CN117729576A - Alarm monitoring method, device, equipment and storage medium - Google Patents

Abstract

The application discloses an alarm monitoring method, an alarm monitoring device, alarm monitoring equipment and a storage medium, which relate to the technical field of computer networks and are used for improving the efficiency of monitoring the alarm of a core network. The method comprises the following steps: acquiring a plurality of pieces of alarm information of a core network, wherein the alarm information comprises: the associated resource information of the fault network element; determining association parameters between any two pieces of alarm information in the plurality of pieces of alarm information, wherein the association parameters are used for determining association degree between the two pieces of alarm information; determining a target alarm information set from a plurality of alarm information based on the association parameters between any two pieces of alarm information, wherein the association parameters between any two pieces of alarm information in at least two pieces of alarm information included in the target alarm information set are larger than a first preset threshold; and determining the target network element with the fault of the core network based on the associated resource information of the fault network element included in each piece of alarm information in the target alarm information set. The method and the device are applied to the scene of monitoring the alarm.

Description

Alarm monitoring method, device, equipment and storage medium

Technical Field

The present disclosure relates to the field of computer networks, and in particular, to a method, an apparatus, a device, and a storage medium for monitoring alarms.

Background

In the fifth generation mobile communication technology (5th generation mobile communication technology,5G) core network framework, network element functions have been fully virtualized based on virtualized network function (virtualised network function, VNF) architecture modules. The decoupling of different functional units of the core network is realized by constructing different network element functional units on general hardware (such as a physical machine), so that the 5G core network has high flexibility and high expandability. However, this architecture makes the network architecture of the 5G core network more complex than that of the 4G core network.

When fault monitoring is performed on the 5G core network, the index data (such as the number of access users, the access success rate, the success rate of session establishment of protocol data units (protocol data unit, PDUs)) and the alarm data of the core network can be reported through the network element or the manufacturer (operations management center, OMC) of the core network, so that the index data and the alarm data of the core network are analyzed through engineers, and active intervention processing is performed when a key index abnormality or a key alarm is found, so as to repair the fault.

However, when the core network is monitored by the engineer analyzing the index data and the alarm data, a great amount of experienced engineers are required to carry out total and comprehensive analysis on various related information to carry out fault processing, so that the time consumption is long, the manpower resources are wasted, and the complex network environment requirement of the 5G core network cannot be met. Therefore, the efficiency of monitoring the core network alarms is low.

Disclosure of Invention

The application provides an alarm monitoring method, device, equipment and storage medium, which are used for solving the technical problems that when an engineer analyzes index data and alarm data to monitor a core network, a great deal of experienced engineers are required to carry out total sum comprehensive analysis on various relevant information to carry out fault processing, the time consumption is long, the manpower resources are wasted, and the requirement of a complex network environment of a 5G core network cannot be met, so that the efficiency of monitoring the core network alarm is improved.

In order to achieve the above purpose, the present application adopts the following technical scheme:

in a first aspect, an alarm monitoring method is provided, the method including: acquiring a plurality of pieces of alarm information of a core network, wherein the alarm information comprises: the associated resource information of the fault network element; determining association parameters between any two pieces of alarm information in the plurality of pieces of alarm information, wherein the association parameters are used for determining association degree between the two pieces of alarm information; determining a target alarm information set from a plurality of alarm information based on the association parameters between any two pieces of alarm information, wherein the association parameters between any two pieces of alarm information in at least two pieces of alarm information included in the target alarm information set are larger than a first preset threshold; and determining the target network element with the fault of the core network based on the associated resource information of the fault network element included in each piece of alarm information in the target alarm information set.

In one possible implementation, the method further includes: determining whether data are interacted between a fault network element corresponding to first alarm information in a target alarm information set and a fault network element corresponding to any other alarm information based on a preset topological relation, wherein any other alarm information is alarm information except the first alarm information in the target alarm information set; and under the condition that the fault network element corresponding to the first alarm information and the fault network element corresponding to any other alarm information do not interact data, deleting the first alarm information from the target alarm information set.

In one possible implementation manner, the associated resource information includes a carrier network element, where the carrier network element is a network element for implementing a function of the faulty network element; based on the associated resource information of the failed network element included in each piece of alarm information in the target alarm information set, determining the target network element with the failed core network includes: and under the condition that the target bearing network element corresponding to any one of the alarm information in the target alarm information set fails in the target time period, determining the target network element with the failure of the core network as the target bearing network element.

In one possible implementation, the method further includes: and under the condition that the alarm information of the abnormal power supply of the machine room exists in the plurality of pieces of alarm information, determining that the reason of the failure of the core network is the abnormal power supply of the machine room.

In one possible implementation, the method further includes: determining target services carried by a plurality of fault network elements corresponding to a target alarm information set, wherein the plurality of fault network elements comprise fault network elements included in each piece of alarm information in the target alarm information set; inputting the target service into a target model, determining target service index parameters of the target service in a target time period, wherein the target model is used for simulating and executing the target service; and determining that the target service is abnormal under the condition that the target service index parameter is smaller than a second preset threshold or larger than a third preset threshold, wherein the second preset threshold is smaller than the third preset threshold.

In one possible implementation manner, the method further comprises the steps of determining target service index parameters of the target service in a preset time period based on the target model under the condition that the target service is determined to be abnormal and the alarm information of the core network is not received in the preset time period; and under the condition that the target service index parameter is larger than or equal to the second preset threshold value and smaller than or equal to the third preset threshold value, determining that the target service is recovered to be normal.

In a second aspect, an alarm monitoring apparatus is provided, the alarm monitoring apparatus including: an acquisition unit and a determination unit; the acquisition unit is used for acquiring a plurality of pieces of alarm information of the core network, wherein the alarm information comprises: the associated resource information of the fault network element; the determining unit is used for determining association parameters between any two pieces of alarm information in the plurality of pieces of alarm information, and the association parameters are used for determining association degree between the two pieces of alarm information; the determining unit is further used for determining a target alarm information set from the plurality of alarm information based on the association parameters between any two pieces of alarm information, and the association parameters between any two pieces of alarm information in at least two pieces of alarm information included in the target alarm information set are larger than a first preset threshold; the determining unit is further configured to determine, based on the associated resource information of the failed network element included in each alarm information in the target alarm information set, a target network element in which the core network fails.

In one possible implementation, the alarm monitoring device further includes a processing unit; the determining unit is further used for determining whether data are interacted between the fault network element corresponding to the first alarm information in the target alarm information set and the fault network element corresponding to any other alarm information, wherein any other alarm information is alarm information except the first alarm information in the target alarm information set, based on a preset topological relation; and the processing unit is used for deleting the first alarm information from the target alarm information set under the condition that the fault network element corresponding to the first alarm information does not interact data with the fault network element corresponding to any other alarm information.

In one possible implementation manner, the associated resource information includes a carrier network element, where the carrier network element is a network element for implementing a function of the faulty network element; the determining unit is further configured to determine that the target network element with the failed core network is the target bearer network element when the target bearer network element corresponding to any one of the alarm information in the target alarm information set fails within the target time period.

In a possible implementation manner, the determining unit is further configured to determine, in a case where it is determined that the alarm information of the power supply abnormality of the machine room exists in the plurality of pieces of alarm information, that the cause of the failure of the core network is the power supply abnormality of the machine room.

In a possible implementation manner, the determining unit is further configured to determine a target service carried by a plurality of faulty network elements corresponding to the target alarm information set, where the plurality of faulty network elements includes a faulty network element included in each alarm information in the target alarm information set; the determining unit is also used for inputting the target service into a target model, determining target service index parameters of the target service in a target time period, and the target model is used for simulating and executing the target service; the determining unit is further configured to determine that the target service is abnormal when the target service index parameter is smaller than a second preset threshold or larger than a third preset threshold, where the second preset threshold is smaller than the third preset threshold.

In a possible implementation manner, the determining unit is further configured to determine, based on the target model, a target service index parameter of the target service in a preset time period when it is determined that the target service is abnormal and no alarm information of the core network is received in the preset time period; and the determining unit is also used for determining that the target service is recovered to be normal under the condition that the target service index parameter is larger than or equal to the second preset threshold value and smaller than or equal to the third preset threshold value.

In a third aspect, an electronic device, comprising: a processor and a memory; wherein the memory is configured to store one or more programs, the one or more programs comprising computer-executable instructions that, when executed by the electronic device, cause the electronic device to perform an alert monitoring method as in the first aspect.

In a fourth aspect, there is provided a computer readable storage medium storing one or more programs, the one or more programs comprising instructions, which when executed by a computer, cause the computer to perform a method of alert monitoring as in the first aspect.

The application provides an alarm monitoring method, an alarm monitoring device, alarm monitoring equipment and a storage medium, which are applied to an alarm monitoring scene. When the core network needs to be monitored in an alarm mode, multiple pieces of alarm information of the core network can be obtained, the multiple pieces of alarm information are input into a target algorithm to determine association parameters between any two pieces of alarm information in the multiple pieces of alarm information, further, a target alarm information set, wherein the association parameters between any two pieces of alarm information are larger than a preset threshold value, is determined from the multiple pieces of alarm information based on the association parameters between any two pieces of alarm information, and further, a target network element with a fault in the core network is determined based on association resource information of a fault network element, which is included in each piece of alarm information in the target alarm information set. The larger the association parameter between two pieces of alarm information is, the larger the probability that the two pieces of alarm information are generated due to the same fault is, so that alarm information with higher association degree in a plurality of pieces of alarm information can be integrated into the same alarm information set, and the reason that the core network generates the fault is analyzed uniformly.

By the method, the target alarm information set can be determined from the plurality of alarm information, so that the target network element with the failure of the core network is determined based on the associated resource information of the failure network element included in each alarm information in the target alarm information set. Therefore, the technical problems that when the core network is monitored by analyzing index data and alarm data through engineers, a large amount of experienced engineers are required to carry out total sum comprehensive analysis on various relevant information and then carry out fault processing are solved, time consumption is long, manpower resources are wasted, the requirement of a complex network environment of the 5G core network can not be met, and the efficiency of monitoring the core network alarm is improved.

Drawings

Fig. 1 is a schematic structural diagram of an alarm monitoring system according to an embodiment of the present application;

fig. 2 is a schematic structural diagram of a warning monitoring system according to an embodiment of the present application;

FIG. 3 is a flowchart illustrating a method for monitoring alarms according to an embodiment of the present application;

fig. 4 is a schematic diagram of an FP-Tree provided in an embodiment of the present application;

fig. 5 is a second flow chart of an alarm monitoring method according to an embodiment of the present application;

fig. 6 is a schematic diagram of a cross-level topology relationship of a 5G core network according to an embodiment of the present application;

Fig. 7 is a flowchart of a method for monitoring alarms according to an embodiment of the present application;

fig. 8 is a flow chart diagram of an alarm monitoring method according to an embodiment of the present application;

fig. 9 is a flowchart fifth of an alarm monitoring method according to an embodiment of the present application;

fig. 10 is a flowchart of a method for monitoring an alarm according to an embodiment of the present application;

FIG. 11 is a flowchart of a core network alarm monitoring analysis according to an embodiment of the present application;

FIG. 12 is a schematic structural diagram of an alarm monitoring device according to an embodiment of the present disclosure;

fig. 13 is a schematic structural diagram of an electronic device according to an embodiment of the present application.

Detailed Description

The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application.

In the description of the present application, "/" means "or" unless otherwise indicated, for example, a/B may mean a or B. "and/or" herein is merely an association relationship describing an association object, and means that three relationships may exist, for example, a and/or B may mean: a exists alone, A and B exist together, and B exists alone. Further, "at least one", "a plurality" means two or more. The terms "first," "second," and the like do not limit the number and order of execution, and the terms "first," "second," and the like do not necessarily differ.

When the 5G core network is monitored for faults, index data and alarm data of the core network can be reported through network elements of the core network or OMC of a manufacturer, and then the index data and alarm data of the core network are analyzed through engineers, and active intervention processing is performed when key index abnormality or key alarm is found, so that faults are repaired. And when user complaints are received, the running state of the equipment in the core network can be inspected so as to carry out fault processing after judging and analyzing faults.

However, when the core network is monitored by analyzing the index data and the alarm data by engineers, a great deal of experienced engineers are required to manually sum up and comprehensively analyze various related information, fault processing can be performed after the cause of the fault is determined, the time consumption is long, the fault processing is often delayed, the manpower resources are wasted, and the complex network environment requirement of the 5G core network cannot be met. After receiving the user complaints, the fault processing is carried out, so that the user complaints are easy to cause, and the user experience is poor.

Specifically, when a core network fails, a large amount of alarm data and index abnormal data are often associated, but the current monitoring means lacks means for merging alarms caused by the same failure together, so that operation and maintenance personnel need to spend a large amount of time to process invalid alarm information, and operation and maintenance efficiency is reduced. When a fault occurs, the service range affected by the fault cannot be judged to confirm the fault handling priority. After the operation and maintenance personnel process the faults, whether the service operation is recovered to be normal cannot be verified. The technical requirements on operation and maintenance personnel are high, the operation and maintenance personnel need to be familiar with the business flow of the core network and know the query means of each data, and the operation and maintenance personnel can analyze and process faults in time, so that the labor cost is high.

The application provides an alarm monitoring method, when an alarm monitoring is required to be carried out on a core network, a plurality of pieces of alarm information of the core network can be obtained, the pieces of alarm information are input into a target algorithm to determine association parameters between any two pieces of alarm information in the pieces of alarm information, further, a target alarm information set with the association parameters between any two pieces of alarm information larger than a preset threshold value is determined from the pieces of alarm information based on the association parameters between any two pieces of alarm information, and further, a target network element with a fault of the core network is determined based on association resource information of a fault network element included in each piece of alarm information in the target alarm information set. The larger the association parameter between two pieces of alarm information is, the larger the probability that the two pieces of alarm information are generated due to the same fault is, so that alarm information with higher association degree in a plurality of pieces of alarm information can be integrated into the same alarm information set, and the reason that the core network generates the fault is analyzed uniformly.

By the method, the target alarm information set can be determined from the plurality of alarm information, so that the target network element with the failure of the core network is determined based on the associated resource information of the failure network element included in each alarm information in the target alarm information set. Therefore, the technical problems that when the core network is monitored by analyzing index data and alarm data through engineers, a large amount of experienced engineers are required to carry out total sum comprehensive analysis on various relevant information and then carry out fault processing are solved, time consumption is long, manpower resources are wasted, the requirement of a complex network environment of the 5G core network can not be met, and the efficiency of monitoring the core network alarm is improved.

The alarm monitoring method provided by the embodiment of the application can be applied to an alarm monitoring system. Fig. 1 shows a schematic diagram of an alarm monitoring system. As shown in fig. 1, the alarm monitoring system 10 includes: an electronic device 11, and a core network 12. The electronic device 11 and the core network 12 may be connected by a wired manner or may be connected by a wireless manner, which is not limited in the embodiment of the present invention.

The electronic device 11 is configured to obtain multiple pieces of alarm information of the core network 12 in the target time period, input the multiple pieces of alarm information to a target algorithm to determine association parameters between any two pieces of alarm information in the multiple pieces of alarm information, determine a target alarm information set from the multiple pieces of alarm information based on the association parameters between any two pieces of alarm information, and determine a network element with a failure in the core network 12 based on association resource information of the failure network element included in each piece of alarm information; the core network 12 is used to generate alarm information in the event of a failure.

Alternatively, the electronic devices 11 may each be a physical machine, for example: the electronic device may be a base station device, a desktop computer, also called desktop or desktop computer (desktop computer), or a server, or may be a server group formed by a plurality of servers. The core network 12 may be a network device that connects mobile devices to various networks.

As shown in fig. 2, the alarm monitoring system 20 includes: the system comprises a fault monitoring module 21, a fault association aggregation module 22, a business impact judging module 23, a fault root cause positioning module 24, a business recovery verification 25, an AI algorithm training platform 26 and a scene arrangement platform 27.

The fault monitoring module 21 is used for performing basic preprocessing operations such as monitoring and identifying the alarm information of the core network, normalizing the alarm information, associating resource information and the like so as to support subsequent fault analysis and positioning; the fault association and aggregation module 22 is used for identifying the faults of the core network, and carrying out association and aggregation on the faults of the core network through the models and scene flows output by the underlying AI algorithm platform and the scene arrangement platform so as to merge the homologous faults together; the service impact judging module 23 is used for analyzing the service scope affected by the core network fault through service topology analysis and gold index analysis, and outputting a specific service scope result and related judging basis.

The fault root positioning module 24 is configured to combine multi-level topology positioning capability and cross-professional positioning capability to perform multidimensional analysis on a cause of a core network fault, output a fault cause, and assist an operation and maintenance personnel to quickly determine the fault cause; the service restoration verification 25 is used for verifying key service indexes of the core network to check whether the service is restored to be normal or not; the AI algorithm training platform 26 is configured to provide big data algorithm training capabilities (including algorithm management, training task management, and training result query functions) to mine historical alarms and performance data of the core network, and support fault association and location of the core network; the scene orchestration platform 27 is used to provide visual orchestration design capabilities (including fault scene design and capability design).

The homologous failure refers to a failure caused by the same cause. The operator may configure algorithms and data training tasks on his own on the AI algorithm training platform 26. The operation and maintenance personnel can define the positioning flow on the scene arranging platform 27 according to different scene characteristics of the core network.

An alarm monitoring method provided in the embodiments of the present application is described below with reference to the accompanying drawings. As shown in fig. 3, the alarm monitoring method provided in the embodiment of the present application is applied to an electronic device, and the method includes S201-S204:

s201, acquiring a plurality of pieces of alarm information of a core network.

The alarm information comprises: the fault network element, the fault location information and the associated resource information of the fault network element, wherein the associated resource information comprises at least one of the following items: the method comprises the steps of bearing network elements, nodes (namely network element home nodes), resource pools (namely network element home resource pools), associated machine rooms and network element home nodes.

It can be appreciated that multiple pieces of alarm information of the kernel network in the target time period can be obtained through the electronic device.

Alternatively, a plurality of pieces of alarm data (each piece of alarm data includes a faulty network element and faulty location information) of the core network may be docked through the kafka message queue, and the plurality of pieces of alarm data are subjected to standardized processing and resource information association.

Specifically, the standardized processing process is as follows: and carrying out format standardization processing on fields such as alarm standard names, network management alarm levels, alarm logic classifications, alarm logic subclasses, influences of the event on the service, influences of the event on equipment and the like included in each piece of alarm data of different manufacturers so as to facilitate subsequent alarm analysis and processing.

The resource information association process is as follows: and associating the fault network element and the fault position information included in each piece of alarm data with a resource library, and filling the associated resource information corresponding to each piece of alarm data in the resource library into the alarm data to obtain a plurality of pieces of alarm information for supporting subsequent analysis.

The core network may be a 5G core network, for example.

S202, determining association parameters between any two pieces of alarm information in the plurality of pieces of alarm information.

The association parameter is used for determining the association degree between the two pieces of alarm information.

It can be appreciated that the plurality of alert information may be input to the target algorithm (i.e., the alert association model) by the electronic device to determine association parameters between any two of the plurality of alert information.

Optionally, alarm data may be obtained from the alarm data pool, and the relationship between alarms of the 5G core network may be analyzed based on the Fpgrouth algorithm, so as to obtain an alarm association model. Specifically, data clipping can be performed first, that is, whether an association relationship exists between each resource generating alarm data in the same time period is judged according to the resource association relationship data. If the resource association relation of the alarm data is known, the resource of one alarm data in the alarm item set is not associated with other resources, then the characteristic values of all alarms generated by the resource are deleted from the alarm item set, and the filtered alarm events are independently stored to generate a new alarm item set.

Further, a frequent pattern Tree (Frequent Pattern Tree, FP-Tree) may be constructed, i.e. the clipped alarm data may be combined according to the alarm association time window to form the original data item set. And deleting the alarm data with low support according to the occurrence frequency of the alarm data, and generating an FP-Tree according to the processed data. And further constructing frequent item sets, namely uniformly traversing each path in the FP-Tree, and recording the frequent item sets under each path.

By way of example, as shown in FIG. 4, the resources of the respective alert data may include: MP and SC management plane communication abnormality, host computer calculation service off-line, physical machine Ethernet port off-line and port off-line alarm. A1, B1 and C1 (A1, B1 and C2, A1, B2 and C3, and A1, B3 and C4 are the same meaning) are a path in the FP-Tree, and A1, B1 and C1 can form a frequent item set. In this application, A1 may be an abnormal communication of the management plane between the MP and the SC, B1 may be offline for the host computing service, C1 may be offline for the physical machine ethernet port, C2 may be offline for the port alarm, B2 may be offline for the physical machine ethernet port, and C3 may be offline for the port alarm.

Furthermore, frequent item set association analysis can be performed, namely after frequent item sets of the FP-Tree are traversed and analyzed, alarm association can be calculated according to the occurrence times of the frequent item sets, and confidence level is confirmed, so that implicit association among alarms of a core network is analyzed, and an alarm association model is established.

Optionally, the fault scene information designed in the scene arrangement platform can be compared according to the conditions of the alarm titles, the alarm codes, the alarm categories and the like of the plurality of pieces of alarm information, so that the fault scene flow into which the alarm should enter is confirmed. After the fault scene identification is completed, according to the alarm association model in the fault scene, determining association parameters between any two pieces of alarm information in the plurality of pieces of alarm information so as to carry out association merging on the alarm information meeting the conditions.

S203, determining a target alarm information set from a plurality of pieces of alarm information based on the association parameters between any two pieces of alarm information.

The association parameter between any two pieces of alarm information in at least two pieces of alarm information included in the target alarm information set is larger than a first preset threshold value, and the frequency of simultaneous existence of any two pieces of alarm information is higher as the association parameter is larger.

It can be appreciated that the target set of alert information may be determined from the plurality of alert information by the electronic device based on the association parameters between any two pieces of alert information.

It should be noted that, the larger the association parameter between two pieces of alarm information, the larger the correlation between the two pieces of alarm information.

S204, determining the target network element with the fault of the core network based on the associated resource information of the fault network element included in each piece of alarm information in the target alarm information set.

It can be understood that the electronic device may determine, based on the associated resource information of the failed network element included in each alarm information in the target alarm information set, the target network element in which the core network fails.

Optionally, the target network element where the core network fails (i.e. the alarm is located by the root cause of the failure) may be determined based on the associated resource information of the failed network element included in each alarm information in the target alarm information set. Fault root location includes cross-level topology fault location and cross-specialty alarm location.

In one design, as shown in fig. 5, in the alarm monitoring method provided in the embodiment of the present application, after the step S203 and before the step S204, the method further includes S301-S302:

s301, determining whether data are interacted between a fault network element corresponding to first alarm information in a target alarm information set and a fault network element corresponding to any other alarm information based on a preset topological relation.

Wherein any other alarm information is the alarm information except the first alarm information in the target alarm information set.

The preset topology may be, for example, a cross-level topology of the 5G core network. As shown in fig. 6. The cross-level topology of the 5G core network includes 4 levels (i.e., VNF, virtual Machine (VM), network function virtualization infrastructure (NFV Infrastructure, NFVI), box device/frame device (TOR/EOR)), specifically, VNF includes network element 1, VM includes network element 2, network element 3, network element 4, NFVI includes network element 5, network element 6, TOR/EOR includes network element 7, and a dashed line connecting the two network elements in the figure is used to indicate that there is data interaction between the two network elements.

It should be noted that the cross-level topological relation of the 5G core network is used to indicate the data interaction relation between the network elements included in the 5G core network.

S302, deleting the first alarm information from the target alarm information set under the condition that the fault network element corresponding to the first alarm information does not interact data with the fault network element corresponding to any other alarm information.

Optionally, after determining the target alarm information set, the alarm network element in which the target alarm information set has no association relationship (i.e. data interaction relationship) with other network elements can be found further according to the preset topological relationship, and is deleted from the target alarm information set.

In a possible manner, the alarm information after model aggregation can be subjected to secondary analysis based on the cross-level topological relation of the 5G core network so as to remove the alarm information which obviously does not accord with service logic, and the accuracy of alarm aggregation is improved.

In one design, as shown in fig. 7, in the alarm monitoring method provided in the embodiment of the present application, the associated resource information includes a bearer network element, where the bearer network element is a network element for implementing a function of a faulty network element, and the method in step S204 specifically includes S401:

s401, under the condition that a target bearing network element corresponding to any one of the alarm information in the target alarm information set fails in a target time period, determining the target network element with the failure of the core network as the target bearing network element.

Optionally, when determining the cause of the failure of the core network through cross-level topology fault positioning, the cross-level topology relationship of the core network may be used to analyze the bearing relationship between different network elements, specifically, the alarm information in the integrated target alarm information set may be traversed, the bearing network element corresponding to each alarm information may be obtained, and according to the bearing network element, the bearing network element information (including virtual machine information, host information, and physical machine information) of the bearing network element in the resource data may be queried in an associated manner.

Further, after obtaining the information of the load-bearing network element, the alarm of the core network is related and inquired before and after (i.e. the target time period) whether the load-bearing network element has a specified fault (for example, the virtual machine node is offline), so as to locate the network element fault of the core network fault. If the target bearing network element corresponding to a certain piece of alarm information has specified faults in the target time period, the target network element with the faults of the core network is the target bearing network element.

Illustratively, the bearer network element may be a virtual machine or a physical machine.

In a possible manner, through the cross-level topological relation of the core network, the bearing relation among different network elements can be analyzed, so that the fault root cause of the core network can be positioned according to the faults of the bearing network elements, and the accuracy of identifying the fault cause is improved.

In one design, as shown in fig. 8, the method for monitoring an alarm provided in the embodiment of the present application further includes S501:

s501, under the condition that the alarm information of the abnormal power supply of the machine room exists in the plurality of pieces of alarm information, determining that the reason of the failure of the core network is the abnormal power supply of the machine room.

Optionally, when determining the cause of the failure of the core network through cross-professional alarm positioning, the bearing relation between the core network host and the rotating ring machine room (i.e. the machine room where the core network host is located) can be checked, and whether the machine room where the core network host is located has over-power outage and under-voltage alarms (i.e. alarms of abnormal power supply of the machine room) within the alarm time period (i.e. the target time period) can be analyzed, so as to position whether the failure of the core network is caused by the abnormal power supply of the machine room.

If the alarm information of the abnormal power supply of the machine room exists in the plurality of alarm information, determining that the reason of the failure of the core network is the abnormal power supply of the machine room.

In a possible implementation manner, whether the core network faults are caused by abnormal power supply of the machine room or not is determined by inquiring whether the machine room where the core network host is located in the time period of the alarm occurrence is in the over-power failure under-voltage alarm or not, so that the accuracy of fault cause identification is improved.

In one design, as shown in fig. 9, after step S202, the method for monitoring an alarm further includes S601-S603:

s601, determining target services carried by a plurality of fault network elements corresponding to a target alarm information set.

Wherein the plurality of faulty network elements includes a faulty network element that each of the alarm information in the target set of alarm information includes.

Optionally, the service scope affected by the fault may be confirmed by querying the subnet slicing relationship of the core network, specifically, first, according to the unique code (Identity document, ID) of the VNF network element of the fault, the association relationship between the VNF network element and the subnet slicing information of the core network in the resource data is queried, and the subnet slicing ID of the core network to which the VNF network element belongs is obtained. And then inquiring the target service carried by the fault network element according to the inquired core network subnet slice ID, and determining the service influence range analysis of the fault.

S602, inputting the target service into the target model, and determining target service index parameters of the target service in a target time period.

Wherein the target model (i.e., the golden index model) is used to simulate the execution of the target business.

Optionally, performance data of the service may be obtained from the performance data pool, and based on a K-means clustering algorithm (K-means clustering algorithm, K-means), the service index parameters of the service in a preset time period are analyzed to obtain a golden index model.

Specifically, an original K cluster may be set, that is, a part of index data during normal operation of the service is selected from the performance data pool and used as the original K cluster. Further, iterative analysis is performed, that is, grouping iterative analysis is performed on the performance data to be trained according to the original K cluster samples, and the nearest value of the original K cluster in each sample set is analyzed. And updating the cluster mean vector according to the analysis result of each sample, and repeating the steps until the mean vector is not changed.

Further, outputting abnormal fluctuation points, namely finding out data which is not in the mean value vector range as abnormal fluctuation points according to the analysis result of each sample, recording index values and index time corresponding to the fluctuation points, and generating an abnormal fluctuation event. And further analyzing the relationship between the abnormal fluctuation and the alarm, namely analyzing the relationship between the abnormal fluctuation event and the alarm based on the Fpgrouth algorithm. After analysis is completed, the golden index model can be output to illustrate the service index directly affected by the alarm.

Optionally, after confirming the service influence range of the fault, the possibly influenced service may be input into the golden index model, and according to the alarm feature of the fault, the service index parameters of the golden index during the fault occurrence period (i.e. within the target time period) are queried in the performance data pool based on the golden index model, so as to confirm whether the fault actually influences the service.

S603, determining that the target service is abnormal when the target service index parameter is smaller than a second preset threshold or larger than a third preset threshold.

Wherein the second preset threshold is less than the third preset threshold.

In a possible implementation manner, the index value of the service is detected through a K-means algorithm, so that the abnormal detection of the gold index and the relation between the alarm and the index are analyzed, whether the service is affected by the fault is determined, and the accuracy of monitoring the core network is improved.

In one design, as shown in fig. 10, after step S603, the method for monitoring an alarm further includes S701-S702:

s701, under the condition that the target service is determined to be abnormal and the alarm information of the core network is not received in a preset time period, determining target service index parameters of the target service in the preset time period based on the target model.

Wherein the plurality of faulty network elements includes a faulty network element that each of the alarm information in the target set of alarm information includes.

Optionally, after the alarm of the core network is recovered, the golden index model may be used to query the index value (i.e. the target service index parameter) of the target service in the next period (i.e. the preset time period) to confirm whether the index value is recovered to the normal state, so as to determine whether the target service is recovered to the normal state.

S702, determining that the target service is recovered to be normal under the condition that the target service index parameter is larger than or equal to a second preset threshold value and smaller than or equal to a third preset threshold value.

As shown in fig. 11, before the alarm information of the core network is acquired, data mining training may be performed on the AI algorithm training platform, specifically, specified data may be pulled from the alarm data pool and the performance data pool at regular time according to an algorithm and a training task set on the AI algorithm training platform by an operator, and data mining training (including alarm relation mining and performance index relation mining). Further, according to the data mining training result, an alarm association model and a golden index model are output so as to support the fault location design of the core network.

The capability design layout can be performed on the scene layout platform, and specifically, the alarm association model and the gold index model output by the AI algorithm training platform can be registered in the capability design center of the scene layout platform to form a capability component with a standard being called.

The fault scene design can be performed on the scene arrangement platform, and specifically, the AI algorithm capability and other capabilities can be assembled according to specific fault scenes of different core networks to form a fault scene rule. And setting fault scenes (including alarm identification conditions and algorithm capabilities required to be called) on the scene arranging platform so as to support fault scene analysis. And the fault scene can be released, and the designed fault scene is loaded into a rule engine to support fault association aggregation and fault root cause positioning of the core network.

When the core network alarms, alarm monitoring can be carried out, alarm standardization and information resource association are carried out on monitored alarm data to obtain alarm information, then fault scene recognition is carried out, the alarm information is aggregated according to an AI model of the fault scene, and the aggregated alarm information is subjected to bearing relation analysis to obtain integrated alarm information. Further, fault root positioning is carried out on the merged alarm information through cross-level topological positioning and cross-professional alarm positioning respectively. Further, the service influence range is determined by carrying out service influence analysis on the merged alarm information, the gold index analysis is carried out on the service in the influence range by utilizing the performance data in the performance data pool, and the alarm analysis result is output. After the alarm is cleared, the performance data in the performance data pool can be utilized to carry out service recovery verification, and an alarm analysis result is output.

The embodiment of the application provides an alarm monitoring method, which aims to overcome the defects of a core network fault monitoring means in the prior art, and the application learns, excavates and analyzes historical fault data of a historical 5G core network through a bottom AI training platform of a big data technology, and realizes the design of analysis processes aiming at faults of different 5G core networks through a scene arrangement platform, so as to support alarm identification monitoring, fault association aggregation, service influence judgment, fault root cause positioning and service recovery verification under different core network fault scenes, and is assisted with a multidimensional analysis and treatment means.

Specifically, based on the Fpgroute algorithm, on the basis of data correlation analysis, the actual network resource bearing relation is introduced, and the accuracy and usability of alarm association merging are improved. And (3) realizing anomaly detection of gold indexes based on a K-means algorithm, and analyzing the relation between alarms and indexes. And carrying out fault location of the core network based on the bearing relation among different levels of network elements of the core network. On the basis of fault location, the service range influenced by faults is analyzed by combining service configuration data, so that maintenance of key services is better supported. Therefore, the automatic analysis, automatic merging, automatic positioning and automatic verification of faults of the 5G core network are realized, and the operation and maintenance processing efficiency is improved.

The foregoing description of the solution provided in the embodiments of the present application has been mainly presented in terms of a method. To achieve the above functions, it includes corresponding hardware structures and/or software modules that perform the respective functions. Those of skill in the art will readily appreciate that the elements and algorithm steps of the examples described in connection with the embodiments disclosed herein may be implemented as hardware or combinations of hardware and computer software. Whether a function is implemented as hardware or computer software driven hardware depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.

According to the embodiment of the application, the function modules of the alarm monitoring method can be divided according to the method example, for example, each function module can be divided corresponding to each function, and two or more functions can be integrated in one processing module. The integrated modules may be implemented in hardware or in software functional modules. Optionally, the division of the modules in the embodiments of the present application is schematic, which is merely a logic function division, and other division manners may be actually implemented.

Fig. 12 is a schematic structural diagram of an alarm monitoring device according to an embodiment of the present application. As shown in fig. 12, an alarm monitoring apparatus 40 is used for monitoring the efficiency of core network alarms, for example, for performing an alarm monitoring method shown in fig. 3. The alarm monitoring apparatus 40 includes: an acquisition unit 401 and a determination unit 402.

An obtaining unit 401, configured to obtain a plurality of pieces of alarm information of a core network, where the alarm information includes: the fault network element and the associated resource information of the fault network element.

A determining unit 402, configured to determine a correlation parameter between any two pieces of alarm information in the plurality of pieces of alarm information, where the correlation parameter is used to determine a degree of correlation between the two pieces of alarm information.

The determining unit 402 is further configured to determine, from the plurality of pieces of alarm information, a target alarm information set based on an association parameter between any two pieces of alarm information, where the association parameter between any two pieces of alarm information in at least two pieces of alarm information included in the target alarm information set is greater than a first preset threshold.

The determining unit 402 is further configured to determine, based on the associated resource information of the failed network element included in each alarm information in the target alarm information set, a target network element in which the core network fails.

In a possible implementation manner, the alarm monitoring device further includes a processing unit 403; the determining unit 402 is further configured to determine, based on a preset topology relationship, whether to interact data between a faulty network element corresponding to the first alarm information in the target alarm information set and a faulty network element corresponding to any other alarm information, where any other alarm information is alarm information in the target alarm information set other than the first alarm information; and the processing unit 403 is configured to delete the first alarm information from the target alarm information set under the condition that no data is interacted between the faulty network element corresponding to the first alarm information and the faulty network element corresponding to any other alarm information.

In one possible implementation manner, the associated resource information includes a carrier network element, where the carrier network element is a network element for implementing a function of the faulty network element; the determining unit 402 is further configured to determine that, when a target bearer network element corresponding to any one of the set of target alarm information fails within the target time period, the target network element with the failed core network is the target bearer network element.

In a possible implementation manner, the determining unit 402 is further configured to determine, in a case where it is determined that there is an alarm information of a power supply abnormality of the machine room in the plurality of alarm information, that a cause of the failure of the core network is the power supply abnormality of the machine room.

In a possible implementation manner, the determining unit 402 is further configured to determine a target service carried by a plurality of faulty network elements corresponding to the target alarm information set, where the plurality of faulty network elements includes a faulty network element included in each alarm information in the target alarm information set; the determining unit 402 is further configured to input a target service to a target model, determine a target service index parameter of the target service in a target time period, and the target model is used for simulating and executing the target service; the determining unit 402 is further configured to determine that the target service is abnormal if the target service index parameter is smaller than a second preset threshold or larger than a third preset threshold, where the second preset threshold is smaller than the third preset threshold.

In a possible implementation manner, the determining unit 402 is further configured to determine, based on the target model, a target service index parameter of the target service in a preset time period when it is determined that the target service is abnormal and no alarm information of the core network is received in the preset time period; the determining unit 402 is further configured to determine that the target service is restored to be normal if the target service indicator parameter is greater than or equal to the second preset threshold and less than or equal to the third preset threshold.

In the case of implementing the functions of the integrated modules in the form of hardware, the embodiments of the present application provide a possible structural schematic diagram of the electronic device involved in the above embodiments. As shown in fig. 13, an electronic device 60 is provided for improving the efficiency of monitoring alarms in a core network, for example, for performing an alarm monitoring method as shown in fig. 3. The electronic device 60 comprises a processor 601, a memory 602 and a bus 603. The processor 601 and the memory 602 may be connected by a bus 603.

The processor 601 is a control center of the communication device, and may be one processor or a collective term of a plurality of processing elements. For example, the processor 601 may be a general-purpose central processing unit (central processing unit, CPU), or may be another general-purpose processor. Wherein the general purpose processor may be a microprocessor or any conventional processor or the like.

As one example, processor 601 may include one or more CPUs, such as CPU 0 and CPU 1 shown in fig. 13.

The memory 602 may be, but is not limited to, a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (random access memory, RAM) or other type of dynamic storage device that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), magnetic disk storage or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer.

As a possible implementation, the memory 602 may exist separately from the processor 601, and the memory 602 may be connected to the processor 601 through the bus 603 for storing instructions or program codes. When the processor 601 invokes and executes instructions or program codes stored in the memory 602, an alarm monitoring method provided in the embodiments of the present application can be implemented.

In another possible implementation, the memory 602 may also be integrated with the processor 601.

Bus 603 may be an industry standard architecture (industry standard architecture, ISA) bus, a peripheral component interconnect (peripheral component interconnect, PCI) bus, or an extended industry standard architecture (extended industry standard architecture, EISA) bus, among others. The bus may be classified as an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is shown in fig. 13, but not only one bus or one type of bus.

It should be noted that the structure shown in fig. 13 does not constitute a limitation of the electronic device 60. The electronic device 60 may include more or fewer components than shown in fig. 13, or may combine certain components or a different arrangement of components.

As an example, in connection with fig. 12, the acquisition unit 401, the determination unit 402, and the processing unit 403 in the alarm monitoring apparatus 40 realize the same functions as those of the processor 601 in fig. 13.

Optionally, as shown in fig. 13, the electronic device 60 provided in the embodiment of the present application may further include a communication interface 604.

Communication interface 604 for connecting with other devices via a communication network. The communication network may be an ethernet, a radio access network, a wireless local area network (wireless local area networks, WLAN), etc. The communication interface 604 may include a receiving unit for receiving data and a transmitting unit for transmitting data.

In one design, the electronic device provided in the embodiments of the present application may further include a communication interface integrated into the processor.

From the above description of embodiments, it will be apparent to those skilled in the art that the foregoing functional unit divisions are merely illustrative for convenience and brevity of description. In practical applications, the above-mentioned function allocation may be performed by different functional units, i.e. the internal structure of the device is divided into different functional units, as needed, to perform all or part of the functions described above. The specific working processes of the above-described systems, devices and units may refer to the corresponding processes in the foregoing method embodiments, which are not described herein.

The embodiment of the application further provides a computer readable storage medium, in which instructions are stored, and when the computer executes the instructions, the computer executes each step in the method flow shown in the method embodiment.

Embodiments of the present application provide a computer program product comprising instructions which, when run on a computer, cause the computer to perform an alarm monitoring method as in the method embodiments described above.

The computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples (a non-exhaustive list) of the computer-readable storage medium would include the following: electrical connections having one or more wires, portable computer diskette, hard disk. Random access memory (random access memory, RAM), read-only memory (ROM), erasable programmable read-only memory (erasable programmable read only memory, EPROM), registers, hard disk, optical fiber, portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any other form of computer-readable storage medium suitable for use by a person or combination of the foregoing, or as a value in the art.

An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the processor. The processor and the storage medium may reside in an application specific integrated circuit (application specific integrated circuit, ASIC).

In the context of the present application, a computer-readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.

Since the electronic device, the computer readable storage medium, and the computer program product in the embodiments of the present application may be applied to the above-mentioned method, the technical effects that can be obtained by the electronic device, the computer readable storage medium, and the computer program product may also refer to the above-mentioned method embodiments, and the embodiments of the present application are not repeated herein.

The foregoing is merely a specific embodiment of the present application, but the protection scope of the present application is not limited thereto, and any changes or substitutions within the technical scope of the present disclosure should be covered in the protection scope of the present application.

Claims (14)

1. An alarm monitoring method, the method comprising:

Acquiring a plurality of pieces of alarm information of a core network, wherein the alarm information comprises: the associated resource information of the fault network element;

determining association parameters between any two pieces of alarm information in the plurality of pieces of alarm information, wherein the association parameters are used for determining association degree between the two pieces of alarm information;

determining a target alarm information set from the plurality of alarm information based on the association parameters between any two pieces of alarm information, wherein the association parameters between any two pieces of alarm information in the target alarm information set are larger than a first preset threshold;

and determining the target network element with the fault of the core network based on the associated resource information of the fault network element included in each piece of alarm information in the target alarm information set.

2. The method according to claim 1, wherein the method further comprises:

determining whether data are interacted between a fault network element corresponding to first alarm information in the target alarm information set and a fault network element corresponding to any other alarm information based on a preset topological relation, wherein any other alarm information is alarm information except the first alarm information in the target alarm information set;

And under the condition that data are not interacted between the fault network element corresponding to the first alarm information and the fault network element corresponding to any other alarm information, deleting the first alarm information from the target alarm information set.

3. A method according to claim 1 or 2, characterized in that the associated resource information comprises a bearer network element, which is a network element for implementing the functionality of the faulty network element;

the determining the target network element with the core network fault based on the associated resource information of the fault network element included in each piece of alarm information in the target alarm information set includes:

and under the condition that a target bearing network element corresponding to any one of the alarm information in the target alarm information set fails in a target time period, determining the target network element with the failure of the core network as the target bearing network element.

4. The method according to claim 1 or 2, characterized in that the method further comprises:

and under the condition that the alarm information of the abnormal power supply of the machine room exists in the plurality of pieces of alarm information, determining that the reason of the failure of the core network is the abnormal power supply of the machine room.

5. The method according to claim 1 or 2, characterized in that the method further comprises:

Determining target services carried by a plurality of fault network elements corresponding to the target alarm information set, wherein the plurality of fault network elements comprise fault network elements included in each piece of alarm information in the target alarm information set;

inputting the target service into a target model, and determining target service index parameters of the target service in the target time period, wherein the target model is used for simulating and executing the target service;

and determining that the target service is abnormal under the condition that the target service index parameter is smaller than a second preset threshold or larger than a third preset threshold, wherein the second preset threshold is smaller than the third preset threshold.

6. The method of claim 5, wherein the method further comprises:

under the condition that the target service is determined to be abnormal and the alarm information of the core network is not received in a preset time period, determining target service index parameters of the target service in the preset time period based on the target model;

and under the condition that the target service index parameter is larger than or equal to the second preset threshold value and smaller than or equal to the third preset threshold value, determining that the target service is recovered to be normal.

7. An alarm monitoring device, characterized in that the alarm monitoring device comprises: an acquisition unit and a determination unit;

the obtaining unit is configured to obtain a plurality of pieces of alarm information of a core network, where the alarm information includes: the associated resource information of the fault network element;

the determining unit is used for determining association parameters between any two pieces of alarm information in the plurality of pieces of alarm information, and the association parameters are used for determining association degree between the two pieces of alarm information;

the determining unit is further configured to determine a target alarm information set from the plurality of alarm information based on the association parameter between the arbitrary two pieces of alarm information, where the association parameter between any two pieces of alarm information in the at least two pieces of alarm information included in the target alarm information set is greater than a first preset threshold;

the determining unit is further configured to determine, based on associated resource information of a failed network element included in each piece of alarm information in the target alarm information set, a target network element in which the core network fails.

8. The alert monitoring device of claim 7, further comprising a processing unit;

The determining unit is further configured to determine, based on a preset topological relation, whether data is interacted between a faulty network element corresponding to a first alarm information in the target alarm information set and a faulty network element corresponding to any other alarm information, where any other alarm information is alarm information in the target alarm information set except for the first alarm information;

the processing unit is configured to delete the first alarm information from the target alarm information set under the condition that no data is interacted between the faulty network element corresponding to the first alarm information and the faulty network element corresponding to any other alarm information.

9. The alarm monitoring device according to claim 7 or 8, wherein the associated resource information comprises a bearer network element, the bearer network element being a network element for implementing the function of the faulty network element;

the determining unit is further configured to determine that, when a target bearer network element corresponding to any one of the set of target alarm information fails within a target time period, the target network element with the failed core network is the target bearer network element.

10. The apparatus according to claim 7 or 8, wherein the determining unit is further configured to determine, in a case where it is determined that there is an alarm information of a power abnormality of the machine room in the plurality of alarm information, that a cause of the failure of the core network is the power abnormality of the machine room.

11. The alarm monitoring device according to claim 7 or 8, wherein the determining unit is further configured to determine target services carried by a plurality of faulty network elements corresponding to the target alarm information set, where the plurality of faulty network elements includes a faulty network element included in each alarm information in the target alarm information set;

the determining unit is further configured to input the target service to a target model, determine a target service index parameter of the target service in the target time period, where the target model is used for performing simulation on the target service;

the determining unit is further configured to determine that the target service is abnormal when the target service index parameter is smaller than a second preset threshold or larger than a third preset threshold, where the second preset threshold is smaller than the third preset threshold.

12. The alert monitoring apparatus according to claim 11, wherein the determining unit is further configured to determine, based on the target model, a target traffic index parameter of the target traffic within a preset time period if it is determined that the target traffic is abnormal and the alert information of the core network is not received within the preset time period;

The determining unit is further configured to determine that the target service returns to normal when the target service indicator parameter is greater than or equal to the second preset threshold and less than or equal to the third preset threshold.

13. An electronic device, comprising: a processor and a memory;

wherein the memory is configured to store one or more programs, the one or more programs comprising computer-executable instructions that, when executed by the electronic device, cause the electronic device to perform an alert monitoring method as claimed in any one of claims 1 to 6.

14. A computer readable storage medium storing one or more programs, wherein the one or more programs comprise instructions, which when executed by a computer, cause the computer to perform an alarm monitoring method as claimed in any of claims 1-6.