KR20210111021A - Device, method and computer program for analyzing fault in network equipment - Google Patents

Abstract

A device which analyzes failures occurring in network equipment includes: a collecting unit which collects at least one alarm information generated by a plurality of network devices and network device information in which the alarm information is generated from the network device management system; a group generator which generates at least one alarm group based on the collected at least one alarm information and network device information; a failure pattern generation unit which maps the generated at least one alarm group with a predefined alarm pattern map to generate a failure pattern for each alarm group; a learning unit for learning a failure analysis learning model based on the generated failure pattern for each alarm group; and a derivation unit for deriving a failure cause and failure location related to the unidentified alarm based on the learned failure analysis learning model.

Description

Apparatus, method and computer program for analyzing failures occurring in network equipment {DEVICE, METHOD AND COMPUTER PROGRAM FOR ANALYZING FAULT IN NETWORK EQUIPMENT}

The present invention relates to an apparatus, method and computer program for analyzing a failure occurring in network equipment.

A mobile wireless communication network is a network for the purpose of performing communication between mobile terminals and between the mobile terminal and the outside of the mobile terminal, and requires functions targeting mobile terminals, such as location tracking of mobile terminals, base station setting, and route setting.

The mobile wireless communication network consists of an access network and a core network. The eNode constituting the access network is in charge of radio-related functions such as broadcasting, paging, scheduling, and handover. Management, IP allocation, and interworking with other networks are managed.

With respect to an access network of a mobile wireless communication network, Korean Patent Application Laid-Open No. 2012-0030740 discloses a mobile communication system and an access network control method in the mobile communication system.

Conventionally, when an abnormality occurs in a base station constituting an access network, the base station transmits a related alarm to the network equipment management system, and the network equipment management system transmits the alarm to the network management system. Through this process, the equipment operator was able to analyze the alarm received from the network management system, check the state of the network equipment, identify the cause of the abnormality, and perform recovery.

However, alarm analysis of network equipment using the network management system and identification of the cause of failure are performed according to the equipment manufacturer's operation manual or standard operation procedure arranged by the equipment operator. There is a disadvantage in that a lot of time and manpower are required to do so.

At least one alarm information generated from a plurality of network devices and network device information in which the alarm information is generated are collected from the network device management system, and at least one alarm group is generated based on the collected at least one alarm information and the network device information. An object of the present invention is to provide an apparatus, a method and a computer program for generating and analyzing a failure.

An apparatus, method, and method for mapping at least one alarm group with a predefined alarm pattern map to generate a failure pattern for each alarm group, and learning a failure analysis learning model based on the generated failure pattern for each alarm group to analyze the failure; and We want to provide computer programs.

An object of the present invention is to provide an apparatus, method, and computer program for deriving a failure cause and failure location related to an unidentified alarm based on a learned failure analysis learning model when an unidentified alarm occurs.

However, the technical problems to be achieved by the present embodiment are not limited to the technical problems described above, and other technical problems may exist.

As a means for achieving the above technical problem, an embodiment of the present invention is a collection method for collecting at least one alarm information generated in a plurality of network devices and network device information in which the alarm information is generated from a network device management system unit, a group generating unit that generates at least one alarm group based on the collected at least one alarm information and network equipment information, and maps the generated at least one alarm group with a predefined alarm pattern map for each alarm group A failure pattern generation unit for generating a failure pattern, a learning unit for learning a failure analysis learning model based on the generated failure pattern for each alarm group, and when an unidentified alarm occurs, based on the learned failure analysis learning model It is possible to provide a failure analysis device including a derivation unit for deriving a failure cause and a failure location related to the identification alarm.

Another embodiment of the present invention includes the steps of collecting at least one alarm information generated in a plurality of network devices and network device information in which the alarm information is generated from a network device management system, the collected at least one alarm information and the network Creating at least one alarm group based on equipment information, mapping the at least one alarm group with a predefined alarm pattern map to generate a failure pattern for each alarm group, failure for each generated alarm group Failure analysis comprising the steps of: learning a failure analysis learning model based on a pattern and deriving a failure cause and failure location related to the unidentified alarm based on the learned failure analysis learning model when an unidentified alarm occurs method can be provided.

Another embodiment of the present invention, when the computer program is executed by the computing device, collects from the network equipment management system at least one alarm information generated in a plurality of network equipment and the network equipment information in which the alarm information is generated, generating at least one alarm group based on the collected at least one alarm information and network equipment information, and mapping the generated at least one alarm group with a predefined alarm pattern map to generate a failure pattern for each alarm group, , learn a failure analysis learning model based on the generated failure pattern for each alarm group, and when an unidentified alarm occurs, the failure cause and failure location related to the unidentified alarm are derived based on the learned failure analysis learning model It is possible to provide a computer program stored in a medium including a sequence of instructions to do so.

The above-described problem solving means are merely exemplary, and should not be construed as limiting the present invention. In addition to the exemplary embodiments described above, there may be additional embodiments described in the drawings and detailed description.

According to any one of the above-described problem solving means of the present invention, a relationship between alarm information occurring in a plurality of network equipment is created as a single failure pattern using a predefined alarm pattern map, so that the cause of failure of the network equipment and It is possible to provide an apparatus, method, and computer program for locating a fault location.

By generating an alarm generated in a first network device among a plurality of network devices and an alarm generated in a second network device connected to each port of the first network device into one alarm group based on the alarm occurrence time, It is possible to provide an apparatus, a method, and a computer program for reducing the time required for failure analysis.

A device, method, and computer program for registering a label for a failure pattern based on the priority of the alarm information and the priority of the failure location among the alarm information generated from a plurality of network equipment and learning through the failure analysis learning model. can provide

1 is a block diagram of a failure analysis system according to an embodiment of the present invention.
2 is a block diagram of a failure analysis apparatus according to an embodiment of the present invention.
3 is an exemplary diagram for explaining a process of creating an alarm group according to an embodiment of the present invention.
4 is an exemplary diagram illustrating a predefined alarm pattern map according to an embodiment of the present invention.
5A and 5B are exemplary views for explaining a process of displaying a failure pattern for each alarm group according to an embodiment of the present invention.
6 is an exemplary diagram for explaining a process of registering a label for a failure pattern according to an embodiment of the present invention.
7 is a flowchart of a method of analyzing a failure occurring in a network device in the failure analysis apparatus according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those of ordinary skill in the art can easily implement them. However, the present invention may be embodied in many different forms and is not limited to the embodiments described herein. And in order to clearly explain the present invention in the drawings, parts irrelevant to the description are omitted, and similar reference numerals are attached to similar parts throughout the specification.

Throughout the specification, when a part is "connected" with another part, this includes not only the case of being "directly connected" but also the case of being "electrically connected" with another element interposed therebetween. . Also, when a part "includes" a component, it means that other components may be further included, rather than excluding other components, unless otherwise stated, and one or more other features However, it is to be understood that the existence or addition of numbers, steps, operations, components, parts, or combinations thereof is not precluded in advance.

In this specification, a "part" includes a unit realized by hardware, a unit realized by software, and a unit realized using both. In addition, one unit may be implemented using two or more hardware, and two or more units may be implemented by one hardware.

Some of the operations or functions described as being performed by the terminal or device in the present specification may be instead performed by a server connected to the terminal or device. Similarly, some of the operations or functions described as being performed by the server may also be performed in a terminal or device connected to the server.

Hereinafter, an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of a failure analysis system according to an embodiment of the present invention. Referring to FIG. 1 , a failure analysis system 1 may include a base station 100 , a network equipment management system 110 , and a failure analysis apparatus 120 . The base station 100 , the network equipment management system 110 , and the failure analysis apparatus 120 exemplarily illustrate components that can be controlled by the failure analysis system 1 .

Each component of the failure analysis system 1 of FIG. 1 is generally connected through a network. For example, as shown in FIG. 1 , the failure analysis device 120 may be connected to the network equipment management system 110 at the same time or at a time interval.

A network refers to a connection structure in which information can be exchanged between each node, such as terminals and servers, and includes a local area network (LAN), a wide area network (WAN), and the Internet (WWW: World). Wide Web), wired and wireless data communication networks, telephone networks, wired and wireless television networks, and the like. Examples of wireless data communication networks include 3G, 4G, 5G, 3rd Generation Partnership Project (3GPP), Long Term Evolution (LTE), World Interoperability for Microwave Access (WIMAX), Wi-Fi, Bluetooth communication, infrared communication, ultrasound Communication, Visible Light Communication (VLC), LiFi, etc. are included, but are not limited thereto.

The plurality of base stations 100 may configure a Long Term Evolution (LTE) access network.

The plurality of base stations 100 may provide a wireless communication service by connecting a core network and a terminal (not shown) as a wireless communication facility.

The plurality of base stations 100 may include DUs and RUs. Hereinafter, description will be made based on the first base station 101 .

The DU 102 (Digital Unit) is a digital data processing device of the first base station 101, and may be configured as a channel card for encrypting and decrypting wireless digital signals such as 3G, WiBro, and LTE.

The DU 102 is composed of a main processing unit and a channel processing unit, and may include a GPS processing unit, a power supply unit, a rectifier, a timing processing unit, and the like. The DU 102 may be interlocked with the RU 103 using an optical cable, for example, up to three RUs 103 may be connected in series through each port of the channel processing unit of the DU 102 .

The RU (Radio Unit) 103 is a remote radio signal processing device of the first base station 101, and may convert a digital signal received from the DU 102 into an RF signal according to a frequency band. The RU 103 may be configured with an RF amplifier and a conversion device for transmitting/receiving with an antenna.

When a failure occurs in the network equipment such as the DU 102 or the RU 103 , the first base station 101 may transmit alarm information indicating that the failure has occurred to the network equipment management system 110 .

The network equipment management system 110 (EMS; Element Management System) is a system for monitoring and controlling network equipment through a network.

When receiving the alarm information generated by the network device from the first base station 101 , the network device management system 110 may transmit the alarm information and the network device information on which the alarm information is generated to the failure analysis device 120 .

The failure analysis device 120 may collect at least one alarm information generated in a plurality of network devices and network device information in which the alarm information is generated from the network device management system 110 . Here, the network device information may include a network device name, a network device type, and network device connection information of a network device in which the alarm information is generated.

The failure analysis apparatus 120 may generate at least one alarm group based on the collected at least one alarm information and network equipment information. In this case, the failure analysis apparatus 120 may generate an alarm group in consideration of the generation time of the collected at least one alarm information. For example, the failure analysis device 120 generates an alarm generated in a first network device among a plurality of network devices and an alarm generated in a second network device connected to each port of the first network device into one alarm group. can do.

The failure analysis apparatus 120 may generate a failure pattern for each alarm group by mapping the generated at least one alarm group with a predefined alarm pattern map. Here, the alarm pattern map is predefined in the form of a map so that it can be displayed according to whether an alarm that can be generated from the first network device and an alarm that can be generated from a second network device that is serially connected to a specific port of the first network device occurs. can be

The failure analysis apparatus 120 may display a failure pattern for each alarm group generated in the alarm pattern map through mapping between at least one alarm group and the alarm pattern map. In addition, the failure analysis device 120 may display alarm information such as an alarm code related to a failure pattern for each alarm group, an alarm generating device number, detailed description of the alarm, and an alarm type.

The failure analysis apparatus 120 may register a label for the failure pattern by selecting a predefined failure cause and failure location based on the failure pattern for each alarm group and at least one piece of alarm information.

The failure analysis apparatus 120 may train the failure analysis learning model based on the generated failure pattern for each alarm group.

When an unidentified alarm occurs, the failure analysis apparatus 120 may derive a failure cause and failure location related to the unidentified alarm based on the learned failure analysis learning model. Here, the unidentified alarm may be an alarm collected in real time from the network equipment management system 110 .

The failure analysis apparatus 120 may be executed by a computer program stored in a medium including a sequence of instructions for analyzing a failure occurring in the network equipment. When the computer program is executed by the computing device, the network equipment management system 110 collects at least one alarm information generated in a plurality of network devices and network device information in which the alarm information is generated, and the collected at least one alarm information and generating at least one alarm group based on the network equipment information, and mapping the generated at least one alarm group with a predefined alarm pattern map to generate a failure pattern for each alarm group, and to the generated failure pattern for each alarm group. It may include a sequence of instructions to train the failure analysis learning model based on the failure analysis learning model, and to derive the failure cause and failure location related to the unidentified alarm based on the learned failure analysis learning model when an unidentified alarm occurs.

2 is a block diagram of a failure analysis apparatus according to an embodiment of the present invention. Referring to FIG. 2 , it includes a collection unit 210 , a group generation unit 220 , a failure pattern generation unit 230 , a display unit 240 , a registration unit 250 , a learning unit 260 , and a derivation unit 270 . can do.

The collection unit 210 may collect at least one alarm information generated in a plurality of network devices and network device information in which the alarm information is generated from the network device management system 110 . For example, the collection unit 210 may generate alarm information and alarm information generated in the DU 102 or RU 103 among the network equipment constituting the first base station 101 from the network equipment management system 110 . It can collect network device information. Here, the network device information may include a network device name, a network device type, and network device connection information of a network device in which the alarm information is generated.

The group generator 220 may generate at least one alarm group based on the collected at least one alarm information and network device information. The process of creating an alarm group will be described in detail with reference to FIG. 3 .

3 is an exemplary diagram for explaining a process of creating an alarm group according to an embodiment of the present invention. Referring to FIG. 3 , the group generating unit 220 includes an alarm generated in a first network device DU 102 among a plurality of network devices and a second network device connected to each port of the first network device DU 102 . An alarm generated in (RU, 103) may be created as one alarm group.

For example, the group generating unit 220 is connected in series with an alarm generated in the first network equipment (DU, 102) of the plurality of network equipment and the first port 310 of the first network equipment (DU, 102). The alarm 300 generated by the second network equipment RU 103 may be generated as the first alarm group 320 .

For another example, the group generating unit 220 may be configured to serially connect an alarm generated in the first network device DU 102 among a plurality of network devices and the second port 330 of the first network device DU 102 . The alarm 300 generated by the connected second network equipment (RU) 103 may be generated as the second alarm group 340 .

The group generator 220 may generate an alarm group in consideration of the alarm occurrence time of the collected at least one piece of alarm information. For example, the group generating unit 220 generates an alarm generated in the first network equipment (DU, 102) and the second network equipment (RU, 103) connected in series with the first network equipment (DU, 102). When the alarm occurrence time of at least one alarm is generated within a predetermined time (eg, 5 minutes), the same alarm group may be generated. Here, the reason for setting the predetermined time to, for example, 5 minutes, is that most of the differences in the alarm occurrence times due to one cause are not large, and if the time is set too long, one alarm due to different causes because they can be grouped into

Through the process of creating such an alarm group, it can be estimated whether an alarm is generated by the same cause.

Returning to FIG. 1 again, the failure pattern generator 230 may generate a failure pattern for each alarm group by mapping the generated at least one alarm group with a predefined alarm pattern map.

The display unit 240 may display a failure pattern for each alarm group generated in the alarm pattern map through mapping between at least one alarm group and the alarm pattern map. A process of generating and displaying a failure pattern for each alarm group based on a predefined alarm pattern map will be described in detail with reference to FIGS. 4 to 5B .

4 is an exemplary diagram illustrating a predefined alarm pattern map according to an embodiment of the present invention. 4, the alarm pattern map 400 is an alarm that can be generated in the first network equipment (DU, 102) and the second network equipment (RU) serially connected to a specific port of the first network equipment (DU, 102) , 103) may be defined in the form of a map of a matrix to be displayed depending on whether an alarm has occurred.

By designing the alarm pattern map 400 to record all the alarm information of a plurality of units constituting the DU 102 and the RUs 103 connected in series with a specific port for each unit, the map form of one matrix A network topology between the DU 102 and the RU 103 may be configured through .

For example, in the case of the channel processing unit 410 of the DU 102, up to three RUs 103 may be serially connected to a specific port, and each RU 103 may generate an alarm when an abnormality occurs. have.

Through this, the alarm pattern map 400 is configured in the form of a map of a specified size, so that all alarm information that can occur in each part of the DU 102 and RU 103 can be displayed.

5A and 5B are exemplary views for explaining a process of displaying a failure pattern for each alarm group according to an embodiment of the present invention.

Referring to FIGS. 3 to 5A , the failure pattern generator 230 maps the first alarm group 320 of FIG. 3 with a predefined alarm pattern map 400, Failure patterns 501 , 502 , and 503 may be generated.

The display unit 240 may display failure patterns 501 , 502 , and 503 for the generated first alarm group 320 .

Referring to FIGS. 3 to 5B , the failure pattern generator 230 maps the second alarm group 340 of FIG. 3 with a predefined alarm pattern map 400 , Failure patterns 510 , 511 , and 512 may be generated.

The display unit 240 may display failure patterns 510 , 511 , and 512 for the generated second alarm group 340 .

Through this process, a separate failure pattern may be generated for each alarm group.

Returning to FIG. 1 again, the display unit 240 may display alarm information such as an alarm code related to a failure pattern for each alarm group, an alarm generating device number, detailed description of the alarm, and an alarm type. This is to help the network equipment operator determine the cause of the failure and the location of the failure related to the occurrence of the alarm by displaying the alarm information.

The registration unit 250 may register a label for the failure pattern by selecting a predefined failure cause and failure location based on the failure pattern for each alarm group and at least one piece of alarm information. At this time, the network equipment operator determines the type of alarm information that occurred in the failure pattern for each alarm group and the location on the topology of the network equipment, based on the priority criteria for the cause of the failure and the location of the failure The cause of the failure and the location of the failure can be selected according to the operator's operating experience. Here, in the case of a failure cause, the priority criterion may have a higher priority in the order of power failure alarm, link failure alarm, node failure alarm, unit failure alarm, and other alarms.

For example, if power failure-related alarm information and link failure-related alarm information in the failure pattern for each alarm group occur at the same time, the cause of the failure is estimated to be due to a power failure based on the priority of the alarm information, and then It can be confirmed and registered through judgment.

In the case of a fault location, the priority is between DU 102 and RU 103 serially connected to a specific port of DU 102, in the order of DU 102, RU 0, RU 1, RU2. By being estimated, it can be confirmed and registered through the judgment of the network equipment operator.

A label for a failure pattern will be described in detail with reference to FIG. 6 .

6 is an exemplary view for explaining a process of registering a label for a failure pattern according to an embodiment of the present invention. Referring to FIG. 6 , the registration unit 250 may receive a selection of a failure cause 601 for a failure pattern 600 for each alarm group from a network equipment operator. For example, the registration unit 250 may include '1. LINK 2. UNIT 3.PROVISIONING 4. POWER 5. NODE 6. INTRINSIC' can be selected as the cause of failure (601).

The registration unit 250 may receive a selection of a failure location 602 for the failure pattern 600 for each alarm group from the network equipment operator.

For example, the registrar 250 may select '1. Any one of DU 2. RRH0 3. RRH1 4. RRH2' may be selected as the fault location 602 .

The registration unit 250 may register the selected failure cause 601 and failure location 602 as a label 603 for the failure pattern.

Through this process, a failure pattern generated based on a long-term alarm history and a label 603 for the failure pattern may be generated as learning data.

Returning to FIG. 2 again, the learning unit 260 may train the failure analysis learning model based on the generated failure pattern for each alarm group. Here, the failure analysis learning model may be configured as a Convolution Neural Network (CNN).

For example, the learning unit 260 inputs the learning data generated based on the failure pattern and the label for the failure pattern to the failure analysis learning model, and the correlation between the alarm information and the failure cause and between the alarm generating equipment and the failure location. By learning the correlation, the failure analysis learning model can be trained.

When an unidentified alarm occurs, the derivation unit 270 may derive a failure cause and a failure location related to the unidentified alarm based on the learned failure analysis learning model. Here, the unidentified alarm may be an alarm received in real time from a plurality of network devices.

The display unit 240 may display a failure cause and failure location related to the derived unidentified alarm.

The alarm unit (not shown) may transmit a failure cause and a failure location related to the derived unidentified alarm to a terminal (not illustrated) of a network equipment operator.

7 is a flowchart of a method of analyzing a failure occurring in a network device in the failure analysis apparatus according to an embodiment of the present invention. The method of analyzing a failure occurring in network equipment in the failure analysis apparatus 120 shown in FIG. 7 includes steps processed in time series by the failure analysis system 1 according to the embodiment shown in FIGS. 1 to 6 . include Therefore, even if omitted below, it is also applied to the method of analyzing the failure occurring in the network equipment in the failure analysis apparatus 120 according to the embodiment shown in FIGS. 1 to 6 .

In step S710 , the failure analysis device 120 may collect at least one alarm information generated in a plurality of network devices and network device information in which the alarm information is generated from the network device management system 110 .

In step S720, the failure analysis apparatus 120 may generate at least one alarm group based on the collected at least one alarm information and network equipment information.

In step S730, the failure analysis apparatus 120 may generate a failure pattern for each alarm group by mapping the generated at least one alarm group with a predefined alarm pattern map.

In step S740, the failure analysis apparatus 120 may learn a failure analysis learning model based on the generated failure pattern for each alarm group.

In step S750, when an unidentified alarm occurs, the failure analysis apparatus 120 may derive a failure cause and failure location related to the unidentified alarm based on the learned failure analysis learning model.

In the above description, steps S710 to S750 may be further divided into additional steps or combined into fewer steps, according to an embodiment of the present invention. In addition, some steps may be omitted if necessary, and the order between the steps may be switched.

The method for analyzing a failure occurring in network equipment in the failure analysis apparatus described through FIGS. 1 to 7 is also in the form of a computer program stored in a medium executed by a computer or a recording medium including instructions executable by the computer. can be implemented. In addition, the method of analyzing a failure occurring in the network equipment in the failure analysis apparatus described with reference to FIGS. 1 to 7 may be implemented in the form of a computer program stored in a medium executed by a computer.

Computer-readable media can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media. Also, computer-readable media may include computer storage media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data.

The above description of the present invention is for illustration, and those of ordinary skill in the art to which the present invention pertains can understand that it can be easily modified into other specific forms without changing the technical spirit or essential features of the present invention. will be. Therefore, it should be understood that the embodiments described above are illustrative in all respects and not restrictive. For example, each component described as a single type may be implemented in a dispersed form, and likewise components described as distributed may be implemented in a combined form.

The scope of the present invention is indicated by the following claims rather than the above detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalent concepts should be interpreted as being included in the scope of the present invention. do.

100: base station
110: network equipment management system
120: failure analysis device
210: collection unit
220: group creation unit
230: failure pattern generation unit
240: display unit
250: register
260: study unit
270: derivation part

Claims (17)

A device for analyzing a failure occurring in a network device, comprising:
a collection unit configured to collect at least one alarm information generated in a plurality of network devices and network device information in which the alarm information is generated from the network device management system;
a group generator configured to generate at least one alarm group based on the collected at least one alarm information and network device information;
a failure pattern generation unit that maps the generated at least one alarm group with a predefined alarm pattern map to generate a failure pattern for each alarm group;
a learning unit for learning a failure analysis learning model based on the generated failure pattern for each alarm group; and
When an unidentified alarm occurs, a derivation unit for deriving a failure cause and a failure location related to the unidentified alarm based on the learned failure analysis learning model
Including, failure analysis device.
The method of claim 1,
The group generating unit generates an alarm generated in a first network device among the plurality of network devices and an alarm generated in a second network device connected to each port of the first network device as one alarm group. Device.
The method of claim 1,
The group generating unit generates the alarm group by further considering an alarm occurrence time of the collected at least one alarm information.
3. The method of claim 2,
The alarm pattern map is in the form of a map so that an alarm that can be generated from the first network device and an alarm that can be generated from the second network device serially connected to a specific port of the first network device can be displayed according to whether or not an alarm occurs. A failure analysis device, which is defined as
5. The method of claim 4,
A display unit for displaying a failure pattern for each generated alarm group on the alarm pattern map through mapping between the at least one alarm group and the alarm pattern map
Which will further include a failure analysis device.
6. The method of claim 5,
The display unit further displays at least one alarm information of an alarm code related to the failure pattern for each alarm group, an alarm generating device number, detailed alarm description, and an alarm type.
7. The method of claim 6,
A registration unit that registers a label for the failure pattern by selecting a predefined failure cause and failure location based on the failure pattern for each alarm group and the at least one alarm information
Which will further include a failure analysis device.
The method of claim 1,
The network equipment information includes at least one of a network equipment name, a network equipment type, and network equipment connection information of a network equipment in which the alarm information is generated.
A method for analyzing a failure occurring in a network device in a failure analysis device, the method comprising:
collecting at least one alarm information generated by a plurality of network devices and network device information in which the alarm information is generated from a network device management system;
generating at least one alarm group based on the collected at least one alarm information and network device information;
generating a failure pattern for each alarm group by mapping the generated at least one alarm group with a predefined alarm pattern map;
learning a failure analysis learning model based on the generated failure pattern for each alarm group; and
When an unidentified alarm occurs, deriving a failure cause and a failure location related to the unidentified alarm based on the learned failure analysis learning model
Including, failure analysis method.
10. The method of claim 9,
The step of creating the at least one alarm group comprises:
Failure analysis comprising the step of generating an alarm generated in a first network device among the plurality of network devices and an alarm generated in a second network device connected to each port of the first network device into one alarm group Way.
10. The method of claim 9,
The step of creating the at least one alarm group comprises:
and generating the alarm group by further considering an alarm occurrence time of the collected at least one alarm information.
11. The method of claim 10,
The alarm pattern map is in the form of a map so that an alarm that can be generated from the first network device and an alarm that can be generated from the second network device serially connected to a specific port of the first network device can be displayed according to whether or not an alarm occurs. A failure analysis method, which is defined as .
13. The method of claim 12,
The method further comprising the step of displaying a failure pattern for each generated alarm group on the alarm pattern map through mapping between the at least one alarm group and the alarm pattern map.
14. The method of claim 13,
The step of displaying the failure pattern for each alarm group comprises:
The method further comprising displaying alarm information of at least one of an alarm code, an alarm generating device number, an alarm detailed description, and an alarm type related to the failure pattern for each alarm group.
15. The method of claim 14,
The failure analysis method further comprising the step of registering a label for the failure pattern by selecting a predefined failure cause and failure location based on the failure pattern for each alarm group and the at least one alarm information.
The method of claim 1,
The network equipment information includes at least one of a network equipment name, a network equipment type, and network equipment connection information of a network equipment in which the alarm information is generated.
A computer program stored in a medium including a sequence of instructions for analyzing a failure occurring in a network device, the computer program comprising:
When the computer program is executed by a computing device,
Collecting at least one alarm information generated in a plurality of network devices and network device information in which the alarm information is generated from the network device management system,
generating at least one alarm group based on the collected at least one alarm information and network equipment information;
By mapping the generated at least one alarm group with a predefined alarm pattern map, a failure pattern for each alarm group is generated,
Learning a failure analysis learning model based on the generated failure pattern for each alarm group,
When an unidentified alarm occurs, a computer program stored in a medium comprising a sequence of instructions for deriving a failure cause and failure location related to the unidentified alarm based on the learned failure analysis learning model.

Images