TWI524724B - Telecommunication network alarm correlation analysis method - Google Patents

Description

Telecom network alarm correlation analysis method

The invention relates to a method for correlating alarm correlation, in particular to using an adaptive resonance network, a concept hierarchy tree, a cluster analysis and a geometric distance between various types of data to select an alarm message suitable for being interpreted by a maintenance personnel. Format and content, a method for instantly determining faulty devices and networks.

A large-scale telecommunication service network usually consists of thousands or tens of thousands of devices. Devices are connected to each other through transmission devices. Therefore, when a device fails, related devices affected by the device will generate alarms. It can be seen that it is unavoidable to generate a large number of alarms to be sent to the centralized transportation center. In addition, the equipment is likely to be composed of multiple suppliers (Multi-Vendor). There is no uniform standard description of the alarm format and content, which makes the maintenance personnel In addition to facing a large number of alarms, it is also necessary to understand the alarm descriptions and formats of each vendor, which makes it impossible to quickly determine the cause of the failure and repair the fault, thereby affecting the service quality.

Alarm correlation analysis is one of the main techniques for managing a large number of alarms. It mainly extracts the features of the noise alarm and data analysis, extracts the features and adds them to the alarm message, and enhances the description of the alarm content to make it clearer and easier. Understand, assist the maintenance personnel to determine the true cause of the failure from a large number of alarms more quickly and correctly. Previous techniques have used known algorithms to calculate known network impairment patterns, which are not effectively detected and processed for unknown obstacle patterns.

On the other hand, the traditional clustering algorithm is not suitable for the application of alarm correlation analysis, because the alarm content is mainly composed of various types of attributes. Therefore, the quality of the data is not ideal for the grouping of data and type attribute data. In the case of encountering a type attribute in the training data, it is necessary to first convert the type attribute into a binary value attribute of {0, 1} through the binary coding method, and such a method cannot reasonably calculate and express the type information. Similarity.

In addition, today's telecommunication networks are increasingly complex, and at the same time moving to heterogeneous networks for mutual maintenance, the correlation between alarm messages is often ignored by the old alarm correlation analysis method, which causes the network maintenance system to quickly and correctly find out the real faulty devices. .

It can be seen that there are still many shortcomings in the above-mentioned methods of use, which is not a good designer, but needs to be improved.

In view of the shortcomings derived from the above-mentioned conventional methods, the inventor of the present invention has improved and innovated, and after years of painstaking research, he finally successfully developed and completed the telecommunications network alarm correlation analysis method.

The object of the present invention is to propose a planning method for cross-system alarm correlation analysis for a telecommunication network system.

A second object of the present invention is to propose a planning method for filtering the relevance of an alarm message according to the characteristics of a hierarchical tree.

The telecommunication network alarm correlation analysis method for achieving the above object is based on the adaptive resonance theory network and combines the concept hierarchy tree characteristics. The main purpose is to maintain the stability of the algorithm, that is, if the characteristics of the new input alarm data are not similar to the characteristics of all existing clusters, a new cluster is established for this new input alarm data. Memories, that is, when a new alarm data is input, if its characteristics are similar to the characteristics of an existing cluster, the input alarm data is grouped in the same cluster as the old data, and the group is modified. The partial memory of the poly, so that it can reasonably express the advantages of the characteristics of the old and new data, and solve the contradiction between the two through the warning value test, the warning value test means that the system will compare after each operation. A pre-set alert value, if greater than the alert value, the system considers the new input to be close enough to the feature value and classifies the input as the same group.

A method for correlating analysis of telecommunication network alarms, the steps of which at least include:

(1) Receive fault alarm data from various alarm devices, including: fault cause and equipment, alarm level, etc.

(2) The alarm data is subjected to pre-processing (data format conversion), and then the fault reason concept hierarchy is used for group algorithm calculation, and the following noise alarms are filtered (1) Alarms that are recovered in a very short time and recovered (2) Routine downtime maintenance operations (3) According to expert experience, it is judged that there is no need to monitor the alarm.

(3) Data clustering is performed by adaptive resonance theory network grouping algorithm.

(4) Finally, the attribute-oriented induction method is used to carry out the knowledge induction analysis of each group, and the important characteristics of each group are extracted.

(5) Transfer the results of the analysis to the Transportation Center for processing.

The telecommunications network alarm correlation analysis method as described above, wherein the different alarm devices further include:

(1) Each network component actively sends an alarm message.

(2) The network maintenance system actively detects the network components and replies to the device status.

(3) Various network component support systems such as power equipment, air conditioning equipment, and environmental monitoring equipment.

(4) Those who do not have an alarm message and cannot work.

The fault reason concept hierarchy is classified as a reference according to the X.733 definition.

Further, the step of performing data grouping by the adaptive resonance theory network grouping algorithm may further include:

(1) First, in the initial stage, the first input vector is obtained from the database, and the input vector is regarded as the first cluster, and the value of the input vector is used as the prototype of the group.

(2) Read the data in sequence, each data will be calculated from the prototype of each neuron in the output layer, and the neuron with the shortest distance will be regarded as the winner. The main purpose is to enable subsequent training. Data, find the clusters closest to them, enabling the output layer neurons to compete with each other to produce winning neurons.

(3) Then determine whether the similarity value of the neuron and the input vector is greater than or equal to the standard we set (alert value). If it is true, it indicates that the input vector is similar to the winner neuron, so this input vector can be used. Placing the group and adjusting the prototype of the winner's neuron. If not, it indicates that the input vector is not similar to the winner's neuron. The input vector will be treated as a unique group and the value of the input vector will be used. For the prototype of the group.

(4) Repeat the above two steps (2) and (3) until the entire network learning reaches a stable state.

The attribute-oriented induction method performs the inductive analysis of each cluster to extract the important characteristics of each group, and may include:

(1) n rules and m groups, sorted according to their support (SUP).

(2) Make feature annotations for each group of data in the alarm message, and strengthen the description of the alarm content to make it clearer and easier to understand.

The adaptive resonance theory network has the ability to self-organize, self-stable, and learn quickly in complex, arbitrary-order input samples. It has the following two advantages: (1) Stability: When a new data is entered, it has been learned. Samples that have passed can be properly retained. (2) Plasticity: When a new data is input, it can be quickly learned to make the system reach a stable state. Although the network has the advantages of self-organization and self-stability, and has good quality for grouping of continuous attribute data, it cannot effectively group data and type attribute data in the data. Therefore, the present invention further The conceptual hierarchy is integrated in the theory of adaptive resonance network to improve the shortcomings of traditional clustering algorithms that can not reasonably calculate the similarity of species types, so that they can group the mixed data of species type and numerical type at the same time.

The conceptual hierarchy is mainly a series of low-order conceptual attributes corresponding to high-order conceptual attributes, which define the relationship between categories, sub-categories and entities between concepts. The higher-order (near the root node) represents the larger the value range of the included attributes. The more general category concept, its structure can be represented by the concept hierarchy tree. The type information can be represented by leaf nodes of the conceptual hierarchy, and the weights on the links represent the distance between the nodes. The distance between the two points of the conceptual hierarchy is the sum of the connected weights on the path. Therefore, the distance between the two types of data is the sum of the weights of the links between the two leaf nodes corresponding to the conceptual hierarchy. Each link weight can be set by an expert based on domain knowledge. Therefore, when a new alarm data is input, the alarm content data is first converted into type data, and the similarity between the data can be calculated by the concept hierarchy tree, and sent to the adaptive resonance theory network processing.

Please refer to FIG. 1 , which is a conceptual hierarchical tree of fault causes in the present invention. For the alarm message of the telecommunication network, the similarity between the data can be calculated by the concept hierarchical tree, and then sent to the adaptive resonance theory network processing. . For the concept hierarchy tree consists of the failure cause concept hierarchy tree root node 11, and the failure cause concept hierarchy tree leaf nodes 14, 15, the number of layers of the tree is not limited, and can be expanded arbitrarily, and more classes can expand the classification more. Finer, get a more accurate numerical classification. The type information can be represented by leaf nodes of the conceptual hierarchy, and the weights on the links represent the distance between the nodes. The distance between the two points of the conceptual hierarchy is the sum of the connected weights on the path. Therefore, the distance between the two types of data is the sum of the weights of the links between the two leaf nodes corresponding to the conceptual hierarchy. Each link weight can be set by an expert based on domain knowledge. As shown in Figure 1, the distance between the alarm data points on the fault reason concept level is 12,13, and the distance between the two points in the conceptual hierarchy tree can be calculated. The closer the distance is, the higher the similarity is. Otherwise, the farther the distance is, the more similar the degree is. low.

Please refer to FIG. 2, which is an adaptive resonance theoretical network used in the present invention. The main purpose of the concept hierarchy tree is to maintain the stability of the algorithm, that is, if the characteristics and all of the new input data already exist. The characteristics of clustering are not similar enough to create a new cluster and memory for this new input, and plasticity, that is, when a new data is input, its characteristics are combined with an existing one. If the characteristics are similar, the input data and the old data are grouped together in the same cluster (feature vector), and the partial memory of the cluster is modified, so that the advantages of the characteristics of the old and new data can be reasonably expressed at the same time, and The warning value test method is used to solve the contradiction between the two. Using this method, the N-dimensional data operation can be performed simultaneously, and the obtained vector distance is similar. The main concepts of the algorithm are as follows.

First, in the initial stage, the first input vector 16 is obtained from the database, input to the input layer 17 of the adaptive resonance theory network, and the input vector is regarded as the first cluster, and the value of the input vector is used. For the prototype of the group. In the next training process, we read the data sequentially from the database, and each data is calculated from the distance of each neuron prototype of the output layer 18 of the adaptive resonance theory network. The shortest distance neuron is considered to be the winner. The main purpose is to enable subsequent training materials to find the closest clusters with them, so that the output layer neurons can compete with each other to produce winning neurons. Then determine whether the similarity value of the neuron and the input vector is greater than or equal to the standard we set (alert value). If it is true, it indicates that the input vector is similar to the winner neuron, so the input vector can be placed into the Group, obtains the output eigenvector data 19 of the adaptive resonance theory network, and adjusts the prototype of the winner neuron. If not, it indicates that the input vector is not sufficiently similar to the winner neuron, and the input vector will be regarded as independent. A group, and the value of this input vector is used as the prototype of the group. Repeat the above two steps until the entire network learning reaches a stable state. By expressing the similarity of species type data by the concept hierarchy tree, the traditional clustering algorithm can not reasonably calculate the shortcomings of the similarity of species types, and integrate it into the adaptive resonance network theory, so that it can simultaneously Mixed with numerical mixed data.

A method for correlating analysis of telecommunication network alarms is to use an adaptive resonance theory network, wherein the steps include:

(1) Receive the data, for the fault alarm that occurs during a certain period of time, the type attribute has the fault reason and equipment, the numerical type alarm level, the fault reason concept hierarchy, the fault reason concept level to define the fault according to X.733 The reason is classified as a baseline. The alarm data is first processed by pre-processing (data format conversion) for group algorithm operation, filtering the following noise alarms (1) alarms that are recovered in a very short time and recovered (2) routine shutdown maintenance operations (3) The expert experience judges the alarms that do not need to be monitored, and then uses the adaptive resonance theory network grouping algorithm to perform data grouping. Finally, the attribute-oriented induction method is used to carry out the knowledge induction analysis of each group, and the important characteristics of each group are extracted.

(2) Establish an adaptive resonance theory network, and set the initial value alarm value to 0.8, and then increment by 0.005 to 0.98 in sequence. The training stop condition is when the output layer variation is less than 0.000015. The steps are as follows: .

A. First, in the initial stage, the first input vector is obtained from the database, and the input vector is regarded as the first cluster, and the value of the input vector is used as the prototype of the group.

B. Read the data in sequence, each data will be calculated from the prototype of each neuron in the output layer, and the shortest neuron will be regarded as the winner. The main purpose is to enable subsequent training materials. Find the clusters closest to them so that the output layer neurons can compete with each other to produce winning neurons.

C. Then judge whether the similarity value of the neuron and the input vector is greater than or equal to the standard we set (alert value). If it is true, it indicates that the input vector is similar to the winner neuron, so the input vector can be set. Enter the group and adjust the prototype of the winner's neuron. If not, it means that the input vector is not similar to the winner's neuron. The input vector will be treated as an independent group, and the value of the input vector will be used as the The prototype of the group.

D. Repeat the above two steps until the entire network learning reaches a stable state.

(3) Using attribute-oriented induction method for feature extraction and knowledge induction analysis, the results show that the n rules are extracted and the m groups are sorted according to their support degree (SUP), and the traffic personnel draw through the feature. A small number of rules can be used to know the fault characteristics without reading a large amount of alarm information, thereby improving the accuracy of the fault cause judgment and accelerating the response time.

(4) With the above (3) clustering results, feature annotations of each group of data are added to the alarm message to enhance the description of the alarm content to make it clearer and easier to understand, and to assist the maintenance personnel to more quickly and correctly In the alarm, the true cause of the fault is determined, and each group of data is presented according to the user's needs.

Please refer to FIG. 3 , which is a hybrid alarm related system architecture proposed by the present invention. The architecture retrieves alarm data from the network component 27 , and then the network maintenance information system 26 performs alarm correlation analysis, wherein two analysis methods are mainly used. A case-based reasoner 23 and an M-ART reasoner 24 are generated, followed by an alarm cause analysis checklist 25. In this architecture, the instant information provided by customer service center 20 and network quality of service (QoS) measurement system 21 is also passed to the case correlation analysis module. Finally, the network maintenance information system submits the results of the analysis to the dispatching system to transmit the message to the maintenance personnel of the maintenance center 22 for maintenance of the equipment obstacle.

The telecommunication network alarm correlation analysis method provided by the invention has the following advantages when compared with other conventional technologies:

(1) The method combines the advantages of the adaptive resonance network and the concept hierarchy, and applies a new unsupervised clustering algorithm to the alarm correlation analysis to group the alarm data to assist the maintenance personnel to be faster and more accurate. The true cause of the failure is determined from a large number of alarms.

(2) The advantages of the hybrid alarm analysis architecture proposed by this method. At the same time, the advantages of case correlation analysis are used to find cases that have occurred in the past, and to quickly determine the actual cause of the network failure. At the same time, the adaptive resonance network correlation analysis is used to explore the unknown alarm pattern. In today's telecom heterogeneous network, the network maintenance system has the ability to learn spontaneously, can quickly respond to network equipment obstacles, and improve network maintenance. quality.

The detailed description of the present invention is intended to be illustrative of the preferred embodiments of the present invention, and is not intended to limit the scope of the invention. The patent scope of this case.

To sum up, this case is not only innovative in terms of technical thinking, but also has many of the above-mentioned functions that are not in the traditional methods of the past. It has fully complied with the statutory invention patent requirements of novelty and progressiveness, and applied for it according to law. Approved this invention patent application, in order to invent invention, to the sense of virtue.

11. . . Fault cause concept tree root node

12,13. . . The distance of the alarm data point on the conceptual level of the fault cause

14,15. . . Fault cause concept hierarchical tree leaf node

16. . . Input vector of adaptive resonance theory network

17. . . Input layer of adaptive resonance theory network

18. . . Output layer of adaptive resonance theory network

19. . . Output eigenvector data of adaptive resonance theory network

20. . . customer service center

twenty one. . . Network Quality of Service (QoS) Measurement System

22‧‧‧Service Center

23‧‧‧ Case-based reasoner

24‧‧‧Adaptive Resonance Network Connection Analysis (M-ART reasoner)

25‧‧‧List of alarm causes

26‧‧‧Network Information System

27‧‧‧Network components

Please refer to the detailed description of the present invention and the accompanying drawings, and the technical contents of the present invention and its effects can be further understood; the related drawings are:

1 is a conceptual hierarchical tree planning diagram of a telecommunication network alarm correlation analysis method according to the present invention;

2 is a schematic diagram of an adaptive resonance theoretical network architecture used in a telecommunication network alarm correlation analysis method according to the present invention;

3 is a structural diagram of a hybrid type alarm cause correlation analysis system in a telecommunication network alarm correlation analysis method according to the present invention;

11. . . Fault cause concept tree root node

12,13. . . The distance of the alarm data point on the conceptual level of the fault cause

14,15. . . Fault cause concept hierarchical tree leaf node

Claims (4)

A telecommunication network alarm correlation analysis method includes the following steps: (1) receiving fault alarm data from various alarm devices, including: fault cause and equipment, alarm level, etc.; (2) the alarm data is pre-processed ( Data format conversion), and then use the fault reason concept hierarchy for group algorithm operation, filter the following noise alarms (1) Alarms that are recovered in a very short time and recover (2) Routine shutdown maintenance operations (3) According to experts The experience judges that there is no need to monitor the alarm; (3) the data is grouped by the adaptive resonance theory network grouping algorithm; (4) Finally, the attribute-oriented induction method is used to carry out the knowledge induction analysis of each group, and the group is extracted. (5) The results of the analysis are transmitted to the maintenance center for processing; wherein the adaptive resonance theory network grouping algorithm performs the step of data grouping, and further includes: (6) first data from the initial stage Curry takes the first input vector and treats the input vector as the first cluster, and uses the value of the input vector as the prototype of the group; (7) read the data sequentially, each The pen data will be calculated from the distance of each neuron prototype in the output layer, and the shortest distance neuron will be regarded as the winner. The main purpose is to enable the subsequent training materials to find the closest clustering with them. Enabling the output layer neurons to compete with each other to produce a winning neuron; (8) Then determine whether the similarity value of the neuron and the input vector is greater than or equal to the standard we set (alert value). If it is true, it indicates that the input vector is similar to the winner neuron, so this input vector can be used. Place the group and adjust the prototype of the winner's neuron. If not, it means that the input vector is not similar to the winner's neuron. The input vector will be treated as a separate group and the value of the input vector will be used. For the prototype of the group; and (9) repeat the above two steps (6), (7) until the entire network learning reaches a stable state. The telecommunications network alarm correlation analysis method described in claim 1, wherein the different alarm devices further comprise: (1) each network component actively sends an alarm message; (2) by a network dimension The system actively detects network components and responds to device status; (3) various network component support systems such as power equipment, air conditioning equipment, environmental monitoring equipment, etc.; and (4) networks that do not work without warning messages. Road equipment. For example, the telecommunications network alarm correlation analysis method described in claim 1 is characterized in that the fault reason concept hierarchy classifies the fault cause as a reference according to the definition of X.733. For example, the telecommunications network alarm correlation analysis method described in claim 1 of the patent scope, wherein the attribute-oriented induction method performs the knowledge induction analysis of each cluster to extract the important characteristics of each group, and further includes: (1) n rules and m groups, respectively sorted according to their support (SUP); and (2) feature extraction of each group of data in the alarm message, strengthen the description of the alarm content to make it more clear and easy to understand.