CN116522213A - Service state level classification and classification model training method and electronic equipment - Google Patents
Service state level classification and classification model training method and electronic equipment Download PDFInfo
- Publication number
- CN116522213A CN116522213A CN202210072965.6A CN202210072965A CN116522213A CN 116522213 A CN116522213 A CN 116522213A CN 202210072965 A CN202210072965 A CN 202210072965A CN 116522213 A CN116522213 A CN 116522213A
- Authority
- CN
- China
- Prior art keywords
- alarm
- data
- sample data
- state level
- classification model
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000012549 training Methods 0.000 title claims abstract description 113
- 238000013145 classification model Methods 0.000 title claims abstract description 111
- 238000000034 method Methods 0.000 title claims abstract description 89
- 238000012545 processing Methods 0.000 claims description 51
- 238000005070 sampling Methods 0.000 claims description 21
- 238000012360 testing method Methods 0.000 claims description 18
- 238000004590 computer program Methods 0.000 claims description 5
- 238000011156 evaluation Methods 0.000 claims description 5
- 238000012216 screening Methods 0.000 claims description 5
- 238000004891 communication Methods 0.000 abstract description 4
- 238000000605 extraction Methods 0.000 description 30
- 238000002372 labelling Methods 0.000 description 13
- 238000004140 cleaning Methods 0.000 description 12
- 238000000691 measurement method Methods 0.000 description 12
- 238000001514 detection method Methods 0.000 description 10
- 238000012423 maintenance Methods 0.000 description 9
- 239000012634 fragment Substances 0.000 description 8
- 238000010586 diagram Methods 0.000 description 7
- 230000015556 catabolic process Effects 0.000 description 6
- 238000006731 degradation reaction Methods 0.000 description 6
- 230000001502 supplementing effect Effects 0.000 description 6
- 230000006870 function Effects 0.000 description 5
- 238000010606 normalization Methods 0.000 description 5
- 238000004422 calculation algorithm Methods 0.000 description 4
- 239000012792 core layer Substances 0.000 description 4
- 238000005516 engineering process Methods 0.000 description 3
- 230000000295 complement effect Effects 0.000 description 2
- 238000007418 data mining Methods 0.000 description 2
- 238000013461 design Methods 0.000 description 2
- 230000000694 effects Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000002093 peripheral effect Effects 0.000 description 2
- 230000002159 abnormal effect Effects 0.000 description 1
- 230000005856 abnormality Effects 0.000 description 1
- 230000002457 bidirectional effect Effects 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000003203 everyday effect Effects 0.000 description 1
- 238000005259 measurement Methods 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000007781 pre-processing Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/20—Administration of product repair or maintenance
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
- Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
- Y04S10/00—Systems supporting electrical power generation, transmission or distribution
- Y04S10/50—Systems or methods supporting the power network operation or management, involving a certain degree of interaction with the load-side end user applications
Landscapes
- Business, Economics & Management (AREA)
- Human Resources & Organizations (AREA)
- Engineering & Computer Science (AREA)
- Economics (AREA)
- Entrepreneurship & Innovation (AREA)
- Marketing (AREA)
- Operations Research (AREA)
- Quality & Reliability (AREA)
- Strategic Management (AREA)
- Tourism & Hospitality (AREA)
- Physics & Mathematics (AREA)
- General Business, Economics & Management (AREA)
- General Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The embodiment of the application relates to the technical field of communication, in particular to a business state level classification and classification model training method and electronic equipment, wherein the business state level classification method comprises the following steps: extracting features of the real-time alarm slice data; inputting the extracted characteristics of the alarm slice data into a pre-trained classification model for predicting the service state level; acquiring a service state level output by the classification model to obtain a service state level of real-time alarm slice data; the method comprises the steps that a classification model is obtained through training under a self-training framework of semi-supervised learning, an alarm sample data set for training the classification model comprises first alarm sample data and second alarm sample data, and the first alarm sample data comprises: the second type of alarm sample data only comprises the characteristics of the alarm slice data. Under the condition of reducing preconditions, the accuracy and the high efficiency of service state classification are ensured.
Description
Technical Field
The present disclosure relates to the field of communications technologies, and in particular, to a method for classifying service states and training a classification model, and an electronic device.
Background
With the development of communication technology and the large-scale operation of related services, the structure of a communication network is more complex, and service functions tend to be layered. An alarm is an event report sent by a managed object when a specific event occurs, and can reflect the running condition of the network. When the equipment sends out an alarm and reports the alarm to the network management system, the network management system cannot directly judge whether the service can keep in a normal state or not, operation and maintenance personnel are required to search for screening alarms, and the important emergency degree of the alarms is judged so as to dispatch faults in time. However, in an actual operation and maintenance scene, operation and maintenance personnel can face thousands of alarms every day, if all alarms are screened one by one, the workload is huge, and the operation and maintenance efficiency of a network management system is definitely reduced. As can be seen, there is a need for an efficient method for determining the current network traffic operating conditions during the alarm monitoring process.
In the related art, the methods for classifying the service states based on the alarm data mainly include two types, one type is a method using experience rules, and the association rules are constructed through expert experience or a data mining algorithm, so that the state of the current network is judged according to the matching relation between the real-time alarm data and the rules. In the method, on one hand, the rule needs to be continuously maintained through expert experience, and on the other hand, the rule also needs to be updated in time after the system configuration is changed so as to adapt to the continuously changed running environment, and high requirements are set for the expert experience and the rule maintenance; yet another class is methods based on data mining classification models. At present, most of the methods train a classification model in a supervised mode and then predict real-time data, so that the methods rely on a large amount of marked data, and the marked data are difficult to collect, and high cost and abundant expert experience are required.
Disclosure of Invention
The application mainly aims to provide a business state level classification and classification model training method and electronic equipment, which are used for ensuring the accuracy and the high efficiency of business state classification under the condition of reducing preconditions.
In order to achieve the above objective, the present application proposes a service state level classification method, including: extracting features of the real-time alarm slice data; inputting the extracted characteristics of the alarm slice data into a pre-trained classification model for predicting the service state level; acquiring a service state level output by the classification model to obtain a service state level of real-time alarm slice data; the method comprises the steps that a classification model is obtained through training under a self-training framework of semi-supervised learning, an alarm sample data set for training the classification model comprises first alarm sample data and second alarm sample data, and the first alarm sample data comprises: the second type of alarm sample data only comprises the characteristics of the alarm slice data.
In order to achieve the above object, the present application proposes a classification model training method, including: acquiring an alarm sample data set for training a classification model, wherein the alarm sample data set comprises first-type alarm sample data and second-type alarm sample data, and the first-type alarm sample data comprises: the second type of alarm sample data only comprises the characteristics of the alarm slice data; dividing the first type of alarm sample data into a training set and a testing set; training an initial classification model by using a training set, and predicting the service state level of the second type of alarm sample data according to the initial classification model trained by using the training set; distributing and aligning the predicted service state level, and carrying out balance sampling on the second type of alarm sample data according to the distributed and aligned service state level; generating third type alarm sample data according to the predicted service state level of the second type alarm sample data obtained by balanced sampling, wherein the third type alarm sample data comprises the characteristics of alarm slice data and the marking information of the predicted service state level; and retraining the classification model by using the training set and the third type of alarm sample data until the evaluation result of the currently trained classification model reaches the expectation based on the test set.
To achieve the above object, the present application proposes an electronic device including: at least one processor; and a memory communicatively coupled to the at least one processor; the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the business state level classification method or the classification model training method.
To achieve the above object, the present application proposes a computer readable storage medium storing a computer program which, when executed by a processor, implements the above-mentioned business state level classification method, or the above-mentioned classification model training method.
In the embodiment of the application, the real-time alarm slice data is subjected to feature extraction, and the extracted features of the alarm slice data are input into a pre-trained classification model for predicting the service state level to obtain the service state level of the real-time alarm slice data; expert experience and manual assistance are not needed, and labor cost is reduced. Meanwhile, the classification model is obtained by training under a self-training framework of semi-supervised learning, the alarm sample data set for training the classification model comprises first alarm sample data and second alarm sample data, and the first alarm sample data comprises: the second type of alarm sample data only comprises the characteristics of the alarm slice data, namely, a large amount of marked data is not needed in the implementation process, so that the marking cost is reduced, and the accuracy and the high efficiency of the service state classification can be effectively ensured.
Drawings
FIG. 1 is a flow chart of a business state level classification method according to one embodiment of the present application;
FIG. 2 is a schematic diagram I of a business state level classification method according to an embodiment of the present application;
FIG. 3 is a second schematic diagram of a business state level classification method according to an embodiment of the present application;
FIG. 4 is a third schematic diagram of a business state level classification method according to an embodiment of the present application;
FIG. 5 is a schematic diagram of a method for classifying service status levels according to an embodiment of the present application;
FIG. 6 is a schematic diagram five of a business state level classification method according to an embodiment of the present application;
FIG. 7 is a flow chart of a classification model training method according to one embodiment of the present application;
FIG. 8 is a schematic diagram of a classification model training method according to an embodiment of the present application;
fig. 9 is a schematic structural diagram of an electronic device according to an embodiment of the present application.
Detailed Description
For the purpose of making the objects, technical solutions and advantages of the embodiments of the present application more apparent, the embodiments of the present application will be described in detail below with reference to the accompanying drawings. However, as will be appreciated by those of ordinary skill in the art, in the various embodiments of the present application, numerous technical details have been set forth in order to provide a better understanding of the present application. However, the technical solutions claimed in the present application can be implemented without these technical details and with various changes and modifications based on the following embodiments. The following embodiments are divided for convenience of description, and should not be construed as limiting the specific implementation of the present application, and the embodiments may be mutually combined and referred to without contradiction.
The terms "first", "second" in the embodiments of the present application are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defining "a first" or "a second" may explicitly or implicitly include at least one such feature. In the description of the present application, the terms "comprise" and "have," along with any variations thereof, are intended to cover non-exclusive inclusions. For example, a system, article, or apparatus that comprises a list of elements is not limited to only those elements or units listed but may alternatively include other elements not listed or inherent to such article, or apparatus. In the description of the present application, the meaning of "plurality" means at least two, for example, two, three, etc., unless specifically defined otherwise.
One embodiment of the invention relates to a business state level classification method. The specific flow is shown in figure 1. The method can be applied to a telecommunication network supporting a large-scale service group, such as a bearing network, wherein each device can send out an alarm to reflect the current network operation condition when a specific event occurs.
Step 101, extracting features of real-time alarm slice data;
102, inputting the extracted characteristics of the alarm slice data into a pre-trained classification model for predicting the service state level; the method comprises the steps that a classification model is obtained through training under a self-training framework of semi-supervised learning, an alarm sample data set for training the classification model comprises first alarm sample data and second alarm sample data, and the first alarm sample data comprises: the second type of alarm sample data only comprises the characteristics of the alarm slice data.
And step 103, obtaining the service state level output by the classification model, and obtaining the service state level of the real-time alarm slice data.
In the embodiment, feature extraction is performed on real-time alarm slice data, and the extracted features of the alarm slice data are input into a pre-trained classification model for predicting service state levels, so that the service state levels of the real-time alarm slice data are obtained; expert experience and manual assistance are not needed, and labor cost is reduced. Meanwhile, the classification model is obtained by training under a self-training framework of semi-supervised learning, the alarm sample data set for training the classification model comprises first alarm sample data and second alarm sample data, and the first alarm sample data comprises: the second type of alarm sample data only comprises the characteristics of the alarm slice data, namely, a large amount of marked data is not needed in the implementation process, so that the marking cost is reduced, and the accuracy and the high efficiency of the service state classification can be effectively ensured.
The implementation details of the service state level classification method of the present embodiment are specifically described below, and the following description is provided only for convenience of understanding, and is not necessary to implement the present embodiment.
In step 101, feature extraction is performed on the real-time alert slice data. For example, real-time alarm stream data in a service scene of a carrier network is obtained, and the real-time alarm stream data is subjected to preprocessing of steps such as complement of missing information, cleaning of noise redundancy, dynamic slicing of stream data and the like, so that alarm slice data are obtained.
In one example, the features of the alert slice data include one or any combination of the following: basic features, location features, fuzzy features, alert code features. That is, after the real-time alarm slice data is obtained, the real-time alarm slice data is subjected to feature extraction processing of multiple dimensions such as basic, position, ambiguity, alarm code and the like, so as to obtain alarm sample data.
Wherein basic features are extracted, for example: the method comprises the steps of extracting the number of alarms in statistical alarm slice data, including a plurality of different network elements, a plurality of different alarm codes, a plurality of different clearing types, a maximum value of alarm duration, a relative value of the maximum value of alarm duration, a plurality of different severity alarms, a ratio of the number of different severity alarms to the total alarm number, a plurality of different alarm types, a number of alarms in different alarm types, a ratio of the number of alarms in different alarm types to the number of total alarms, and sharing parameters such as the number of alarms generated by the business of the same asset in the same time range as basic characteristics of the alarm slice data.
Extracting location features, such as: and extracting parameters such as the number of core layer alarms, the ratio of the number of core layer alarms to the total alarms, the number of service tunnel pseudo-wire alarms, the ratio of the number of service tunnel pseudo-wire alarms to the total alarms, the number of network element alarms, the ratio of the number of network element alarms to the total alarms, the number of single-board port alarms, the ratio of the number of single-board port alarms to the total alarms and the like in the statistics alarm slice data as the position characteristics of the alarm slice data.
Extracting blur features, such as: and acquiring service fuzzy alarm slices, which are related to a plurality of services, of each alarm in the process of cleaning the alarm data. Firstly, the occurrence time of the first alarm data in the current alarm slice data is taken as the starting time, the clearing time of the last alarm is taken as the ending time, and the unique service identifier of each alarm data in the alarm slice data is obtained. For example, a service unique identifier to which the alarm data Q belongs is obtained, all alarm data related to the service is obtained by inquiring in a service fuzzy alarm according to the service unique identifier, then service fuzzy alarm fragments which accord with a time interval from a start time to an end time are obtained, and a service fuzzy alarm slice is obtained, namely all alarms corresponding to the service are obtained, fragments which accord with a start time and a stop time are obtained, the fragments are all placed in alarm slice data where the alarm data Q is located, and similarly, the fuzzy characteristics of the current alarm slice data can be obtained by carrying out the same characteristic extraction processing on the slice as the alarm slice data. In a general case, each alarm has a uniquely associated service, where a service-obscuring alarm refers to the case that there is no alarm associated with the service, or that one alarm is associated with more than one service, i.e., the relation between the alarm and the service is ambiguous.
Extracting alarm code features, such as: by observing and statistically analyzing the alarm slice data, the alarm codes are divided into a plurality of alarm code combinations capable of representing different service states, so that parameters such as the number of alarms in different alarm code combinations in the alarm slice data, the ratio of the number of alarms in different alarm code combinations to the total alarm number and the like are counted to be used as the alarm code characteristics of the alarm slice data.
In step 102, the extracted features of the alert slice data are input into a pre-trained classification model for predicting traffic state levels. The method comprises the steps that a classification model is obtained through training under a self-training framework of semi-supervised learning, an alarm sample data set for training the classification model comprises first alarm sample data and second alarm sample data, and the first alarm sample data comprises: the second type of alarm sample data only comprises the characteristics of the alarm slice data. That is, the alarm sample data obtained by the real-time processing is input into the classification model obtained by training in the offline learning stage, so as to obtain the service state classification result.
In one example, the alert sample data set is obtained by: acquiring historical alarm stream data in a network service scene; acquiring network operation index data in a corresponding time interval of the historical alarm stream data; acquiring a plurality of alarm slice data according to the historical alarm stream data, and marking the service state level of part of alarm slice data in the plurality of alarm slice data according to the network operation index data; and generating the first type of alarm sample data according to the alarm slice data marked with the service state level, and generating the second type of alarm sample data according to the alarm slice data not marked with the service state level.
Specifically, as shown in fig. 2, the alert sample data set in this embodiment is acquired in an offline learning stage, and the offline learning stage is shown on the left side of fig. 2, and includes: the device comprises a data acquisition module, a data processing module and a slice labeling module. The data acquisition module is configured to acquire historical alarm stream data in a network service scene, and meanwhile, acquire network operation index data obtained according to a measurement method in a corresponding time interval of the historical alarm stream data, where the measurement method is not limited in this embodiment, and includes, but is not limited to, TWAMP detection, I n band oam detection, and the like. And the data processing module is used for obtaining alarm slice data according to the historical alarm stream data and can carry out the steps of complement of missing information, cleaning of noise redundancy, dynamic slicing of the alarm stream data and the like. The slice labeling module is used for labeling a small amount of slices by using network operation index data obtained based on a measurement method to the alarm slice data obtained by processing, so as to obtain a small amount of labeled alarm slice data and a large amount of unlabeled alarm slice data; the first type of alarm sample data is generated according to the alarm slice data marked with the service state level, and the second type of alarm sample data is generated according to the alarm slice data not marked with the service state level. The network operation index data is used for obtaining a service state grading result so as to further label the alarm slice data and the like.
In addition, the offline learning stage further comprises a feature extraction module and a classification model training module. The feature extraction module is used for carrying out feature extraction processing on the historical alarm slice data in multiple dimensions such as basis, position, blurring, alarm codes and the like so as to obtain a small amount of marked alarm sample data and a large amount of unmarked alarm sample data; feature extraction of different dimensions of base, location, ambiguity, and alert codes are as described above. And the classification model training module is used for training the classification model by using a small amount of marked alarm sample data and a large amount of unmarked alarm sample data. A semi-supervised self-training framework is adopted in the training process, and a method of distributed alignment and rebalancing sampling is integrated in the self-training framework, so that the training of the classification model by using the partially marked unbalanced alarm data is realized.
That is, in the offline learning phase, as shown in fig. 3, it is possible to perform: and acquiring the historical alarm stream data in the network service scene, and simultaneously acquiring network operation index data obtained based on a measurement method in a corresponding time interval of the historical alarm stream data. And carrying out the steps of supplementing missing information, cleaning noise redundancy, dynamically slicing the alarm stream data and the like on the historical alarm stream data so as to obtain alarm slice data. And marking a small amount of slices by using network operation index data obtained based on a measurement method to the alarm slice data obtained through processing, so as to obtain a small amount of marked alarm slice data and a large amount of unmarked alarm slice data. And performing feature extraction processing on the historical alarm slice data in multiple dimensions such as basis, position, ambiguity, alarm codes and the like, so as to obtain a small amount of marked alarm sample data and a large amount of unmarked alarm sample data. The classification model is trained using a small amount of marked alert sample data and a large amount of unmarked alert sample data. A semi-supervised self-training framework is adopted in the training process, and a method of distributed alignment and rebalancing sampling is integrated in the self-training framework, so that training of a classification model by using partially marked unbalanced alarm data is realized. In addition, the process of feature extraction and data labeling is not limited to the execution sequence of both, and feature extraction and data labeling may be performed first, or feature extraction may be performed first and then.
In one example, the classification model is trained by: dividing the first type of alarm sample data into a training set and a testing set; training an initial classification model by using the training set, and predicting the service state level of the second type alarm sample data according to the initial classification model trained by using the training set; distributing and aligning the predicted service state level, and carrying out balance sampling on the second type of alarm sample data according to the distributed and aligned service state level; generating third type alarm sample data according to the predicted service state level of the second type alarm sample data obtained by the balance sampling, wherein the third type alarm sample data comprises characteristics of alarm slice data and marking information of the predicted service state level; and retraining the classification model by using the training set and the third type of alarm sample data until the evaluation result of the currently trained classification model reaches the expectation based on the test set.
Specifically, a small amount of first-type alarm sample data (labeled alarm sample data) x= { (X) is obtained b ,y b ) The method comprises the steps of carrying out a first treatment on the surface of the b e (1.), C) } a number of alarm sample data of the second type (unlabeled alarm sample data) u= { U b The method comprises the steps of carrying out a first treatment on the surface of the b e (1..d) }, C represents the number of marked samples and D represents the number of unmarked samples. y is b Representing the correspondence X b Service status level.
For example, the first type of alarm sample data is divided into test sets X test And training set X train . Using training set X train Training an initial classification modelPredicting the second type alarm sample data U by using the initial classification model to obtain the prediction distribution q of the second type alarm sample data b ＝p model (y|u b The method comprises the steps of carrying out a first treatment on the surface of the θ), where θ represents a parameter of the model; performing distribution alignment on the prediction distribution of each second type of alarm sample data, and calculatingWhere p (y) refers to the probability distribution of the alarm sample data of the first type, < >>Mean value of prediction distribution of the second type of alarm sample data is indicated, and normal (·) represents a normalization function. y is the number of service state levels, i.e. in the formula, P (y) represents the probability that the service state level corresponds to, e.g. y is 1, and P (y) represents the probability that the service state level is 1, e.g. 20%, etc.,/for the alarm sample data>May be used to achieve normalization. Distribution alignment in order to equalize sample data, for example, the service state level range is from one to four, distribution alignment is performed, the number corresponding to different service state levels is adjusted, and the situation of unbalanced sample is avoided.
And carrying out balanced sampling on the second type of alarm sample data according to the distribution alignment result to obtain third type of alarm sample data, wherein the third type of alarm sample data further comprises the predicted service state level of the second type of alarm sample data obtained by balanced sampling. According to the third type of alarm sample data and the original training set X train Retraining the classification model to obtain a new classification model, and using the new classification model to test set X test And predicting, and calculating the error between the prediction result and the real label, so as to evaluate the model performance. If the model performance does not meet the expectations, returning to predicting the second type of alarm sample data U to obtain the prediction distribution q of the second type of alarm sample data b ＝p model (y|u b The method comprises the steps of carrying out a first treatment on the surface of the θ) step, performing the next training round, if alreadyAnd if the current classification model meets the expectation, training can be ended, and the current classification model is output. As shown in fig. 4.
In one example, the balanced sampling of the second type of alert sample data according to the service status level after the distribution alignment includes: screening samples meeting constraint conditions from the second type of alarm sample data; extracting part of the second type alarm sample data from the samples meeting the constraint conditions according to a preset proportion rule; wherein the constraint condition includes: and in the prediction distribution of the service state level after the distribution alignment, when the difference value between the highest probability value and the second highest probability value reaches a set threshold value, the second type of alarm sample data corresponding to the highest probability value.
Screening samples meeting constraint conditions from second type alarm sample data predicted by a model, and then proportioningSampling these samples to obtain a "pseudo tag" sample set, i.e., a third type of alert sample data (μ) y Referring to the probability that a sample with a service state level number y is sampled, N y Refers to the number of samples with the service state level number of y, N 1 ≥N 2 ≥…≥N L Alpha.gtoreq.0 is used to adjust the ratio, N 1 For the number of samples corresponding to the class with the largest number of samples, the denominator is used for realizing normalization, and L is the maximum service state level in the samples, and can also represent the total number of service level levels in the samples). The constraint condition may be that a difference between a highest probability value and a second highest probability value in the prediction distribution after the distribution alignment processing is calculated, and when the difference reaches a set threshold, the constraint condition is considered to be satisfied, and a category corresponding to the highest probability value is regarded as a "pseudo tag". That is, the most accurate service state level is taken, and the most accurate service state level also needs to be higher than the less accurate service state level by a preset difference value to be used as a pseudo tag; when the "pseudo tag" sample satisfying the condition is no longer available, the training process is ended, and the current classification model is output, as shown in fig. 4.
In step 103, the service state level output by the classification model is obtained, and the service state level of the real-time alarm slice data is obtained. Namely, the service state level output by the classification model is used as the service state level of the real-time alarm slice data.
In one example, after the obtaining the service status level of the real-time alert slice data, the method further includes: triggering fault processing according to the service state level of the real-time alarm slice data; correcting the service state level of the real-time alarm slice data according to the processing result fed back after the fault processing is finished, and obtaining marking information of the corrected service state level; and the modified marking information of the service state level is used for updating the classification model. In an actual execution process, operation and maintenance personnel timely process service faults according to real-time service state grading results, the processing results can be fed back after the processing is completed, labels of alarm slice data are corrected, and the labels are used as new historical alarm data for offline learning to update a classification model.
As shown in the right side flow of FIG. 2, the method is composed of a data acquisition module, a data processing module, a feature extraction module, a classification model prediction module and a fault processing module in the online classification stage. The data acquisition module acquires real-time alarm stream data in a service scene of the bearer network. And the real-time data processing module is used for carrying out the processing of the steps of supplementing the missing information, cleaning the noise redundancy, dynamically slicing the stream data and the like on the real-time alarm data so as to obtain alarm slice data. And the feature extraction module is used for carrying out feature extraction processing on the real-time alarm slice data in multiple dimensions such as basis, position, blurring, alarm codes and the like, so as to obtain alarm sample data. And the classification model prediction module is used for inputting alarm sample data obtained through real-time processing into a classification model obtained through training in an offline learning stage for training, so as to obtain a service state classification result. The fault processing module is used for timely processing the service faults by operation and maintenance personnel according to the real-time service state grading result, feeding back the processing result after the processing is completed, correcting the labels of the alarm slice data, and then using the labels as new historical alarm data for offline learning.
That is, in the online classification stage in this embodiment, acquiring real-time alarm stream data in a carrier network service scenario may be performed. And carrying out the processing of the steps of supplementing the missing information, cleaning the noise redundancy, dynamically slicing the stream data and the like on the real-time alarm data, thereby obtaining alarm slice data. And carrying out feature extraction processing of multiple dimensions such as basic, position, fuzzy, alarm codes and the like on the real-time alarm slice data, thereby obtaining alarm sample data. And inputting alarm sample data obtained through real-time processing into a classification model obtained through training in an offline learning stage for training, and obtaining a service state classification result. The operation and maintenance personnel timely process the service faults according to the real-time service state grading result, the processing result can be fed back after the processing is completed, the labels of the alarm slice data are corrected, and then the alarm slice data are used as new historical alarm data for offline learning. As shown in fig. 5.
That is, embodiments of the present application may be divided into an offline learning stage, in which a classification model is generated, and an online classification stage, in which a business state classification result is acquired according to the classification model, as shown in fig. 6. The slice in the figure is the alarm slice, and is also equivalent to the alarm slice data.
In the context of PTN (Packet Transport Network ), the technical solutions of the present application are described, the following are merely for convenience of understanding, and are not limited in nature:
the data adopted in the embodiment are alarm data and asset configuration data of the PTN bearing network, and network operation index data based on a measurement method, which are collected by pre-buried detection points, and bidirectional active measurement protocol (tvamp) data. The alarm data contains the information of the service, the position, the alarm type, the severity and the like. The asset configuration data includes association information among different levels of assets such as network element nodes, links, services, and the like.
The embodiment comprises a data acquisition module, a data processing module, a slice labeling module, a feature extraction module and a classification model training module in an offline learning stage.
The data acquisition module acquires historical alarm stream data in a network service scene, and simultaneously needs to acquire twamp data in a corresponding time interval of the historical alarm stream data. And the data processing module is used for carrying out the processing of the steps of supplementing the missing information, cleaning the noise redundancy, dynamically slicing the alarm stream data and the like on the historical alarm stream data so as to obtain alarm slice data. And the slice labeling module is used for labeling a small amount of slices by using the network operation index data obtained based on the measurement method to obtain a small amount of labeled alarm slice data and a large amount of unlabeled alarm slice data. And the feature extraction module is used for extracting and processing features of multiple dimensions such as a base, a position, a blur, an alarm code and the like of the historical alarm slice data so as to obtain a small amount of marked alarm sample data and a large amount of unmarked alarm sample data. The classification model training module is responsible for training the classification model by using a small amount of marked alarm sample data and a large amount of unmarked alarm sample data. A semi-supervised self-training framework is adopted in the training process, and a method of distributed alignment and rebalancing sampling is integrated in the self-training framework, so that training of a classification model by using partially marked unbalanced alarm data is realized.
The embodiment is composed of a data acquisition module, a data processing module, a characteristic extraction module, a classification model prediction module and a fault processing module in an online classification stage.
The data acquisition module acquires real-time alarm stream data in a service scene of the bearer network. And the real-time data processing module is used for carrying out the processing of the steps of supplementing the missing information, cleaning the noise redundancy, dynamically slicing the stream data and the like on the real-time alarm data so as to obtain alarm slice data. The feature extraction module performs feature extraction processing on the real-time alarm slice data in multiple dimensions such as base, position, ambiguity, alarm codes and the like, so as to obtain alarm sample data. And the classification model prediction module is used for inputting alarm sample data obtained through real-time processing into a classification model obtained through training in an offline learning stage for training, so as to obtain a service state classification result. And (3) fault processing, namely timely processing the service faults by operation and maintenance personnel according to the real-time service state grading result, feeding back the processing result after the processing is completed, correcting the labels of the alarm slice data, and then using the labels as new historical alarm data for offline learning.
Further, the historical data processing module comprises alarm data associated asset information complementation, alarm data cleaning and alarm data slicing.
Alarm data associated asset information completion: and using a field representing the alarm sending position in the alarm data, carrying out joint query by means of the existing asset configuration data, acquiring unique identifiers of one or more services associated with each alarm, and complementing the unique identifiers into alarm associated service fields. And (3) cleaning alarm data: according to the quantity of the related services in the alarm data related service field, the alarm data related to only a single service is aggregated into service accurate alarm data, and the alarm data related to a plurality of services is aggregated into service fuzzy alarm data. Alarm data slicing: and dividing the accurate service alarm data into service alarm stream data belonging to different services according to the single service unique identifier of the service in the alarm associated service field. And then dividing the service alarm stream data into alarm slice data according to the time continuity.
The method is to acquire the first piece of alarm data from the alarm stream data, then create a new alarm slice, store the alarm and record the generation time. And continuously acquiring the next piece of alarm data from the alarm stream data, and calculating the time difference between the next piece of alarm data and the generation time of the last alarm. If the time difference is smaller than the set time interval, the alarm is stored in the alarm slice where the last alarm is located, and if the time difference is larger than the set time interval, a new alarm slice is created, and the alarm is stored. And similarly, the next alarm is obtained from the alarm stream data, and the operation is repeated until all alarms in the alarm stream are processed, so that the whole alarm stream data is segmented into alarm slice data.
Further, the slice labeling module comprises a twamp data anomaly detection and an alarm slice data labeling. tvamp data anomaly detection: the twamp data records a plurality of index data and the number of lost packets of the monitored service at each detection time point. And performing anomaly detection on the twamp data by using an isolated forest anomaly detection algorithm. And marking the service and the time point with abnormal indexes as degradation, and marking the service and the time point with all lost packets as interruption to obtain the tvamp data subjected to abnormality detection. Alarm slice data labeling: firstly, the occurrence time of the first alarm data in the alarm slice data is taken as the starting time, the clearing time of the last alarm is taken as the ending time, and the unique service identifiers of the alarms in the alarm slice data are respectively acquired. The starting time is subtracted by the longer set time m1 to obtain a time S, the starting time is subtracted by the shorter set time m2 to obtain a time S ', the ending time is subtracted by the shorter set time m2 to obtain a time E, and the ending time is subtracted by the longer set time m1 to obtain a time E'. And then acquiring index data fragments a of the twater data subjected to anomaly detection of the belonging service of the corresponding alarm slice data in the time S and time E 'intervals and index data fragments n in the time S' and time E intervals. The alarm slice data is marked as degraded or interrupted if there is a degradation or interruption phenomenon within the twamp data segment n, is marked as normal if there is no degradation or interruption phenomenon within the twamp data segment a, and is truncated as noise data if there is no degradation or interruption phenomenon within the twamp data segment n, but there is a degradation or interruption phenomenon within the twamp data segment a. And obtaining the alarm slice data with the labels according to the flow. The degradation, interruption, etc. correspond to different service status levels, for example, a first level and a second level, etc., and the correspondence may be adjusted according to actual situations.
Further, the feature extraction module comprises basic feature extraction, position feature extraction, fuzzy feature extraction, alarm code feature extraction and the like for all the alarm slice data with or without labels.
In this embodiment, a service state labeling and grading method based on unbalanced semi-supervised learning is provided. The method of merging data rebalancing under the self-training framework of semi-supervised learning is adopted, so that the unbalanced alarming data with labels and without labels are fully utilized for training a classification model, and finally, the business state classification based on the alarming data is realized. By analyzing the characteristics of the alarm data, the alarm stream data is dynamically segmented into alarm slice data and then the alarm samples are obtained through feature extraction, so that the integrity of alarm event information is ensured, and the multi-dimensional information of the alarm data can be fully utilized to achieve the effect of improving the performance of a model; on the basis of automatically marking the alarm data by using the network operation index data obtained based on the measurement method, the full utilization of the labeled data and the unlabeled data is realized by adopting a mode of combining semi-supervised self-training with rebalancing. Meanwhile, no expert experience and manual assistance are required, so that the marking cost is reduced, and the accuracy and the high efficiency of service state classification can be effectively ensured.
In the embodiment of the application, compared with a method using a fixed preset time window, the method has the advantages that the time sequence characteristics of alarm data are analyzed, the alarm stream data are dynamically segmented into alarm slice data, and then the alarm samples are obtained through feature extraction, so that the multi-dimensional information of the alarm data can be fully utilized on the basis of guaranteeing the integrity of alarm event information, and the better grading effect of the model performance is achieved; compared with the method using the supervised learning classification model, the method has the advantages that on the basis of automatically marking the alarm data by using the network operation index data obtained based on the measurement method, the full utilization of the labeled data and the unlabeled data is realized by combining the semi-supervised self-training with the rebalancing, the marking cost is reduced, and the accuracy and the high efficiency of service state classification can be effectively ensured under the condition that no expert experience and manual assistance are required.
One embodiment of the present invention relates to a classification model training method, as shown in fig. 7, comprising:
step 201, obtaining an alarm sample data set for training a classification model, where the alarm sample data set includes first-type alarm sample data and second-type alarm sample data, and the first-type alarm sample data includes: the second type of alarm sample data only comprises the characteristics of the alarm slice data;
Specifically, for example, historical alarm stream data in a network service scene is acquired, and network operation index data obtained based on a measurement method in a corresponding time interval of the historical alarm stream data is required to be acquired. And obtaining alarm slice data according to the historical alarm stream data, and carrying out the steps of supplementing missing information, cleaning noise redundancy, dynamically slicing the alarm stream data and the like. Marking a small amount of slices by using network operation index data obtained based on a measurement method to obtain a small amount of marked alarm slice data and a large amount of unmarked alarm slice data; the first type of alarm sample data is generated according to the alarm slice data marked with the service state level, and the second type of alarm sample data is generated according to the alarm slice data not marked with the service state level. The network operation index data is used for obtaining a service state grading result so as to further label the alarm slice data and the like.
Step 202, dividing the first type of alarm sample data into a training set and a testing set; for example, the first type of alert sample data (labeled sample data) is divided into test sets X test And training set X train 。
Step 203, training an initial classification model by using a training set, and predicting the service state level of the second type of alarm sample data according to the initial classification model trained by using the training set; for example, using training set X train Training an initial classification model, and predicting the second type alarm sample data U by using the initial classification model to obtain the prediction distribution q of the second type alarm sample data b ＝p model (y|u b The method comprises the steps of carrying out a first treatment on the surface of the θ), where θ represents a parameter of the model.
204, distributing and aligning the predicted service state level, and carrying out balance sampling on the second type of alarm sample data according to the distributed and aligned service state level; for example, a predictive distribution of alarm sample data of each second typePerforming distribution alignment and calculationWhere p (y) refers to the probability distribution of the first type of alert sample data,mean value of prediction distribution of the second type of alarm sample data is indicated, and normal (·) represents a normalization function.
Step 205, generating third class alarm sample data according to the predicted service state level of the second class alarm sample data obtained by balanced sampling, wherein the third class alarm sample data comprises the characteristics of alarm slice data and the labeling information of the predicted service state level. For example, the second type of alarm sample data is balanced sampled according to the distribution alignment result to obtain third type of alarm sample data, and the third type of alarm sample data further comprises the predicted service state level of the second type of alarm sample data obtained by balanced sampling.
In one example, the balanced sampling of the second type of alert sample data according to the service state level after the distribution alignment includes: screening samples meeting constraint conditions from the second type of alarm sample data; extracting part of the second type alarm sample data from the samples meeting the constraint conditions according to a preset proportion rule; wherein the constraint condition includes: and in the prediction distribution of the service state level after the distribution alignment, when the difference value between the highest probability value and the second highest probability value reaches a set threshold value, the second type of alarm sample data corresponding to the highest probability value. Specifically, samples meeting constraint conditions are screened from the second type of alarm sample data (unlabeled samples) subjected to model prediction, and then the samples are proportionedSampling these samples to obtain a "pseudo tag" sample set, i.e., a third type of alert sample data (μ) y Referring to the probability that a sample with a service state level number y is sampled, N y Refers to the number of samples with the service state level number of y, N 1 ≥N 2 ≥…≥N L Alpha is more than or equal to 0, and is used for adjusting the proportion, namely N1 is the number of samples corresponding to the category with the largest sample number, and is used as a denominator for realizing normalization, L is the maximum service state level in the samples, and can also represent the total number of service level levels in the samples). The constraint condition may be that a difference between a highest probability value and a second highest probability value in the prediction distribution after the distribution alignment processing is calculated, and when the difference reaches a set threshold, the constraint condition is considered to be satisfied, and a category corresponding to the highest probability value is regarded as a "pseudo tag". That is, the most accurate service state level is taken, and the most accurate service state level also needs to be higher than the less accurate service state level by a preset difference value to be used as a pseudo tag; and when the 'pseudo tag' sample meeting the condition can not be obtained any more, ending the training process and outputting the current classification model.
And 206, retraining the classification model by using the training set and the third type of alarm sample data until the evaluation result of the currently trained classification model reaches the expectation based on the test set. For example, based on the third type of alert sample data and the original training set X train Retraining the classification model to obtain a new classification model, and using the new classification model to test set X test And predicting, and calculating the error between the prediction result and the real label, so as to evaluate the model performance. If the model performance does not meet the expectations, returning to predicting the second type of alarm sample data U to obtain the prediction distribution q of the second type of alarm sample data b ＝p model (y|u b The method comprises the steps of carrying out a first treatment on the surface of the θ) performing the next training, and if the expected training is satisfied, ending the training and outputting the current classification model. In one example, the output of the model may also refer to the flow shown in FIG. 8.
In one example, the characteristics of the alert slice data include one or any combination of the following: basic features, location features, fuzzy features, alert code features. Among them, basic features are for example: the method comprises the steps of counting the number of alarms in alarm slice data, including a plurality of different network elements, a plurality of different alarm codes, a plurality of different clearing types, a maximum value of alarm duration, a relative value of the maximum value of alarm duration, a plurality of different severity alarms, a number of different severity alarms, a ratio of the number of different severity alarms to the total number of alarms, a plurality of different alarm types, a number of alarms in different alarm types, a ratio of the number of alarms in different alarm types to the number of total alarms, and parameters such as the number of alarms generated by the service of the same asset in the same time range.
Location features, such as: counting parameters such as the number of core layer alarms in the alarm slice data, the ratio of the number of core layer alarms to the total alarms, the number of service tunnel pseudo-wire alarms, the ratio of the number of service tunnel pseudo-wire alarms to the total alarms, the number of network element alarms, the ratio of the number of network element alarms to the total alarms, the number of single board port alarms, the ratio of the number of single board port alarms to the total alarms and the like.
Blur features, such as: and acquiring service fuzzy alarm slices, which are related to a plurality of services, of each alarm in the process of cleaning the alarm data. Firstly, the occurrence time of the first alarm data in the current alarm slice data is taken as the starting time, the clearing time of the last alarm is taken as the ending time, and the unique service identifier of each alarm data in the alarm slice data is obtained. For example, a service unique identifier to which the alarm data Q belongs is obtained, all alarm data related to the service is obtained by inquiring in a service fuzzy alarm according to the service unique identifier, then service fuzzy alarm fragments which accord with a time interval from a start time to an end time are obtained, and a service fuzzy alarm slice is obtained, namely all alarms corresponding to the service are obtained, fragments which accord with a start time and a stop time are obtained, the fragments are all placed in alarm slice data where the alarm data Q is located, and similarly, the fuzzy characteristics of the current alarm slice data can be obtained by carrying out the same characteristic extraction processing on the slice as the alarm slice data. In a general case, each alarm has a uniquely associated service, where a service-obscuring alarm refers to the case that there is no alarm associated with the service, or that one alarm is associated with more than one service, i.e., the relation between the alarm and the service is ambiguous.
Alert code features such as: and (3) observing and statistically analyzing the alarm slice data, dividing the alarm code into a plurality of alarm code combinations capable of representing different service states, so as to count the number of alarms in different alarm code combinations in the alarm slice data, and the ratio of the number of alarms in different alarm code combinations to the total alarm number and other parameters.
In addition, ST (Self-Training) semi-supervised learning may be adopted, in the Self-Training technology, class labels of unlabeled samples are predicted according to a current classifier model, the predicted labels are used as real class labels of the samples, and the samples are added into a Training sample set to be retrained, so as to update the classification model.
In the embodiment of the application, compared with a method using a supervised learning classification model, the method has the advantages that on the basis of automatically marking alarm data by using network operation index data obtained based on a measurement method, a semi-supervised self-training combined rebalancing mode is adopted, so that full utilization of labeled data and unlabeled data is realized, and under the condition that no expert experience and manual assistance are required, the marking cost is reduced, and the accuracy and the high efficiency of service state classification can be effectively ensured.
The above steps of the methods are divided, for clarity of description, and may be combined into one step or split into multiple steps when implemented, so long as they include the same logic relationship, and they are all within the protection scope of this patent; it is within the scope of this patent to add insignificant modifications to the algorithm or flow or introduce insignificant designs, but not to alter the core design of its algorithm and flow.
One embodiment of the invention relates to an electronic device, as shown in fig. 9, comprising at least one processor 301; and a memory 302 communicatively coupled to the at least one processor; wherein the memory 302 stores instructions executable by the at least one processor to enable the at least one processor to perform the business state level classification method described above or the classification model training method described above.
Where the memory and the processor are connected by a bus, the bus may comprise any number of interconnected buses and bridges, the buses connecting the various circuits of the one or more processors and the memory together. The bus may also connect various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art, and therefore, will not be described any further herein. The bus interface provides an interface between the bus and the transceiver. The transceiver may be one element or may be a plurality of elements, such as a plurality of receivers and transmitters, providing a means for communicating with various other apparatus over a transmission medium. The data processed by the processor is transmitted over the wireless medium via the antenna, which further receives the data and transmits the data to the processor.
The processor is responsible for managing the bus and general processing and may also provide various functions including timing, peripheral interfaces, voltage regulation, power management, and other control functions. And memory may be used to store data used by the processor in performing operations.
One embodiment of the present invention relates to a computer-readable storage medium storing a computer program. The computer program implements the above-described method embodiments when executed by a processor.
That is, it will be understood by those skilled in the art that all or part of the steps in implementing the methods of the embodiments described above may be implemented by a program stored in a storage medium, where the program includes several instructions for causing a device (which may be a single-chip microcomputer, a chip or the like) or a processor (processor) to perform all or part of the steps in the methods of the embodiments described herein. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a magnetic disk, or an optical disk, or other various media capable of storing program codes.
It will be understood by those of ordinary skill in the art that the foregoing embodiments are specific examples of carrying out the invention and that various changes in form and details may be made therein without departing from the spirit and scope of the invention.
Claims (10)
1. A method for classifying a service state level, comprising:
extracting features of the real-time alarm slice data;
inputting the extracted characteristics of the alarm slice data into a pre-trained classification model for predicting the service state level;
acquiring a service state level output by the classification model, and obtaining the service state level of the real-time alarm slice data;
the classification model is obtained by training under a self-training framework of semi-supervised learning, the alarm sample data set for training the classification model comprises first alarm sample data and second alarm sample data, and the first alarm sample data comprises: and the second type of alarm sample data only comprises the characteristics of the alarm slice data.
2. The traffic state level classification method according to claim 1, further comprising, after said obtaining the traffic state level of the real-time alert slice data:
triggering fault processing according to the service state level of the real-time alarm slice data;
correcting the service state level of the real-time alarm slice data according to the processing result fed back after the fault processing is finished, and obtaining marking information of the corrected service state level;
And the modified marking information of the service state level is used for updating the classification model.
3. The traffic state level classification method according to claim 1, wherein the features of the alert slice data comprise one or any combination of the following:
basic features, location features, fuzzy features, alert code features.
4. A traffic state level classification method according to any of claims 1 to 3, characterized in that the alert sample data set is obtained by:
acquiring historical alarm stream data in a network service scene;
acquiring network operation index data in a corresponding time interval of the historical alarm stream data;
acquiring a plurality of alarm slice data according to the historical alarm stream data, and marking the service state level of part of alarm slice data in the plurality of alarm slice data according to the network operation index data;
and generating the first type of alarm sample data according to the alarm slice data marked with the service state level, and generating the second type of alarm sample data according to the alarm slice data not marked with the service state level.
5. A traffic state level classification method according to any of claims 1 to 3, characterized in that the classification model is trained by:
Dividing the first type of alarm sample data into a training set and a testing set;
training an initial classification model by using the training set, and predicting the service state level of the second type of alarm sample data according to the initial classification model trained by using the training set;
distributing and aligning the predicted service state level, and carrying out balance sampling on the second type of alarm sample data according to the distributed and aligned service state level;
generating third type alarm sample data according to the predicted service state level of the second type alarm sample data obtained by the balance sampling, wherein the third type alarm sample data comprises characteristics of alarm slice data and marking information of the predicted service state level;
and retraining the classification model by using the training set and the third type of alarm sample data until the evaluation result of the currently trained classification model reaches the expectation based on the test set.
6. The traffic state level classification method according to claim 5, wherein said balanced sampling of said second type of alert sample data according to said distribution-aligned traffic state levels comprises:
screening samples meeting constraint conditions from the second type of alarm sample data;
Extracting part of the second type alarm sample data from the samples meeting the constraint conditions according to a preset proportion rule;
wherein the constraint condition includes: and in the prediction distribution of the service state level after the distribution alignment, when the difference value between the highest probability value and the second highest probability value reaches a set threshold value, the second type of alarm sample data corresponding to the highest probability value.
7. A method of training a classification model, comprising:
acquiring an alarm sample data set for training a classification model, wherein the alarm sample data set comprises first-type alarm sample data and second-type alarm sample data, and the first-type alarm sample data comprises: the second type of alarm sample data only comprises the characteristics of the alarm slice data;
dividing the first type of alarm sample data into a training set and a testing set;
training an initial classification model by using the training set, and predicting the service state level of the second type of alarm sample data according to the initial classification model trained by using the training set;
distributing and aligning the predicted service state level, and carrying out balance sampling on the second type of alarm sample data according to the distributed and aligned service state level;
Generating third type alarm sample data according to the predicted service state level of the second type alarm sample data obtained by the balance sampling, wherein the third type alarm sample data comprises characteristics of alarm slice data and marking information of the predicted service state level;
and retraining the classification model by using the training set and the third type of alarm sample data until the evaluation result of the currently trained classification model reaches the expectation based on the test set.
8. The classification model training method of claim 7, wherein the features of the alert slice data comprise one or any combination of the following:
basic features, location features, fuzzy features, alert code features.
9. An electronic device, comprising:
at least one processor; the method comprises the steps of,
a memory communicatively coupled to the at least one processor; wherein,,
the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the traffic state level classification method of any one of claims 1 to 6 or the classification model training method of claim 7 or 8.
10. A computer readable storage medium storing a computer program, wherein the computer program when executed by a processor implements the traffic state level classification method according to any one of claims 1 to 6, or the classification model training method according to claim 7 or 8.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210072965.6A CN116522213A (en) | 2022-01-21 | 2022-01-21 | Service state level classification and classification model training method and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210072965.6A CN116522213A (en) | 2022-01-21 | 2022-01-21 | Service state level classification and classification model training method and electronic equipment |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116522213A true CN116522213A (en) | 2023-08-01 |
Family
ID=87403396
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210072965.6A Pending CN116522213A (en) | 2022-01-21 | 2022-01-21 | Service state level classification and classification model training method and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116522213A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117539665A (en) * | 2024-01-09 | 2024-02-09 | 珠海金智维信息科技有限公司 | Efficient processing method for alarm event and computer readable storage medium |
-
2022
- 2022-01-21 CN CN202210072965.6A patent/CN116522213A/en active Pending
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117539665A (en) * | 2024-01-09 | 2024-02-09 | 珠海金智维信息科技有限公司 | Efficient processing method for alarm event and computer readable storage medium |
| CN117539665B (en) * | 2024-01-09 | 2024-04-12 | 珠海金智维信息科技有限公司 | Efficient processing method for alarm event and computer readable storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108415789B (en) | Node fault prediction system and method for large-scale hybrid heterogeneous storage system | |
| US20200272923A1 (en) | Identifying locations and causes of network faults | |
| CN113497726B (en) | Alarm monitoring method, alarm monitoring system, computer readable storage medium and electronic equipment | |
| CN114465874B (en) | Fault prediction method, device, electronic equipment and storage medium | |
| CN111242171A (en) | Model training, diagnosis and prediction method and device for network fault and electronic equipment | |
| US10616040B2 (en) | Managing network alarms | |
| CN112884159B (en) | Model updating system, model updating method and related equipment | |
| CN109347688A (en) | A kind of method and apparatus of positioning failure in a wireless local area network | |
| CN105471647A (en) | Power communication network fault positioning method | |
| US20210359899A1 (en) | Managing Event Data in a Network | |
| CN115550139A (en) | Fault root cause positioning method, device and system, electronic equipment and storage medium | |
| CN116522213A (en) | Service state level classification and classification model training method and electronic equipment | |
| CN110609761B (en) | Method and device for determining fault source, storage medium and electronic equipment | |
| CN107590008A (en) | A kind of method and system that distributed type assemblies reliability is judged by weighted entropy | |
| CN113572639B (en) | Carrier network fault diagnosis method, system, equipment and medium | |
| US20240113932A1 (en) | Telecommunication network alarm management | |
| Mijumbi et al. | MAYOR: machine learning and analytics for automated operations and recovery | |
| CN117376084A (en) | Fault detection method, electronic equipment and medium thereof | |
| CN114490303A (en) | Fault root cause determination method and device and cloud equipment | |
| Wang et al. | LSTM-based alarm prediction in the mobile communication network | |
| RU2786934C1 (en) | Method for predicting the failure of sensor and wireless network equipment based on ontology using machine learning | |
| Hairuman et al. | Evaluation of machine learning techniques for anomaly detection on hourly basis kpi | |
| US12015530B2 (en) | Management entity, network element, system, and methods for supporting anomaly detection for communication networks | |
| CN114422324B (en) | Alarm information processing method and device, electronic equipment and storage medium | |
| FI130073B (en) | Predictive maintenance of cable modems |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication |