i The w value of the ith class node is represented as the number of matched alarm rules under the current class node, if the ith class node is j If the class node has a requirement for the ith point, E ij ＝W j Otherwise, setting 0, namely, on the premise that the jth class node is successfully matched with a certain alarm instance, once the ith class node is successfully matched, all condition elements of the kth rule node or the intermediate node can be successfully matched;
informing all nodes connected with the class node of the matching result of the class node, and setting the alarm example of each new network as E i The value arrangement sequence is subjected to descending order and is matched with the class nodes;
s22, if the alarm event is matched with the class node of the alarm rule, checking whether the class node is connected with the intermediate node, if so, transmitting the updated information to the intermediate node when adding or deleting the event; if not, checking whether the class nodes meet the condition of rule matching, and if so, activating the corresponding rule nodes.
4. The alarm rule inference method based on cache space optimization according to claim 1, wherein step S3 is to recycle the cache space occupied by the intermediate node, and specifically includes:
the counter of the middle node is used for determining when the node can be recycled, the initial value is 1, the value of the counter increases along with the increase of the number of the child nodes, the class node only has a subsequent pointer, and the regular node only has a preamble pointer; after a certain rule is matched, traversing upwards by taking a corresponding rule node as a root, and subtracting 1 from the counter value of the passing intermediate node to indicate that the rule is matched; when the value of the intermediate node counter is decremented to 0, the corresponding intermediate node is immediately cleared from the cache.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210464267.0A CN114866400B (en) | 2022-04-29 | 2022-04-29 | Alarm rule reasoning method based on buffer space optimization |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210464267.0A CN114866400B (en) | 2022-04-29 | 2022-04-29 | Alarm rule reasoning method based on buffer space optimization |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114866400A true CN114866400A (en) | 2022-08-05 |
| CN114866400B CN114866400B (en) | 2024-04-30 |
Family
ID=82636029
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210464267.0A Active CN114866400B (en) | 2022-04-29 | 2022-04-29 | Alarm rule reasoning method based on buffer space optimization |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114866400B (en) |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20140201126A1 (en) * | 2012-09-15 | 2014-07-17 | Lotfi A. Zadeh | Methods and Systems for Applications for Z-numbers |
| CN108989132A (en) * | 2018-08-24 | 2018-12-11 | 深圳前海微众银行股份有限公司 | Fault warning processing method, system and computer readable storage medium |
| CN110784338A (en) * | 2019-09-29 | 2020-02-11 | 许昌许继软件技术有限公司 | Intelligent alarm processing method and distribution network master station system |
| CN111444291A (en) * | 2020-03-27 | 2020-07-24 | 上海爱数信息技术股份有限公司 | Real-time data alarm method based on stream processing engine and rule engine |
-
2022
- 2022-04-29 CN CN202210464267.0A patent/CN114866400B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20140201126A1 (en) * | 2012-09-15 | 2014-07-17 | Lotfi A. Zadeh | Methods and Systems for Applications for Z-numbers |
| CN108989132A (en) * | 2018-08-24 | 2018-12-11 | 深圳前海微众银行股份有限公司 | Fault warning processing method, system and computer readable storage medium |
| CN110784338A (en) * | 2019-09-29 | 2020-02-11 | 许昌许继软件技术有限公司 | Intelligent alarm processing method and distribution network master station system |
| CN111444291A (en) * | 2020-03-27 | 2020-07-24 | 上海爱数信息技术股份有限公司 | Real-time data alarm method based on stream processing engine and rule engine |
Non-Patent Citations (2)
| Title |
|---|
| 徐久强 等: "基于改进Rete算法的RFID复合事件检测方法", 东北大学学报(自然科学版), vol. 33, no. 06, 30 June 2012 (2012-06-30), pages 806 - 814 * |
| 武丹凤 等: "支持演化规则引擎的Rete算法研究", 计算机应用研究, vol. 30, no. 06, 30 June 2013 (2013-06-30), pages 1747 - 1750 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114866400B (en) | 2024-04-30 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN103902646B (en) | Distributed task managing system and method | |
| WO1992016906A1 (en) | Computerised information-retrieval database systems | |
| CN109120461B (en) | A kind of service feature end-to-end monitoring method, system and device | |
| US20220067008A1 (en) | Method and apparatus for determining configuration knob of database | |
| CN114465874B (en) | Fault prediction method, device, electronic equipment and storage medium | |
| CN112217674B (en) | Alarm root cause identification method based on causal network mining and graph attention network | |
| CN112559237B (en) | Operation and maintenance system troubleshooting method and device, server and storage medium | |
| CN110427298A (en) | A kind of Automatic Feature Extraction method of distributed information log | |
| CN107579844A (en) | It is a kind of that failure method for digging is dynamically associated based on service path and frequency matrix | |
| Kilby et al. | The backbone of the travelling salesperson | |
| CN114416573A (en) | Defect analysis method, device, equipment and medium for application program | |
| CN113541986B (en) | Fault prediction method and device for 5G slice and computing equipment | |
| JP3182169B2 (en) | Failure diagnosis method | |
| CN114866400A (en) | Alarm rule reasoning method based on cache space optimization | |
| CN115996169A (en) | Network fault analysis method and device, electronic equipment and storage medium | |
| CN107566193A (en) | Fuzzy fault Petri network and its network fault diagnosis method | |
| US20060031473A1 (en) | System and method for high capacity fault correlation | |
| Mijumbi et al. | MAYOR: machine learning and analytics for automated operations and recovery | |
| CN111782610B (en) | Log processing method, device, server, system network and storage medium | |
| CN110995815B (en) | Information transmission method based on Gaia big data analysis system | |
| EP4068693A1 (en) | Methods and devices for network monitoring | |
| Youssef et al. | Enhanced parallel mining algorithm for frequent sequential rules | |
| CN116991951A (en) | Root cause quality difference index determination method and device and computer equipment | |
| CN112667464A (en) | Intelligent analysis method, system and equipment for information system state | |
| CN114358911A (en) | Invoicing data risk control method and device, computer equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant |