CN116170281A

CN116170281A - Alarm association rule generation method and device, electronic equipment and storage medium

Info

Publication number: CN116170281A
Application number: CN202111413538.1A
Authority: CN
Inventors: 唐英; 杜贤俊; 宋军; 郑聂聪
Original assignee: ZTE Corp
Current assignee: ZTE Corp
Priority date: 2021-11-25
Filing date: 2021-11-25
Publication date: 2023-05-26
Also published as: WO2023093527A1

Abstract

The application relates to the technical field of wireless communication and discloses an alarm association rule generation method, an alarm association rule generation device, electronic equipment and a storage medium, wherein the method comprises the following steps: carrying out association alarm analysis on each resource in the resource type relation tree according to the history alarm slice to obtain association alarms and association times of the association alarms; acquiring a correlation coefficient corresponding to the correlation alarm according to the preset correlation strength among the resources; acquiring the association degree of the association alarm according to the association times and the association coefficient; and generating an alarm association rule according to the association alarm under the condition that the association degree is larger than a first preset threshold value. The generation of the alarm association rule is more targeted to the current network architecture, meanwhile, the complexity of the generation of the alarm association rule is simplified, the alarm association rule aiming at the current network architecture can be generated simply and efficiently, and the accuracy and efficiency of alarm association analysis by using the alarm association rule are improved.

Description

Alarm association rule generation method and device, electronic equipment and storage medium

Technical Field

The embodiment of the application relates to the technical field of mobile communication, in particular to an alarm association rule generation method, an alarm association rule generation device, electronic equipment and a storage medium.

Background

The 5G network relies on the cloud native core idea, and customization, openness and service of the network are realized by combining a virtualization technology and a cloud technology through a service-based network architecture. The virtualized network realizes the functions of the traditional telecommunication equipment through software, runs on the universal hardware equipment, and realizes hardware resource sharing by adopting a virtualized technology. The virtualized network is divided into a hardware layer, a virtual layer and a network element layer from bottom to top, the lower layer resource is the basis of the operation of the upper layer resource, the failure of the physical layer resource often causes the failure of the virtual layer resource, the failure of the virtual layer resource causes the failure of the network element, and finally the normal processing of the service is affected. Therefore, when an alarm occurs to one resource in the virtualized network, a plurality of virtual resources are often caused to fail, and along with the increase of the scale of the resources, the alarm number is also increased rapidly. In order to efficiently solve the problem of resource alarms, it is important to analyze the relevance of different resource alarms to find and process the root alarm in the 5G network.

According to the current alarm association analysis method, an alarm association rule is predefined according to accumulation of an expert knowledge base, and when an alarm is reported, a rule engine is used for calculating the association of the alarm in a certain time slice according to the existing rule. However, expert experience is difficult to accumulate, and the validity degree of the generated alert association rule is unstable. The other method is that the system uses machine learning and big data analysis to carry out alarm association rule mining, the practicability of the alarm association rule generated by the machine learning is lower, the mined rule is more, and a large amount of system resources are occupied; the alarm association rule generated by big data analysis has better effectiveness, but the generation process is more complex. Therefore, how to simply and efficiently establish the alarm association rule adapted to the network structure still is an urgent problem to be solved.

Disclosure of Invention

The embodiment of the application mainly aims to provide an alarm association rule generation method, an alarm association rule generation device, electronic equipment and a storage medium, aiming at the current network architecture, the alarm association rule capable of accurately identifying association relations among alarms is generated succinctly and efficiently, and the alarm processing efficiency and accuracy are improved.

In order to achieve the above object, an embodiment of the present application provides a method for generating an alarm association rule, including: carrying out association alarm analysis on each resource in the resource type relation tree according to the history alarm slice to obtain association alarms and association times of the association alarms; acquiring a correlation coefficient corresponding to the correlation alarm according to the preset correlation strength among the resources; acquiring the association degree of the association alarm according to the association times and the association coefficient; and generating an alarm association rule according to the association alarm under the condition that the association degree is larger than a first preset threshold value.

In order to achieve the above objective, an embodiment of the present application further provides an alert association rule generating device, including: the acquisition module is used for carrying out association alarm analysis on each resource in the resource type relation tree according to the history alarm slice to acquire association alarms and association times of the association alarms; the computing module is used for acquiring the association coefficient corresponding to the association alarm according to the preset association strength among the resources; the determining module is used for acquiring the association degree of the association alarm according to the association times and the association coefficient; and the generation module is used for generating alarm association rules according to the association alarms under the condition that the association degree is larger than a first preset threshold value.

In order to achieve the above object, an embodiment of the present application further provides an electronic device, where the device includes: at least one processor; and a memory communicatively coupled to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the alert association rule generating method as described above.

To achieve the above object, an embodiment of the present application further provides a computer readable storage medium storing a computer program, where the computer program when executed by a processor implements the alert association rule generating method as described above.

According to the alarm association rule generation method, after a resource type relation tree is established according to resources needing to be subjected to association alarm analysis, a historical alarm slice is generated according to alarm information of each resource in a period of time, then association alarm analysis is carried out on each resource according to the historical alarm slice, association times between association alarms and the association alarms are obtained, association coefficients of the association alarms are obtained by combining preset association strengths among the resources, association degrees of the association alarms are obtained according to the association times and the association coefficients, and when the association degrees are larger than a first preset threshold, alarm association rules are generated according to the association alarms. The method has the advantages that the result of carrying out the association alarm analysis on each resource by utilizing the history alarm slice and the preset association strength among each resource are combined, the association degree of the association alarm is accurately measured, and the alarm association rule is generated according to the association alarm with the high association degree, so that the generation of the alarm association rule is more targeted and simplified, the complexity of the generation of the alarm association rule is also simplified, the alarm association rule aiming at the current network architecture can be generated in a concise and efficient manner, and the accuracy and the efficiency of carrying out the alarm association analysis by utilizing the alarm association rule are further improved.

Drawings

One or more embodiments are illustrated by way of example and not limitation in the figures of the accompanying drawings.

FIG. 1 is a flowchart of an alarm association rule generation method in an embodiment of the present application;

FIG. 2 is a schematic diagram of the architecture of a 5G virtualized network resource model in an embodiment of the application;

FIG. 3 is a schematic diagram of a resource type relationship tree in an embodiment of the present application;

FIG. 4 is a schematic diagram of a resource instance relationship tree in an embodiment of the present application;

FIG. 5 is a flowchart of an alarm association rule mining maintenance method in an embodiment of the present application;

FIG. 6 is a schematic structural diagram of an alarm association rule mining maintenance device according to an embodiment of the present application;

FIG. 7 is a schematic structural diagram of an alarm association rule generating device according to another embodiment of the present application;

fig. 8 is a schematic structural diagram of an electronic device in another embodiment of the present application.

Detailed Description

As known from the background art, in the alert association rule generating method that is currently more commonly used, when the alert association rule is generated based on expert experience accumulation, the expert experience is difficult to accumulate and the validity of the generated alert association rule is unstable; the alarm association rule generated based on machine learning has poor effectiveness and needs to occupy a large amount of system resources; the rule generation process is relatively complex when generating alert association rules based on big data analysis. Therefore, how to simply and efficiently establish the alarm association rule adapted to the network structure under the process and ensure the alarm association analysis efficiency and accuracy are the problems which need to be solved urgently.

In order to solve the above problem, an embodiment of the present application provides a method for generating an alarm association rule, including: carrying out association alarm analysis on each resource in the resource type relation tree according to the history alarm slice to obtain association alarms and association times of the association alarms; acquiring a correlation coefficient corresponding to the correlation alarm according to the preset correlation strength among the resources; acquiring the association degree of the association alarm according to the association times and the association coefficient; and generating an alarm association rule according to the association alarm under the condition that the association degree is larger than a first preset threshold value.

For the purpose of making the objects, technical solutions and advantages of the embodiments of the present application more apparent, the embodiments of the present application will be described in detail below with reference to the accompanying drawings. However, as will be appreciated by those of ordinary skill in the art, in the various embodiments of the present application, numerous technical details have been set forth in order to provide a better understanding of the present application. However, the technical solutions claimed in the present application can be implemented without these technical details and with various changes and modifications based on the following embodiments. The following embodiments are divided for convenience of description, and should not be construed as limiting the specific implementation of the present application, and the embodiments may be mutually combined and referred to without contradiction.

Implementation details of the alarm association rule generating method described in the present application will be specifically described below with reference to specific embodiments, and the following details are provided only for facilitating understanding, and are not necessary to implement the present embodiment.

A first aspect of the embodiments of the present application provides a method for generating an alert association rule, where referring to fig. 1, a specific flow of the alert association rule generating method is applied to an analysis control terminal with communication and analysis capabilities, such as a computer, a tablet, a mobile phone, and other electronic devices, and the embodiment is described by taking application in a computer as an example, and at least includes, but is not limited to, the following steps:

And step 101, carrying out association alarm analysis on each resource in the resource type relation tree according to the history alarm slice, and obtaining association alarms and association times of the association alarms.

Specifically, before the alarm association rule is generated, the computer defines resource types needing alarm association analysis according to the virtualized network networking architecture, and organizes association relations of the resource types to establish a resource type relation tree. And then acquiring historical alarm information of each resource within a certain time period, generating a plurality of historical alarm slices according to a time sequence, establishing a relation among resource examples according to a resource type relation tree, generating a resource example relation tree, combining the resource example relation tree, carrying out association alarm analysis on each resource in the resource type relation tree according to the historical alarm slices, and acquiring association alarms with association relation and association times of the association alarms.

For example, as shown in fig. 2, a schematic diagram of a 5G virtualized network resource model is shown, where an uppermost network element layer includes service network elements and virtualized network functions, a virtual layer in a middle layer includes virtualized network resources such as hosts, virtual interaction machines, virtual databases, virtual networks, virtual hosts, virtual network cards, and virtual disks, and a lowermost hardware layer includes hardware facilities or ports such as servers, system servers, interaction servers, switch ports, router ports, switches, and routers, where the resources are communicatively connected according to service interactions or association relationships. The computer determines the range of the resources to be analyzed according to the network resource model, and after combing the hierarchical association relationship of the resources, the established resource type relationship tree is shown in fig. 3, and is respectively a service network element, a virtual host, a server, a magnetic array, a switch and a router which are parallel to the server from top to bottom. The generated resource type relationship tree may be stored in a graph database, the resource types being stored as type tree nodes in the library, the relationships between the types being stored as relationship edges between the tree nodes.

The resource instance relation tree generated by the computer according to the resource type relation tree is shown in fig. 4, the resource instance relation tree can also be stored in the graph database, the resource instance is stored as an instance tree node, and the relation between the instances is stored as a relation edge between the nodes. For the purpose of quickly searching the relationship later, a relationship edge of an instance and a type can be established, and an index is established by using a resource id. The resource instance relation tree has the overall structure that different routers are connected with at least one server through different switches, corresponding hosts are connected through the server, and then each host is connected with a virtual network function through a virtual host connected with the corresponding host. In addition, after the resource instance relation tree is established, the resource instance relation tree needs to be synchronized with the resource library in real time so as to update the resource instance relation in real time.

Before the computer generates the alarm association rule, various resource data are collected from a network element management system (Element Management System, EMS), a virtual infrastructure manager (Virtualized Infrastructure Manager, VIM) and a physical infrastructure manager (Physical Infrastructure Manager, PIM) through resource probes and stored in a system resource library. Meanwhile, the system collects alarms from EMS, VIM and PIM through the alarm probes, generates alarm information inquiry snapshot after formatting processing and stores the snapshot into the current alarm library and the historical alarm library. After the resource instance relation tree is generated, the computer reads the history alarm information of each resource contained in the resource type relation tree within a certain time period in the history alarm database, and divides the history alarm information into a plurality of history alarm slices according to the time sequence of alarm occurrence and the preset time granularity. And performing historical alarm slice scanning in the resource relation instance relation tree by using a slice scanning mode, performing associated alarm analysis on each resource in the resource type relation tree, marking a group of alarms with resource correlation and time correlation as associated alarms, and counting the occurrence times of alarm sets with time and resource correlation to obtain associated alarms with associated relation and associated alarm association times.

The specific method for carrying out the association alarm analysis by the computer by using the history alarm slice is as follows: in the generated resource instance relation tree, starting from the earliest alarm slice in the acquired historical alarm slices, playing the historical alarm slices one by one according to a certain playing speed, and updating the alarm state of each resource in the resource instance relation tree according to the alarm information in each alarm slice. Under the condition that a plurality of resources generate alarm change at the same time, extracting the resources generating the alarm change, and inquiring whether the resources have resource correlation or not on a resource instance relation tree. For example, when the resource A and the resource B have alarm changes at the same time, the resource A and the resource B have a relation edge on the resource instance relation tree, or the resource A to the resource B have an reachable path on the resource instance relation tree, and the alarm changes which do not occur on other resources on the path in the slice, the two alarms are judged to have resource correlation. Under the condition that the resources with alarm changes have resource correlation, according to the resource type and the hierarchy of the resources in the resource type relation tree, setting the alarm of the resources at the lower layer as a root alarm, setting the alarm of the resources at the upper layer as sub alarms, and setting the two as associated alarms. And extracting the key features of the associated alarms to generate an associated mark. The main content of the mark is the resource type, alarm code and association times of two alarms, for example, the mark is recorded as [ (resource type 1, alarm code 1), (resource type 2, alarm code 2), association times n ], the initial value of association times is 1, and the association times are increased by 1 when the corresponding feature of the association alarm appears in each scanning. There may be multiple resources in a slice that are each simultaneously subject to alarm changes at different times, e.g., in a slice, the policy control function element and virtual host 2, virtual host 3 and host 3, the user plane data function element and switch 3, server 7 and switch 3, switch 3 and switch 4 in the resource instance relationship tree, the resources are combined or have a directly connected relationship edge, or there is an reachable path on the resource instance relationship tree, and in this slice, other resources on this path are not simultaneously subject to alarm changes. These alarms are considered to have time and resource dependencies, respectively. In addition, the service discovery function network element and the router 1 also generate alarm change in the time slice, but the network element does not have an reachable path reaching the router 1, so that the two alarms have no association relationship in the slice.

After the current historical alarm slice scanning is completed, the computer automatically scans the next historical alarm slice, updates the associated alarms until the scanning of all the historical alarm slices is completed, and acquires one or more associated alarms with associated relations among all resources in the resource type relation tree and associated times of the associated alarms. Through carrying out association alarm analysis on each resource in the resource type relation tree according to the history alarm slice, the association times of the association alarms and the association alarms are accurately obtained from two dimensions of time association and resource association, and the generation of the alarm association rule is facilitated.

Step 102, obtaining association coefficients corresponding to the association alarms according to preset association strength among the resources.

Specifically, after the computer acquires the association alarm and the association times of the association alarm according to the historical alarm slice, the computer acquires the association coefficient corresponding to the association alarm when carrying out association degree analysis according to the type of the resource where the association alarm is located and the preset association strength among the resources.

In one example, the computer obtains the association coefficient corresponding to the association alarm according to the preset association strength among the resources, including: acquiring a resource connection path between resources where the associated alarms are located; acquiring preset alarm association strength among the resources corresponding to each sub-path in the resource connection path according to the preset alarm association strength among the resources; and acquiring the association coefficient corresponding to the association alarm according to the preset alarm association strength among the resources corresponding to each sub-path. After the computer acquires the association alarms, searching a resource connection path between resources where the association alarms are located in a resource instance relation tree species generated according to a resource type relation tree, dividing the resource connection path into a plurality of sub-paths according to different resource nodes passed by the resource connection path, acquiring preset alarm association strength corresponding to each section of sub-path according to preset alarm association strength between the resources, and acquiring association coefficients corresponding to the alarm resources by combining the preset alarm association strengths corresponding to the sub-paths on the resource connection path. And the association strength of each stage in the resource connection path is obtained according to the preset association strength among the resources, and the association coefficient is accurately obtained by combining the association strength of each stage, so that the accuracy of subsequent association degree evaluation is ensured.

For example, after evaluating the alarm association strengths of different types of resources according to the service hierarchical support relationship of the resources and the accumulated expert experience, the computer pre-sets the alarm association strengths among the resources in the resource type relationship tree as follows: service network element-virtual host: the association strength is 0.4; virtual host-host: the association strength is 0.8; virtual host-virtual switch: the association strength is 0.5; virtual host-magnetic array: the association strength is 0.6; host-server: the association strength is 1; server-switch: the association strength is 0.5; magnetic array-switch: the association strength is 0.5; switch-switch: the association strength is 0.5; switch-router: the correlation strength was 0.5. The alarm association strength among the resources can be set manually according to expert experience, and can be accumulated and calculated by a computer according to expert experience, and the association strength can be stored as an attribute on the resource type relation side and stored in a graph database together with a resource type relation tree, so that subsequent searching and referencing are facilitated.

When the computer obtains the association coefficient corresponding to the association alarm, the computer firstly obtains the specific resource where the association alarm is located, for example, in the resource instance relation tree shown in fig. 4, the association alarm is [ (switch 4, ethernet protocol down), (user plane data function, routing group is unavailable) ], and the resource where the association alarm is located is the switch 4 and the user plane data function. Then, the computer obtains the connection path between the switch 4 and the user plane data function as the switch 4-the server 7-the host 7-the virtual host 6-the user plane data function by inquiring the resource connection path in the resource instance relation tree. And combining the preset association strengths among the resources, wherein the preset association strengths corresponding to the sub-paths are respectively 0.5, 1, 0.8 and 0.4, and combining the preset association strengths corresponding to the sub-paths to acquire the association coefficients corresponding to the resource connection paths. For example, if the product of the preset association strengths of the sub-paths is used as the association coefficient, the association coefficient corresponding to the association alarm [ (switch 4, ethernet protocol down), (user plane data function, routing group unavailable) ] is (0.5×0.8×0.4×1) =0.16.

Further, the computer obtains a resource connection path between resources where the association alarm is located, including: and acquiring the shortest resource connection path between the resources where the associated alarms are located. When the computer acquires the resource connection paths, under the condition that a plurality of resource connection paths exist among the resources where the association alarms are located, the shortest resource connection path is selected as the resource connection path for calculating the association coefficients corresponding to the association alarms. In addition, the computer can also calculate the association coefficient corresponding to each resource connection path respectively, and select one resource connection path according to the size of the association coefficient, for example, the connection path with the largest or smallest corresponding association coefficient is used as the selected resource connection path. The shortest resource connection path is selected from the plurality of alternative resource connection paths to be used as the resource connection path for calculating the corresponding association coefficient of the association alarm, so that the subsequent generation omission of alarm rules caused by the too low evaluation of the association degree of the association alarm is avoided.

And step 103, acquiring the association degree of the association alarm according to the association times and the association coefficient.

Specifically, after the computer acquires the association alarms, the association times of the association alarms and the association coefficients corresponding to the association alarms, the computer evaluates the specific association degrees of the alarms contained in the association alarms, and for each association alarm, the association degrees of the association alarms are acquired according to the association times and the association coefficients. The association degree of the associated alarms is determined according to the association times and the association coefficient, and the association degree of the associated alarms is comprehensively analyzed on the two levels of the alarm occurrence probability and the alarm association probability, so that the association degree of the associated alarms is accurately obtained.

For example, the computer can calculate the association value of the association alarm according to the product of the association times of the association alarm and the association coefficient corresponding to the association alarm, and measure the association degree of the association alarm through the association value. In the resource instance relationship tree shown in fig. 4, the obtained association alarm is [ (switch 4, ethernet protocol down), (user plane data function, routing group unavailable) ], and when the association number is 20, the association value of the association alarm=20×0.16=3.2, and the association degree corresponding to the association alarm [ (switch 4, ethernet protocol down), (user plane data function, routing group unavailable) ] is 3.2.

And 104, generating alarm association rules according to the association alarms under the condition that the association degree is larger than a first preset threshold value.

Specifically, after the computer obtains the association degree of the association alarms, it is detected whether the obtained association degree meets a first preset threshold value, and when the association degree of the association alarms is greater than the first preset threshold value, it is determined that the association degree of the association alarms is high enough, the correlation between the association alarms is significant, and then an alarm association rule is generated according to the association alarms.

In one example, a computer generates alert association rules based on association alerts, comprising: acquiring a first alarm key feature corresponding to a root alarm and a second alarm key feature corresponding to a sub alarm in the associated alarm; the alarm key features comprise a resource type and an alarm code; generating an alarm association rule according to the first alarm key feature and the second alarm key feature; the alarm association rule includes: and under the condition that a plurality of alarms with the alarm key characteristics being the first alarm key characteristic and the second alarm key characteristic are detected, marking the alarms with the alarm key characteristics being the first alarm key characteristic as root alarms, marking the alarms with the alarm key characteristics being the second alarm key characteristics as sub alarms, and marking the root alarms and the sub alarms as associated alarms. Under the condition that the association degree of the associated alarms is detected to be larger than a first preset threshold value, the computer starts an alarm association rule generating process, extracts alarm key features of the associated alarms, and acquires a resource type 1 and an alarm code 1 corresponding to a root alarm and a resource type 2 and an alarm code 2 corresponding to a sub alarm in the associated alarms. According to the acquired alarm key features, generating alarm association rules for marking the alarm with the alarm key feature being a first alarm key feature as a root alarm, marking the alarm with the alarm key feature being a second alarm key feature as a sub alarm and associating the root alarm with the sub alarm under the condition that a plurality of alarms with the alarm key features being the first alarm key feature and the second alarm key feature are detected. By means of feature extraction, the method and the device can accurately identify the associated alarms according to the alarm association rules corresponding to the associated alarms with strong association degree, facilitate the subsequent accurate identification of the associated alarms by using the alarm association rules, and improve the efficiency and accuracy of the associated alarm identification. In one example, after generating the alarm association rule according to the association alarm, the computer further includes: updating the validity of the alarm association rule according to the real-time alarm message or the historical alarm slice; and under the condition that the validity degree of the alarm association rule is larger than a second preset threshold value, validating the alarm association rule. After the computer generates the alarm association rule, the generated initial alarm association rule can be stored in the seed alarm association rule set or set as the seed alarm association rule, then the effective degree of the alarm association rule in the actual application process is evaluated according to the real-time alarm message or the alarm information in the history alarm slice, and the effective degree of the alarm association rule is updated according to the evaluation result. And detecting whether the validity degree of the alarm association rule is larger than a second preset threshold value according to preset duration or after updating the validity degree each time, and under the condition that the validity degree of the alarm association rule is larger than the second preset threshold value, moving the alarm association rule set as a seed alarm association rule or the alarm association rule stored in a seed alarm association rule set into a formal alarm association rule set or setting the alarm association rule as a formal alarm association rule, namely validating the alarm association rule, and starting to use the alarm association rule to carry out association alarm analysis on alarms occurring in a network architecture.

In another example, the computer updates the validity of the alert association rule based on the real-time alert message or the historical alert slice, including: determining an alarm with a changed alarm state according to the real-time alarm message or the alarm information in the history alarm slice; the alarm state comprises reporting alarm and alarm recovery; detecting whether an alarm state change of the associated alarm is reported in a preset time interval under the condition that the alarm belongs to the associated alarm corresponding to the alarm association rule; under the condition that the alarm state of the associated alarm is not reported, the effective degree of the alarm association rule is adjusted downwards; under the condition that the alarm state change of the associated alarm is reported, the effective degree of the alarm association rule is adjusted according to the reporting sequence of the alarm state change of the associated alarm. When the computer adjusts the effective degree of the alarm association rule, the computer acquires the real-time alarm information or the alarm information in the history alarm slice, and acquires the resource and the alarm code of the alarm with the reporting alarm and/or the alarm recovery through the analysis of the alarm information. Detecting whether the acquired alarm belongs to the associated alarm corresponding to the alarm association rule, and further detecting whether the alarm state change of the associated alarm is reported in a preset time interval under the condition that the acquired alarm belongs to the associated alarm corresponding to the alarm association rule. That is, under the condition that the up-report alarm message is obtained, detecting whether the associated alarm report occurs within a certain time period before and after the up-report alarm message occurs; and under the condition that the alarm recovery message is acquired, detecting whether the associated alarm recovery occurs within a certain time period before and after the alarm recovery message occurs. Under the condition that the alarm state change of the associated alarm is detected not to be reported in a preset time interval, the effective degree of the alarm association rule is adjusted downwards; under the condition that the alarm state change of the associated alarm is reported in the preset time interval, the effective degree of the alarm association rule is adjusted according to the reporting sequence of the alarm state change of the associated alarm. By further verifying the validity of the alarm association rule by using the historical alarm slice or the real-time alarm message, the applicability of the alarm association rule to the current network architecture is accurately measured, so that after the alarm association rule is effective, the system can timely and efficiently analyze the association alarm in the current network architecture.

When the computer measures the effective degree of the alarm association rule, an effective score can be preset for each alarm association rule, a score is added when the effective degree is adjusted upwards each time, a score is subtracted when the effective degree is adjusted downwards, the preset effective score can be a fixed value, the preset effective score can be a score set according to the association degree of the alarm association, and the score adjustment step length can also be set by oneself.

Further, the computer adjusts the validity degree of the alarm association rule according to the reporting sequence of the alarm state change of the association alarm, including: when the alarm state change reporting sequence in the associated alarm is based on the alarm state change reporting, and the sub-alarm state change is reported, the effective degree of the alarm association rule is up-regulated; and when the alarm state change reporting sequence in the associated alarm is the sub alarm state change reporting, and the root alarm state change is reported, the effective degree of the alarm association rule is adjusted downwards. Under the condition that the computer detects that the alarm state change of the associated alarm is reported in a preset time window, detecting the reporting sequence of the alarm state change, and judging that the alarm association rule is valid and up-regulating the validity degree of the alarm association rule under the condition that the computer reports the sub-alarm state change after detecting that the reporting sequence of the alarm state change is the root alarm state change in the associated alarm; and when the sequence of reporting the alarm state change is the sub alarm state change in the associated alarm, and the root alarm state change is reported, judging that the alarm association rule is invalid, and reducing the validity degree of the alarm association rule. The validity of the alarm association rule is accurately detected and adjusted by detecting the sequence of the root alarm state change and the sub alarm state change in the association alarm, so that the verification of the validity degree of the alarm association rule is accurately completed.

In another example, after validating the alert association rule, the computer further includes: updating the effective degree of the effective alarm association rule according to the real-time alarm message; and under the condition that the validity degree of the alarm association rule is not greater than a second preset threshold value, invalidating the alarm association rule. After the alarm association rule is validated, the computer updates the validated alarm association rule in real time according to the real-time alarm message in the current network architecture by adopting a verification mode similar to the validated alarm association rule, namely, updates the validated alarm association rule set as a formal alarm association rule or a rule stored in a formal alarm association rule set, detects the relation between the validated alarm association rule validation degree and a second preset threshold value after each update or after a preset time interval, and fails the alarm association rule under the condition that the validated alarm association rule validation degree is not greater than the second preset threshold value, namely, sets the formal alarm association rule as a failure rule, resets the formal alarm association rule as a seed alarm association rule or directly moves out of the formal alarm association rule set. When the alarm association rule is disabled by the computer, the alarm association rule may be removed from the set of validation rules or set to a disabled state, which is not limited in this embodiment. By updating the validity degree and the validation state of the alarm association rule in real time after the alarm association rule is applied, a large number of rules which are not applicable to the current network architecture are prevented from being existed in the validation rule, the alarm association rule in the validation can be well applicable to the current network architecture, and the accuracy and the high efficiency of alarm association analysis are ensured.

In addition, after the alarm association rule is invalidated, the invalidated alarm association rule may be added to a storage set of other alarm analysis rules, for example, tidal-type service association alarm influence analysis, which is not limited in this embodiment.

In another example, after updating the validity of the alert association rule according to the real-time alert message or the historical alert slice, the computer further includes: deleting the alarm association rule under the condition that the effective degree of the alarm association rule is smaller than a third preset threshold value; wherein the third preset threshold is smaller than the second preset threshold. After updating the validity of the alarm association rule, the computer also detects whether the validity of the alarm association rule meets a third preset threshold value lower than the second preset threshold value, and deletes the alarm association rule with the validity lower than the third preset threshold value. By setting a third preset threshold, a lower limit is set for the effectiveness of the alarm association rule, and when the effectiveness of the alarm association rule is too low, the alarm association rule is judged to be completely unsuitable for the current network architecture, and is deleted, so that the situation that too many useless alarm association rules need to be stored and maintained is avoided, and the processing pressure is reduced.

In summary, referring to fig. 5, the process of performing alarm association rule mining maintenance by the computer according to the alarm information at least includes but is not limited to the following steps:

The specific implementation of the alarm association rule mining is similar to the alarm association rule generating method, and will not be described herein.

And 105, carrying out effective degree evaluation and updating on the generated alarm association rule, and dynamically maintaining the generated alarm association rule according to the effective degree.

Specifically, after the computer digs out a series of alarm association rules, the computer stores the mined alarm association rules in a pre-created alarm association rule base, for example, stores the newly mined alarm association rules in the seed rule base as seed alarm association rules. Then according to the historical alarm slice or the real-time alarm message, evaluating and updating the effective degree of the seed alarm association rule in the seed rule base, setting the seed alarm association rule as a formal alarm association rule under the condition that the effective degree of any seed alarm association rule exceeds a second preset threshold, and adding the formal alarm association rule into a formal rule base storing the effective rule; and under the condition that the effective degree of any seed alarm association rule is smaller than a third preset threshold, deleting or moving the seed alarm association rule out of the seed rule base directly.

After the alarm association rule is generated, the validity degree of the formal alarm association rule in effect is evaluated and updated, and the formal alarm association rule in any effect is set to be in a failure state or is removed or directly deleted under the condition that the validity degree of the formal alarm association rule in any effect is not greater than a second preset threshold. The validity of the alarm association rule in effect is ensured by dynamically maintaining the generated alarm association rule and the alarm association rule in effect according to the real-time alarm information or the history alarm information, and the analysis efficiency is improved by timely clearing the alarm association rule which is not suitable for the current network architecture, reducing the resource occupation of the alarm association rule storage, reducing the number of the alarm association rules which need to be traversed in the process of association alarm analysis.

In addition, referring to fig. 6, a schematic structural diagram of an alarm association rule mining maintenance device for implementing the alarm association rule mining maintenance includes: the relationship tree construction module 601 is configured to generate a resource type relationship tree according to a predefined resource association relationship when the system is initialized, and set an association coefficient on a relationship edge of the resource type relationship tree. The method comprises the steps of monitoring change information of a resource library by inquiring the resource library, simplifying complex resource relations in the resource library, only extracting an instance of a resource type to be analyzed, and organizing a resource instance relation tree used in the alarm association rule mining process.

The alarm slicing module 602 is configured to obtain, in a preset time, all the historical alarm information conforming to the resource association relationship in the alarm information of each resource in the resource instance relationship tree, use the obtained historical alarm information set as an analysis sample, divide the analysis sample according to the alarm occurrence time, and generate a continuous time slice including the alarm information.

The rule generating module 603 is configured to perform scan analysis on the alarm slice by using a correlation analysis algorithm, analyze the correlation and the correlation degree of the alarm on time and resources, perform feature extraction on a group of correlation alarm sets with the correlation degree meeting the requirements, and generate an alarm correlation rule in an initial state.

The rule maintenance module 604 is configured to dynamically maintain the generated alarm association rule, evaluate and update the validity degree of the seed alarm association rule in the initial state by monitoring a real-time alarm message or calling a history alarm message, and set any seed alarm association rule as a valid formal alarm association rule if the validity degree of the seed alarm association rule is greater than a second preset threshold; and deleting any sub-alarm association rule under the condition that the validity degree of the sub-alarm association rule is smaller than a third preset threshold. And updating the validity degree of the formal alarm association rules in effect according to the audible real-time alarm message or the historical alarm message, dynamically maintaining according to the updated validity degree, and setting the validity degree of the formal alarm association rules in any effect as a failure state or removing the formal rule library or directly deleting the formal alarm association rules under the condition that the validity degree of the formal alarm association rules in any effect is not greater than a second preset threshold.

Another aspect of the embodiments of the present application relates to an alarm association rule generating apparatus, referring to fig. 7, including:

the obtaining module 701 is configured to perform association alarm analysis on each resource in the resource type relationship tree according to the history alarm slice, and obtain association alarms and association times of the association alarms.

The calculating module 702 is configured to obtain a correlation coefficient corresponding to the correlation alarm according to a preset correlation strength between the resources.

And the determining module 703 is configured to obtain a correlation degree of the correlation alarm according to the correlation times and the correlation coefficient.

And the generating module 704 is configured to generate an alarm association rule according to the association alarm when the association degree is greater than a first preset threshold.

It is to be noted that this embodiment is an apparatus embodiment corresponding to the method embodiment, and this embodiment may be implemented in cooperation with the method embodiment. The related technical details mentioned in the method embodiment are still valid in this embodiment, and in order to reduce repetition, they are not described here again. Accordingly, the related technical details mentioned in the present embodiment may also be applied in the method embodiment.

It should be noted that, each module involved in this embodiment is a logic module, and in practical application, one logic unit may be one physical unit, or may be a part of one physical unit, or may be implemented by a combination of multiple physical units. In addition, in order to highlight the innovative part of the present invention, units less closely related to solving the technical problem presented by the present invention are not introduced in the present embodiment, but it does not indicate that other units are not present in the present embodiment.

Another aspect of the embodiments of the present application further provides an electronic device, referring to fig. 8, including: including at least one processor 801; and a memory 802 communicatively coupled to the at least one processor 801; the memory 802 stores instructions executable by the at least one processor 801, and the instructions are executed by the at least one processor 801 to enable the at least one processor 801 to perform the alert association rule generating method described in any one of the method embodiments.

Where the memory 802 and the processor 801 are connected by a bus, the bus may comprise any number of interconnected buses and bridges, which connect the various circuits of the one or more processors 801 and the memory 802 together. The bus may also connect various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art, and therefore, will not be described any further herein. The bus interface provides an interface between the bus and the transceiver. The transceiver may be one element or may be a plurality of elements, such as a plurality of receivers and transmitters, providing a means for communicating with various other apparatus over a transmission medium. The data processed by the processor 801 is transmitted over a wireless medium via an antenna, which in turn receives the data and transmits the data to the processor 801.

The processor 801 is responsible for managing the bus and general processing and may provide various functions including timing, peripheral interfaces, voltage regulation, power management, and other control functions. And memory 802 may be used to store data used by the processor 801 in performing operations.

Another aspect of the embodiments of the present application also provides a computer-readable storage medium storing a computer program. The computer program implements the above-described method embodiments when executed by a processor.

That is, it will be understood by those skilled in the art that all or part of the steps in implementing the methods of the embodiments described above may be implemented by a program stored in a storage medium, where the program includes several instructions for causing a device (which may be a single-chip microcomputer, a chip or the like) or a processor (processor) to perform all or part of the steps in the methods of the embodiments described herein. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a magnetic disk, or an optical disk, or other various media capable of storing program codes.

It will be understood by those of ordinary skill in the art that the foregoing embodiments are specific embodiments in which the present application is implemented and that various changes in form and details may be made therein without departing from the spirit and scope of the present application.

Claims

1. An alarm association rule generation method, comprising:

carrying out association alarm analysis on each resource in the resource type relation tree according to the history alarm slice to obtain association alarms and association times of the association alarms;

acquiring a correlation coefficient corresponding to the correlation alarm according to the preset correlation strength between the resources;

acquiring the association degree of the association alarm according to the association times and the association coefficient;

and generating an alarm association rule according to the association alarm under the condition that the association degree is larger than a first preset threshold value.

2. The method for generating alarm association rule according to claim 1, wherein the obtaining the association coefficient corresponding to the association alarm according to the preset association strength between the resources comprises:

acquiring a resource connection path between the resources where the associated alarms are located;

acquiring the preset alarm association strength among the resources corresponding to each sub-path in the resource connection path according to the preset alarm association strength among the resources;

and acquiring the association coefficient corresponding to the association alarm according to the preset alarm association strength among the resources corresponding to each sub-path.

3. The method for generating alert association rules according to claim 2, wherein the obtaining a resource connection path between the resources where the association alert is located comprises:

and acquiring the shortest resource connection path between the resources where the association alarm is located.

4. The alert association rule generating method according to claim 1, further comprising, after the alert association rule is generated according to the associated alert:

updating the effective degree of the alarm association rule according to the real-time alarm message or the history alarm slice;

and under the condition that the effective degree of the alarm association rule is larger than a second preset threshold value, validating the alarm association rule.

5. The alert association rule generating method according to claim 4, wherein updating the validity of the alert association rule according to the real-time alert message or the history alert slice comprises:

determining an alarm with a changed alarm state according to the real-time alarm message or the alarm information in the history alarm slice; wherein, the alarm state comprises reporting alarm and alarm recovery;

Detecting whether an alarm state change of the associated alarm is reported in a preset time interval under the condition that the alarm belongs to the associated alarm corresponding to the alarm association rule;

under the condition that the alarm state change of the association alarm is not reported, the effective degree of the alarm association rule is adjusted down;

and under the condition that the alarm state change of the associated alarm is reported, adjusting the effective degree of the alarm association rule according to the reporting sequence of the alarm state change of the associated alarm.

6. The method for generating alert association rules according to claim 5, wherein said adjusting the validity of the alert association rules according to the reporting order of the alert state changes of the associated alert comprises:

when the alarm state change reporting sequence in the associated alarm is that the alarm state change is reported according to the root alarm state change, and then the sub-alarm state change is reported, the effective degree of the alarm association rule is up-regulated;

and when the alarm state change reporting sequence in the associated alarm is that the sub alarm state change is reported, and then the root alarm state change is reported, the effective degree of the alarm association rule is adjusted down.

7. The alert association rule generating method according to claim 4, further comprising, after said validating said alert association rule:

updating the effective degree of the alarm association rule after the effective according to the real-time alarm message;

and under the condition that the validity degree of the alarm association rule is not greater than the second preset threshold value, invalidating the alarm association rule.

8. The alert association rule generating method according to any one of claims 4 to 7, further comprising, after updating the validity degree of the alert rule according to the real-time alert message or the history alert slice:

deleting the alarm association rule under the condition that the effective degree of the alarm association rule is smaller than the third preset threshold value; wherein the third preset threshold is less than the second preset threshold.

9. The method of generating alert association rules according to claim 1, wherein the generating alert association rules according to the associated alert comprises:

acquiring a first alarm key feature corresponding to a root alarm and a second alarm key feature corresponding to a sub alarm in the associated alarm; the alarm key features comprise a resource type and an alarm code;

Generating the alarm association rule according to the first alarm key feature and the second alarm key feature;

the alarm association rule includes: and under the condition that a plurality of alarms with the alarm key characteristics being the first alarm key characteristic and the second alarm key characteristic are detected, marking the alarms with the alarm key characteristics being the first alarm key characteristic as the root alarms, marking the alarms with the alarm key characteristics being the second alarm key characteristics as the sub alarms, and marking the root alarms and the sub alarms as associated alarms.

10. An alert association rule generating apparatus, comprising:

the acquisition module is used for carrying out association alarm analysis on each resource in the resource type relation tree according to the history alarm slice, and acquiring association alarms and association times of the association alarms;

the computing module is used for acquiring the association coefficient corresponding to the association alarm according to the preset association strength between the resources;

the determining module is used for acquiring the association degree of the association alarm according to the association times and the association coefficient;

and the generation module is used for generating an alarm association rule according to the association alarm under the condition that the association degree is larger than a first preset threshold value.

11. An electronic device, comprising:

at least one processor; the method comprises the steps of,

a memory communicatively coupled to the at least one processor; wherein,,

the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the alert association rule generation method as claimed in any one of claims 1 to 9.

12. A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the alarm association rule generation method of any one of claims 1 to 9.