CN114866400B - Alarm rule reasoning method based on buffer space optimization - Google Patents
Alarm rule reasoning method based on buffer space optimization Download PDFInfo
- Publication number
- CN114866400B CN114866400B CN202210464267.0A CN202210464267A CN114866400B CN 114866400 B CN114866400 B CN 114866400B CN 202210464267 A CN202210464267 A CN 202210464267A CN 114866400 B CN114866400 B CN 114866400B
- Authority
- CN
- China
- Prior art keywords
- node
- rule
- alarm
- class
- nodes
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 48
- 238000005457 optimization Methods 0.000 title claims abstract description 10
- 230000003213 activating effect Effects 0.000 claims description 8
- 230000002457 bidirectional effect Effects 0.000 claims description 8
- 238000004364 calculation method Methods 0.000 claims description 4
- 238000004064 recycling Methods 0.000 claims description 4
- 238000012360 testing method Methods 0.000 claims description 3
- 238000002372 labelling Methods 0.000 abstract 1
- 238000012098 association analyses Methods 0.000 description 8
- 238000012545 processing Methods 0.000 description 6
- 238000004891 communication Methods 0.000 description 5
- 238000010586 diagram Methods 0.000 description 5
- 238000004458 analytical method Methods 0.000 description 4
- 238000011084 recovery Methods 0.000 description 4
- 230000007547 defect Effects 0.000 description 2
- 238000011161 development Methods 0.000 description 2
- 230000015654 memory Effects 0.000 description 2
- 230000001960 triggered effect Effects 0.000 description 2
- 238000013459 approach Methods 0.000 description 1
- 230000033228 biological regulation Effects 0.000 description 1
- 230000007423 decrease Effects 0.000 description 1
- 238000001514 detection method Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
- 238000010606 normalization Methods 0.000 description 1
- 238000003672 processing method Methods 0.000 description 1
- 230000003936 working memory Effects 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N5/00—Computing arrangements using knowledge-based models
- G06N5/04—Inference or reasoning models
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Evolutionary Computation (AREA)
- Artificial Intelligence (AREA)
- Computational Linguistics (AREA)
- Data Mining & Analysis (AREA)
- Signal Processing (AREA)
- Physics & Mathematics (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Mathematical Physics (AREA)
- Software Systems (AREA)
- Computer Networks & Wireless Communication (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention relates to the field of network alarms, in particular to an alarm rule reasoning method based on buffer space optimization, which is based on Heuristically-Annotated-link (HAL) rule matching algorithm and improves the algorithm to a certain extent. Compared with other rule reasoning algorithms, the HAL mainly emphasizes class rather than rule definition, and the class can be basically determined in the system initialization stage and is not changed frequently along with the inflow of data like a rule, so that the HAL is more suitable for data with high real-time performance and strong dynamic performance like alarm data. The problem that the cache space occupation is large and the matching speed is low in the process of alarming rule matching in the traditional heuristic labeling link matching algorithm is solved by timely recovering the intermediate result of partial matching generated in the process of alarming rule reasoning and matching the alarming instance with class nodes according to the priority, and the cache pressure in the process of alarming rule reasoning is reduced.
Description
Technical Field
The invention relates to the field of network alarms, in particular to an alarm rule reasoning method based on buffer space optimization.
Background
With the development of the age and the continuous update of information technology, the types of services provided by the internet are also increasing. Network devices are also moving toward diversification of categories and decentralization of geographical locations. This situation increases network complexity as well as network management difficulties. When a failure occurs in the network, the corresponding device node typically issues an alarm message. However, due to the connectivity of the network, there is a cascading characteristic between the faults, that is, the fault generated by a certain device may cause other nodes adjacent to the fault to also generate faults, which results in a non-one-to-one correspondence between the root fault and the alarm data. Although the alarm data may not be sent by the same device, it is essentially caused by the same source fault, and thus there is a potential correlation between the alarm data caused by the source faults. Therefore, it is important to quickly perform association analysis on massive alarm data and extract key information related to root cause faults from the alarm data.
Rule reasoning in the alarm association analysis process refers to repeatedly comparing the current generated alarm information with historical data in a knowledge base or a rule base after analyzing the current generated alarm information, so that the alarm which can reflect the root of the fault is deduced. In the process of alarm rule reasoning, the logic structure of the IF … THEN is not simply followed, but the reasoning engine obtains a corresponding reasoning result according to the current alarm level, the area, the time interval and the comprehensive matching condition of the historical knowledge base. Thus, the reasoning process of the alarm rules is also regarded as a one-time pattern matching process.
The alarm rule reasoning process is as follows: given an alarm rule database, according to the current state, the alarm instance and the alarm rule are subjected to pattern matching, and the alarm rule which can be met (namely, the alarm rule of which each condition part can find the matched instance) is put into the alarm conflict set to become the activated alarm rule. Since the rule matching process is a dynamic process, the instances can be modified, added or deleted during each match, so the alarm conflict set is also updated continuously.
In the process of performing root alarm reasoning according to rules generated by alarm association analysis, a matching network containing rule nodes is generally established. The reasoning process is to match the alarm instance of the incoming network with the regular mode condition nodes first, and when all conditions are successfully matched, the corresponding rule nodes will be activated. But because the matching process has a combined nature, a series of intermediate results of partial matches are cached during each rule inference. For data with relatively complex structure and large quantity, the partial matching results occupy more cache space, which has a certain influence on the space utilization of the algorithm. Meanwhile, a large amount of alarm instance data also occupies more matching time.
In order to understand the development status of the prior art, the prior patents and documents are searched, compared and analyzed, and the following technical information with higher correlation degree with the invention is screened out:
Patent scheme 1: CN102724071B discloses a power communication fault early warning analysis method and a system thereof based on a network model and a rule model, and discloses a power communication fault early warning analysis method and a system thereof based on the network model and the rule model, wherein the method comprises the following steps: (1) establishing a network model for fault early warning analysis; (2) Establishing a fault early warning analysis rule model by combining a network model; (3) Reading and analyzing all established rule models, and sending the rule models into a rule reasoning engine; (4) Collecting communication network alarm and performance information for normalization processing, and then sending the communication network alarm and performance information to a rule reasoning engine; (5) The rule reasoning engine conducts reasoning according to the performance early warning rule model, and gives early warning signals according to the rule conclusion part; (6) The rule reasoning engine conducts reasoning according to the rule model of the service influence range to give the affected service and the service influence degree; (7) And giving fault treatment suggestions according to the early warning treatment expert experience library. The invention can automatically and real-time make early warning prompt before the fault occurs, and gives the service influence range of early warning and the processing suggestion of early warning, thereby providing technical means for the stable operation of the power communication network. Defects: the scheme aims at analyzing fault early warning by establishing a fault early warning rule base, acquiring current system information, inputting the current system information into a rule reasoning engine, obtaining early warning information through rule reasoning, and providing a corresponding solution. However, in the actual network application scene, the number of fault types is large, the corresponding rule base is huge, the reasoning efficiency in the huge rule base is low, the result cannot be obtained in time, corresponding processing is performed, and a method is needed to optimize the rule reasoning process.
Patent scheme 2: CN104363129B is a network event association analysis and dynamic early warning method, which relates to a network event association analysis and dynamic early warning method, the method mainly comprises the steps of firstly carrying out association analysis pretreatment on network events according to the requirement of network fault management to form alarm events, then selecting a priority reasoning mode through a reasoning mode selector, and processing the alarm events by sequentially using the priority reasoning mode and a sub-priority reasoning mode until the processing is successful; if both reasoning modes fail to process, dynamic early warning is provided for network operation staff. The method can adaptively select a proper priority reasoning mode, greatly improves reasoning efficiency, can continuously optimize a case library and a rule library in the processing process of network events, and reduces technical requirements on network operation and maintenance personnel. Defects: the scheme provides a network event association analysis and dynamic early warning method, carries out association analysis pretreatment on network events to form alarm events, then obtains a processing method through an inference mode, and preferentially selects three recently used rules for inference in the inference process. This approach also fails to propose an effective way to solve the problem of slow reasoning speed when rule bases are large, and although there is a preferential reasoning mechanism, the effect of this mechanism is limited when the types of faults are large.
Disclosure of Invention
Aiming at the problems that the partial matching intermediate result generated in the alarm reasoning process occupies a cache space and the matching time is long, the invention provides a network-based partial matching intermediate result recovery mechanism and a node priority matching mechanism, so as to improve the utilization rate of the cache space and reduce the matching time consumption.
The invention adopts the technical scheme that:
An alarm rule reasoning method based on buffer space optimization comprises the following steps:
S1, distributing rule nodes for each alarm rule, distributing class nodes for each alarm class, if the alarm rule contains variable binding related to the alarm class, establishing an intermediate node for the corresponding alarm rule as a child node of the rule node, and establishing a connection relationship and initializing the priority of the class nodes;
S2, checking newly arrived alarm events, matching the newly arrived alarm events with class nodes according to the priority, recalculating the priority by the class nodes successfully matched, transmitting the recalculated priority to corresponding intermediate nodes, and activating corresponding alarm rule nodes if no intermediate nodes exist;
S3, for the alarm rule with completely matched conditions, activating a corresponding alarm rule node, executing the operation of the rule conclusion part, and recycling the cache space occupied by the intermediate node; if the conditions are not matched, continuing to wait for a new alarm event; if the network has the alarm event which is not traversed, the step S2 is carried out, otherwise, the step is finished.
Further, the step S1 specifically includes:
s11, distributing rule nodes for each alarm rule, distributing class nodes for each alarm class, and if the alarm rule contains variable binding related to the alarm class, establishing an intermediate node for the corresponding alarm rule and taking the intermediate node as a child node of the corresponding rule node;
S12, establishing connection between the class node and the intermediate node, and if a certain alarm rule does not contain the binding of the alarm class, directly connecting the class node with the alarm rule node; setting a bidirectional pointer field and a counter in each intermediate node; the bidirectional pointer is used for enabling the intermediate node to definitely determine the data source and the destination, the front node of the pointer points to the father node, the rear node points to the child node, wherein the front node type is a class node or an upper intermediate node, and the rear node type is a lower intermediate node or a rule node;
s13, registering corresponding testing conditions in the class node, and initializing the weight w and the priority E of the class node.
Further, the step S2 specifically includes:
S21, traversing all newly arrived or not traversed alarm event instances, matching with class nodes according to priority, updating E values of all points after the newly added alarm instances are successfully matched with the class nodes, wherein E i represents E values of the ith class node, namely the demands of other class nodes on the current class node, and the calculation method comprises the following steps:
W i represents the W value of the ith class node, which is the number of matched alarm rules under the current class node, if the jth class node has a requirement on the ith point, E ij＝Wj, otherwise, setting 0, namely, on the premise that the jth class node is successfully matched with a certain alarm instance, once the ith class node is successfully matched, all condition elements of the kth rule node or intermediate node can be successfully matched;
Informing all nodes connected with the class node of the matching result of a certain class node, and matching the alarm instance newly added into the network with the class node according to the descending order of E i value arrangement sequence every time;
S22, if the alarm event is matched with the class node of the alarm rule, checking whether the class node is connected with the intermediate node, and if so, transmitting updated information to the intermediate node when the event is added or deleted; if not, checking whether the class node has the condition meeting the rule matching condition, and if so, activating the corresponding rule node.
Further, in step S3, the recovering the buffer space occupied by the intermediate node specifically includes:
The counter of the intermediate node is used for defining when the node can be recovered, the initial value is 1, the value of the counter is increased along with the increase of the number of the child nodes, the class node only has a subsequent pointer, and the rule node only has a preceding pointer; when a certain rule is matched, traversing upwards by taking a corresponding rule node as a root, and subtracting 1 from the counter value of the passing intermediate node to indicate that the rule is matched; when the value of the intermediate node counter is decremented to 0, the corresponding intermediate node is immediately flushed from the cache.
Compared with the prior art, the invention has the following advantages:
(1) The invention improves the HAL matching algorithm to be suitable for carrying out regulation matching reasoning on massive and structural and complex alarm events.
(2) In the alarm rule pushing process, the characteristic that the matching time of the alarm instance and the class node is overlong is optimized, the matching sequence of the class node is ordered in a mode of continuously updating the priority of the class node, the matching time of alarm events of an incoming network is reduced, and the alarm data is accelerated to flow from the class node to the rule node to complete rule matching so as to execute the operation of a rule conclusion part.
(3) Aiming at the intermediate result generated by partial matching in the reasoning process, the intermediate nodes meeting the conditions are effectively recovered in time by adding a counter and a bidirectional pointer domain to the intermediate nodes. Under the scene of generating a large amount of alarm data, the improved recovery mechanism partially matched with the HAL can improve the quality of the mined alarm association rule, and reduce the cache pressure in the alarm rule reasoning process so as to improve the cache utilization rate.
Drawings
FIG. 1 is a flow chart of a method according to an embodiment of the invention.
Fig. 2 is a schematic diagram of a priority calculation flow according to an embodiment of the invention.
FIG. 3 is a schematic diagram of an intermediate node recovery mechanism according to an embodiment of the present invention.
Fig. 4 is a network diagram of nodes generated according to rules in accordance with an embodiment of the present invention.
Fig. 5 is a schematic diagram of node allocation according to an embodiment of the present invention.
Detailed Description
The invention is further explained below with reference to the drawings.
First, the present invention needs to explain variables used in the HAL rule inference method based on buffer space optimization. The variables used are as follows:
E i: the requirement of other class nodes on the current class node, namely that the event is the matching value that other certain nodes to be matched are waiting for, so as to meet the condition set of certain rule nodes or intermediate nodes.
W i: and representing the number of matched alarm rules under the current class node.
The invention designs a HAL alarm rule reasoning method based on cache optimization.
The scheme of the invention is described in detail below in connection with fig. 1. Fig. 1 shows a specific flow chart of the method according to the invention.
The steps are described as follows
S1: and allocating corresponding rule nodes, intermediate nodes or class nodes for each alarm rule and each alarm class.
S2: and checking the newly arrived alarm event, and matching the newly arrived alarm event with the mode condition node (class node) of the rule according to the priority, and determining whether the newly arrived alarm event meets the matching condition of the alarm rule in the current network.
S3: for the alarm rule with completely matched conditions, activating the corresponding alarm rule node and executing the operation of the rule conclusion part, and recovering the occupied cache space of the intermediate node according to the recovery mode of the partial matching result provided herein; if the conditions are not matched, continuing to wait for a new alarm event; if the network has an alarm event which is not traversed at the moment, the step S2 is carried out; otherwise, the algorithm ends.
By the method, the partially matched intermediate result nodes can be timely and reasonably recovered in the matching process of the alarm rules.
The step S1 specifically includes:
S11, distributing rule nodes for each alarm rule, distributing class nodes for each alarm class, if the rule contains variable binding related to the alarm class, establishing an intermediate node for the rule, and taking the intermediate node as a child node of the rule node.
As shown in fig. 5; assume that there are two alarm rules R1 and R2 to be matched in the current network, where rule R1 relates to three types A, B and C of alarms and rule R2 relates to three types A, B and D of alarms. In the matching process of the two rules, besides class nodes and rule nodes, intermediate nodes (A, B), (A, B, C) and (A, B, D) which store partial matching results are generated, and the nodes and the matching paths are shown in the following graph, wherein solid line nodes represent that data meeting the conditions can be found from the working memory at the moment, and broken line nodes represent that no data meeting the conditions exists in the memory at the moment. In the following diagram (a), rule R1 can be matched because the required data exists in the memory at this time, and node (a, B, C) can find an instance satisfying the condition from its parent nodes (a, B) and C; while rule R2 may not have completed matching because node (a, B, D) cannot find the corresponding instance from its parent node D.
S12, establishing bidirectional connection between the alarm class and the intermediate node, and if the rule does not contain the binding of the class, directly connecting the alarm class node with the alarm rule node in a bidirectional manner. Each intermediate node is provided with a bi-directional pointer field and a counter. The bidirectional pointer is used for enabling the intermediate node to definitely source and destination data, the front node of the pointer points to the father node of the pointer, the rear node points to the child node of the pointer, the front node type can be a class node or an upper intermediate node, and the rear node type can be a lower intermediate node or a rule node.
S13, registering corresponding test conditions in the nodes of the alarm class. And initializing the w value and the E value of the class node.
The step S2 specifically includes:
S21, traversing all newly arrived or not traversed alarm event instances, matching with the regular mode condition nodes (class nodes) according to the priority, wherein the priority is represented by E, and each time after the newly added alarm instance is successfully matched with the class node, the E value of each point is updated, E i represents the E value of the ith class node, and the calculation method is as follows:
e ij＝wj is set to 0 if the j-th class node has a requirement on the i-th point, namely, if the j-th class node is successfully matched with a certain alarm instance, the i-th class node can be successfully matched once the j-th class node is successfully matched, and all condition elements of the k-th rule node or the intermediate node can be successfully matched (namely, the brother nodes of the currently matched class node).
The initial value of w of all nodes is 0, and w+1 is added after a sample which is successfully matched is newly added. The continuous updating of the E value of each point informs the matching result of a node of a certain class to all nodes connected with the class. And each alarm instance newly added into the network is matched with the class nodes in descending order according to the E i value arrangement order, so that the rule reasoning speed of the alarm instance is improved.
As shown in fig. 2 and 3, after adding a node (A1), the node-like node B is notified of the node (B1) required for detection according to the request of the intermediate node, and the E value +1 of the node B is preferentially searched;
S22: if the alarm event is matched with the regular mode condition node (class node), checking whether the class node is connected with the intermediate node. If so, the updated information needs to be transmitted to the intermediate node when the event is added or deleted; if there is no intermediate node, it is checked whether the alarm class has a condition that meets the rule matching condition. If so, the corresponding alert rule node is activated.
The step S3 specifically includes:
S31: and for the alarm rule with completely matched conditions, activating the corresponding alarm rule node and executing the operation of the rule conclusion part.
S32, recycling the occupied cache space of the intermediate node according to the recycling mode of the partial matching result;
The counter of the intermediate node is used to determine when the node can be reclaimed, the initial value is 1, and the value increases with the number of child nodes. When a certain rule is matched, traversing upwards by taking the rule node as a root, and subtracting 1 from the counter value of the passing intermediate node to indicate that the rule is matched. When the value of the intermediate node counter decreases to 0, this indicates that the node can be immediately flushed from the cache. By the method, the partially matched intermediate result nodes can be timely and reasonably recovered in the matching process of the alarm rules.
As shown in fig. 3, the intermediate nodes (a, B) are triggered by the instances (A1) and (B1), and the intermediate nodes (a, B, C) are triggered by the addition of the instance (C1) and the intermediate nodes (a, B, C), so that all condition elements of Rule-one of the Rule nodes can be matched, and when the counter of the intermediate nodes (a, B, C) and (a, B) is all-1, the counter of the intermediate node is reduced to 0, which indicates that the node can be immediately cleared from the cache.
S33: if the conditions are not matched, continuing to wait for a new alarm event; if the network has an alarm event which is not traversed at the moment, the step S2 is carried out; otherwise, the algorithm ends.
Examples of the invention
The specific analytical steps in the examples of the present invention are as follows
S1: and allocating corresponding rule nodes, intermediate nodes or class nodes for the alarm rules and alarm classes. The node network generated according to the rule is shown in fig. 4;
the network structure generated in rules 2, 4, 49, 51 is exemplified here:
Table 1 part alarm rule table
Table 2 network structure class node correspondence table
S2: and checking alarm examples in the following table, and matching with the mode condition nodes (class nodes) of the rules according to the priority, so as to determine whether the alarm examples meet the matching condition of the alarm rules in the current network.
Table 3 partial alarm instance table
S3: alarm rules for a complete match of conditions, namely: alarm 11 and alarm 1117840660 conform to alarm rule 2, we can infer that its root alarm is alarm 1117840662; the alert 1117840664 meets rule 4, and we can infer that the root alert is alert 1117840665, and reclaim the buffer space occupied by the intermediate node according to the reclamation method of the partial matching result proposed herein in the process of inferring the root alert.
Claims (3)
1. The warning rule reasoning method based on buffer space optimization is characterized by comprising the following steps:
S1, distributing rule nodes for each alarm rule, distributing class nodes for each alarm class, if the alarm rule contains variable binding related to the alarm class, establishing an intermediate node for the corresponding alarm rule as a child node of the rule node, and establishing a connection relationship and initializing the priority of the class nodes;
S2, checking newly arrived alarm events, matching the newly arrived alarm events with class nodes according to the priority, recalculating the priority by the class nodes successfully matched, transmitting the recalculated priority to corresponding intermediate nodes, and activating corresponding alarm rule nodes if no intermediate nodes exist;
The step S2 specifically comprises the following steps:
S21, traversing all newly arrived or not traversed alarm event instances, matching with class nodes according to priority, updating the priority E value of each class node after each time when the newly added alarm instance is successfully matched with the class node, wherein E i represents the priority E value of the ith class node, namely the requirement of other class nodes on the current class node, and the calculation method is as follows:
N1 is the number of regular nodes and intermediate nodes, N2 is the number of all class nodes
W i represents the W value of the ith class node, which is the number of matched alarm rules under the current class node, if the jth class node has a requirement on the ith point, E ij＝Wj, otherwise, setting 0, namely, on the premise that the jth class node is successfully matched with a certain alarm instance, once the ith class node is successfully matched, all condition elements of the kth rule node or intermediate node can be successfully matched;
Informing all nodes connected with the class node of the matching result of a certain class node, and matching the alarm instance newly added into the network with the class node according to the descending order of E i value arrangement sequence every time;
S22, if the alarm event is matched with the class node of the alarm rule, checking whether the class node is connected with the intermediate node, and if so, transmitting updated information to the intermediate node when the event is added or deleted; if not, checking whether the class node meets the rule matching condition, and if so, activating the corresponding rule node;
S3, for the alarm rule with completely matched conditions, activating a corresponding alarm rule node, executing the operation of the rule conclusion part, and recycling the cache space occupied by the intermediate node; if the conditions are not matched, continuing to wait for a new alarm event; if the network has the alarm event which is not traversed, the step S2 is carried out, otherwise, the step is finished.
2. The method for reasoning the alarm rules based on the optimization of the cache space according to claim 1, wherein the step S1 specifically includes:
s11, distributing rule nodes for each alarm rule, distributing class nodes for each alarm class, and if the alarm rule contains variable binding related to the alarm class, establishing an intermediate node for the corresponding alarm rule and taking the intermediate node as a child node of the corresponding rule node;
S12, establishing connection between the class node and the intermediate node, and if a certain alarm rule does not contain the binding of the alarm class, directly connecting the class node with the alarm rule node; setting a bidirectional pointer field and a counter in each intermediate node; the bidirectional pointer is used for enabling the intermediate node to definitely determine the data source and the destination, the front node of the pointer points to the father node, the rear node points to the child node, wherein the front node type is a class node or an upper intermediate node, and the rear node type is a lower intermediate node or a rule node;
s13, registering corresponding testing conditions in the class node, and initializing the weight w and the priority E of the class node.
3. The method for reasoning the alarm rule based on the optimization of the cache space according to claim 2, wherein in step S3, the cache space occupied by the intermediate node is recovered, and the method specifically comprises the following steps:
The counter of the intermediate node is used for defining when the node can be recovered, the initial value is 1, the value of the counter is increased along with the increase of the number of the child nodes, the class node only has a subsequent pointer, and the rule node only has a preceding pointer; when a certain rule is matched, traversing upwards by taking a corresponding rule node as a root, and subtracting 1 from the counter value of the passing intermediate node to indicate that the rule is matched; when the value of the intermediate node counter is decremented to 0, the corresponding intermediate node is immediately flushed from the cache.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210464267.0A CN114866400B (en) | 2022-04-29 | 2022-04-29 | Alarm rule reasoning method based on buffer space optimization |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210464267.0A CN114866400B (en) | 2022-04-29 | 2022-04-29 | Alarm rule reasoning method based on buffer space optimization |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114866400A CN114866400A (en) | 2022-08-05 |
| CN114866400B true CN114866400B (en) | 2024-04-30 |
Family
ID=82636029
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210464267.0A Active CN114866400B (en) | 2022-04-29 | 2022-04-29 | Alarm rule reasoning method based on buffer space optimization |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114866400B (en) |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108989132A (en) * | 2018-08-24 | 2018-12-11 | 深圳前海微众银行股份有限公司 | Fault warning processing method, system and computer readable storage medium |
| CN110784338A (en) * | 2019-09-29 | 2020-02-11 | 许昌许继软件技术有限公司 | Intelligent alarm processing method and distribution network master station system |
| CN111444291A (en) * | 2020-03-27 | 2020-07-24 | 上海爱数信息技术股份有限公司 | Real-time data alarm method based on stream processing engine and rule engine |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US9916538B2 (en) * | 2012-09-15 | 2018-03-13 | Z Advanced Computing, Inc. | Method and system for feature detection |
-
2022
- 2022-04-29 CN CN202210464267.0A patent/CN114866400B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108989132A (en) * | 2018-08-24 | 2018-12-11 | 深圳前海微众银行股份有限公司 | Fault warning processing method, system and computer readable storage medium |
| CN110784338A (en) * | 2019-09-29 | 2020-02-11 | 许昌许继软件技术有限公司 | Intelligent alarm processing method and distribution network master station system |
| CN111444291A (en) * | 2020-03-27 | 2020-07-24 | 上海爱数信息技术股份有限公司 | Real-time data alarm method based on stream processing engine and rule engine |
Non-Patent Citations (2)
| Title |
|---|
| 基于改进Rete算法的RFID复合事件检测方法;徐久强 等;东北大学学报(自然科学版);20120630;第33卷(第06期);第806-814页 * |
| 支持演化规则引擎的Rete算法研究;武丹凤 等;计算机应用研究;20130630;第30卷(第06期);第1747-1750页 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114866400A (en) | 2022-08-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| JP3959027B2 (en) | Data structures for information systems | |
| CN112217674B (en) | Alarm root cause identification method based on causal network mining and graph attention network | |
| CN115225536B (en) | Virtual machine abnormality detection method and system based on unsupervised learning | |
| CN111290913A (en) | Fault location visualization system and method based on operation and maintenance data prediction | |
| CN113282461A (en) | Alarm identification method and device for transmission network | |
| CN111552843B (en) | Fault prediction method based on weighted causal dependency graph | |
| CN112559237B (en) | Operation and maintenance system troubleshooting method and device, server and storage medium | |
| CN109213773A (en) | A kind of diagnostic method, device and the electronic equipment of online failure | |
| CN110427298A (en) | A kind of Automatic Feature Extraction method of distributed information log | |
| CN114119110A (en) | Project cost list collection system and method thereof | |
| CN114416573A (en) | Defect analysis method, device, equipment and medium for application program | |
| CN114866400B (en) | Alarm rule reasoning method based on buffer space optimization | |
| CN113541986B (en) | Fault prediction method and device for 5G slice and computing equipment | |
| CN113268370A (en) | Root cause alarm analysis method, system, equipment and storage medium | |
| JP3182169B2 (en) | Failure diagnosis method | |
| CN114531334A (en) | Intention processing method and device, electronic equipment and readable storage medium | |
| CN107454089A (en) | A kind of network safety situation diagnostic method based on multinode relevance | |
| CN115996169A (en) | Network fault analysis method and device, electronic equipment and storage medium | |
| CN115903503A (en) | GOAP-based artificial intelligence engine control method | |
| CN112306730B (en) | Defect report severity prediction method based on historical item pseudo label generation | |
| CN114266040A (en) | Linux host intrusion detection method | |
| Rodler | Towards Optimizing Reiter's HS-Tree for Sequential Diagnosis | |
| CN113743488B (en) | Vehicle monitoring method, device, equipment and storage medium based on parallel Internet of vehicles | |
| CN114124676B (en) | Fault root positioning method and system for network intelligent operation and maintenance system | |
| CN115617698B (en) | Software defect measurement element selection method based on association rule network |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |