WO2015051638A1

WO2015051638A1 - Fault location method and device

Info

Publication number: WO2015051638A1
Application number: PCT/CN2014/076867
Authority: WO
Inventors: 杨凡; 何诚; 钱剑锋
Original assignee: 华为技术有限公司
Priority date: 2013-10-08
Filing date: 2014-05-06
Publication date: 2015-04-16
Also published as: CN104518905A

Abstract

Disclosed in an embodiment of the present invention are a fault location method and device, the method comprising: extracting the alarm information of each device in a network, and establishing a correspondence between an alarm name and an alarm fault cause in the alarm information; according to a fault location target, merging and classifying the alarm fault causes to obtain a set of alarm fault causes; acquiring the alarm set of alarm data in a current network, and establishing a correspondence between the alarm set and the set of alarm fault causes, the alarm set comprising a set of alarm names; determining the probability of the fault cause occurrence corresponding to the alarm set in a preset time window, and selecting the probability of the fault cause occurrence satisfying a preset range as the fault cause of the alarm set; and hierarchically merging and classifying the fault causes of the alarm set to realize hierarchical locations of the fault causes. The embodiment of the present invention solves the technical problem in the prior art of inaccurate fault location and low location efficiency.

Description

The invention claims the priority of the Chinese patent application filed on October 8, 2013, the Chinese Patent Office, the application number is 201310467700. 7, the invention name is "a fault location method and device", The entire contents are incorporated herein by reference. Technical field

[01] The present invention relates to the field of network technologies, and in particular, to a fault location method and apparatus. Background technique

[02] The network device (network element) generates different alarm information according to its own running status and environment changes during operation. The alarm information includes: an alarm reference document and an alarm fault cause, and sends the alarm information to the network management system. Therefore, the network management and operation and maintenance personnel can check the possible fault causes according to the alarm reference document in the alarm information, thereby locating the cause of the network failure. However, because the network management system collects a large amount of alarm information, and there are also a large number of prompt alarms and derivative alarms, the efficiency of network management and operation and maintenance personnel to locate faults based on alarm information is reduced. [03] Based on this, in order to improve the efficiency of fault location, in the prior art, one method is to remove the derivative alarm by analyzing the correlation between the alarms (ie, the associated alarm analysis), that is, using a specific logical relationship according to the alarm field information. Perform correlation alarm analysis to remove derivative alarms. Another method is to use a probabilistic diagnosis model to calculate the probability of a fault occurring under an alarm condition, that is, to determine whether the alarm will occur within a preset time window by a priori probability of failure, and set a probability threshold, and then, according to the alarm Whether it occurs within the preset time window to determine the cause of the fault and calculate the probability of the fault occurring under the alarm condition.

[04] However, in the research and practice of the prior art, the inventors of the present invention found that in the existing implementation manner, the associated alarm analysis can remove the derivative alarm, but the positioning of the alarm fault cannot be achieved; When the probability diagnosis model is used, the accuracy and efficiency of fault location are relatively low because the same alarm may correspond to multiple fault causes, or multiple faults may be generated by the same fault. Summary of the invention

[05] A fault location method and apparatus are provided in the embodiment of the present invention to solve the technical problem of inaccurate fault location and low positioning efficiency in the prior art. [06] In order to solve the above technical problem, the embodiment of the present invention discloses the following technical solutions:

[07] The first aspect provides a fault location method, the method comprising:

[08] extracting the alarm information of each device in the network, and establishing a correspondence between the alarm name and the alarm fault cause in the alarm information; [09] combining the alarm fault causes according to the fault location target, and obtaining an alarm [10] The alarm set of the alarm data in the current network is obtained, and the corresponding relationship between the alarm set and the alarm fault cause set is established; wherein the alarm set includes: a set of alarm names;

[11] determining a probability of occurrence of a fault cause corresponding to the alarm set in a predetermined time window;

[12] The probability of occurrence of the fault cause that meets the preset range is selected as the fault cause of the alarm set; [13] hierarchically classifying the fault cause of the alarm set to achieve hierarchical positioning of the fault cause.

[14] In a first possible implementation manner of the first aspect, the collecting, by the fault location target, the classification of the alarm fault causes, and obtaining the alarm fault cause set includes:

[15] According to the principle of equipment fault location, set the fault location target;

[16] According to the fault location target, the alarm fault causes are combined and classified to obtain an alarm fault cause set.

[17] In conjunction with the first aspect or the first possible implementation manner of the first aspect, in a second possible implementation manner, the merging and categorizing the alarm fault causes according to the fault locating target is further obtained The alarm name set; the method further includes:

[18] Calculating the degree of association of the set of alarm names, the degree of association is used to verify the validity of the merged category. [19] In combination with the first aspect or the first or second possible implementation manner of the first aspect, in a third possible implementation, the establishing, by the establishing, the alarm set and the alarm failure cause set Relationships, including:

[20] Establishing a bipartite graph of the alarm set and the alarm failure cause set according to the correspondence between the alarm name and the alarm failure cause. [21] In combination with the first aspect or the first or the second or the third possible implementation manner of the first aspect, in a fourth possible implementation manner, the determining, by the predetermined time window, the alarm set corresponds to The probability of the cause of the failure, including:

[22] calculating a probability of occurrence of each type of alarm in the alarm set in the predetermined time window; [23] calculating a probability of occurrence of the fault cause corresponding to each type of alarm;

[24] determining a probability of occurrence of a fault cause corresponding to the alarm set in the predetermined time window according to the probability of occurrence of each type of alarm and the probability of occurrence of each corresponding fault cause.

[25] In combination with the first aspect or the first or second or the third or the fourth possible implementation manner of the first aspect, in a fifth possible implementation manner, the calculating a predetermined time window alarm The probability of occurrence of each type of alarm in the set, including:

[26] The frequency of occurrence of the alarm within the predetermined time window is used as the probability of occurrence of the alarm within the preset time window.

[27] In conjunction with the first aspect or the first or second or third or fourth or fifth possible implementation of the first aspect, in a sixth possible implementation, the computing The probability of occurrence of the fault cause corresponding to each type of alarm includes: [28] initializing the probability of occurrence of the fault cause of each type of alarm;

[29] calculating and verifying a probability of occurrence of a failure cause of each of the alarms within the predetermined time window;

[30] Update the probability of occurrence of the fault cause corresponding to each type of alarm.

[31] In combination with the first aspect or the first or second or third or fourth or fifth or sixth possible implementation of the first aspect, in a seventh possible implementation, Performing hierarchical hierarchical classification on the fault cause of the alarm set to implement hierarchical positioning of the fault cause, including:

[32] hierarchically classifying the fault causes of the alarm set, and obtaining the reason for the merger of each layer;

[33] Calculate the cause of the fault step by step to complete the hierarchical positioning of the fault location target.

[34] The second aspect provides a fault location device, including: [35] an extracting unit, configured to extract alarm information of each device in the network;

[36] a first establishing unit, configured to establish a correspondence between an alarm name and an alarm failure cause in the alarm information;

[37] a processing unit, configured to combine and classify the alarm fault causes according to the fault location target, and obtain a set of alarm fault causes;

[38] an acquiring unit, configured to acquire an alarm set of alarm data in the live network;

[39] a second establishing unit, configured to establish a correspondence between the alarm set and the alarm failure cause set; wherein the alarm set includes: a set of alarm names;

[40] a determining unit, configured to determine a probability of occurrence of a fault cause corresponding to the alarm set in a predetermined time window;

[41] a selecting unit, configured to select a probability that the fault cause that meets the preset range occurs as a fault cause of the alarm set;

[42] The locating unit is configured to hierarchically classify the fault causes of the alarm set, and implement hierarchical positioning of the fault cause.

[43] In a first possible implementation manner of the second aspect, the processing unit includes:

[44] setting unit, used to set the fault location target according to the principle of equipment fault location;

[45] The classification unit is configured to combine and classify the alarm fault causes according to the fault location target, and obtain an alarm fault cause set.

[46] In combination with the second aspect or the first possible implementation of the second aspect, in a second possible implementation manner,

[47] The classification unit is further configured to: after combining the alarm fault causes according to the fault location target, further obtaining an alarm name set; the device further includes:

[48] a calculating unit, configured to calculate a degree of association of the set of alarm names after the merged classification, where the degree of association is used to verify the validity of the merged category. [49] In combination with the second aspect or the first or second possible implementation manner of the second aspect, in a third possible implementation, the first establishing unit is specifically configured to use the alarm name and A correspondence between the alarm failure causes and a bipartite graph of the alarm failure cause set is established.

[50] In combination with the second aspect or the first or second or the third possible implementation of the second aspect, in a fourth possible implementation, the determining unit includes:

[51] a first probability calculation unit, configured to calculate a probability of occurrence of each type of alarm in the alarm set in the predetermined time window;

[52] a second probability calculation unit, configured to calculate a probability of occurrence of a fault cause corresponding to each type of alarm;

[53] The probability determining unit is configured to determine, according to the probability of occurrence of each type of alarm and the probability of occurrence of each corresponding fault cause, a probability of occurrence of a fault cause corresponding to the alarm set in the predetermined time window. [54] In combination with the first or second or third or fourth possible implementation of the second aspect or the second aspect, in a fifth possible implementation,

[55] The first probability calculation unit is specifically configured to use a frequency of occurrence of an alarm within a predetermined time window as a probability of occurrence of an alarm within a preset time window.

[56] In combination with the first or second or third or fourth or fifth possible implementation of the second aspect or the second aspect, in a sixth possible implementation, the second The probability calculation unit includes:

[57] an initialization unit, configured to initialize a probability of occurrence of the fault cause of each type of alarm;

[58] a verification unit, configured to calculate and verify a probability of occurrence of a failure cause of each type of alarm within the predetermined time window;

[59] an update unit, configured to update a probability of occurrence of a corresponding fault cause of each of the alarms. [60] In combination with the first or second or third or fourth or fifth or sixth possible implementation of the second aspect or the second aspect, in a seventh possible implementation, The positioning unit includes:

[61] A hierarchical classification unit, configured to hierarchically classify fault causes of the alarm set, and obtain a reason for merging each layer;

[62] Hierarchical locating unit, which is used to calculate the cause of the fault step by step to complete the level of the fault locating target Positioning.

[63] The third aspect provides a fault location device, including:

[64] The alarm information extracting unit is configured to extract the alarm information of each device in the network, and establish a correspondence between the alarm name and the alarm fault cause in the alarm information; [65] the alarm information processing unit is configured to follow the fault. The positioning target combines and classifies the alarm fault causes to obtain a set of alarm fault causes;

[66] an alarm data processing unit, configured to acquire an alarm set of alarm data, and establish a correspondence between the alarm set and the alarm failure cause set; wherein the alarm set includes: an alarm name set; determining a predetermined time window The probability of occurrence of the fault cause corresponding to the alarm set; selecting the probability that the fault cause occurs in the preset range as the fault cause of the alarm set;

[67] The fault level locating unit is configured to hierarchically classify the fault causes of the alarm set to achieve hierarchical positioning of the fault cause.

[68] In a first possible implementation manner of the third aspect, the alarm information processing unit is specifically configured to: set a fault location target according to a device fault location principle; and perform the alarm fault according to the fault location target The reason is to perform a combined classification to obtain a set of alarm failure causes.

In combination with the third aspect or the first possible implementation manner of the third aspect, in a second possible implementation manner, the alarm information processing unit is configured to perform the alarm fault according to the fault location target. The reason for performing the merging classification to obtain the alarm name set after the merging is also used to calculate the association degree of the alarm name set after the merging classification, and the association degree is used to verify the validity of the merging classification. In combination with the third aspect or the first or second possible implementation manner of the third aspect, in a third possible implementation manner, the alarm data processing unit establishes the alarm set and the alarm fault The correspondence between the set of causes includes: establishing a bipartite graph of the set of alarms and the set of alarm failure causes according to a correspondence between the alarm name and an alarm failure cause.

[71] In combination with the third aspect or the first or second or third possible implementation manner of the third aspect, in a fourth possible implementation manner, the alarm data processing unit determines the preset time window The probability of occurrence of the fault cause corresponding to the alarm set includes: calculating a probability of occurrence of each alarm in the alarm set in the preset time window; Calculating a probability of occurrence of the fault cause corresponding to each type of alarm; determining a fault cause corresponding to the alarm set in the preset time window according to the probability of occurrence of each type of alarm and the probability of occurrence of each type of fault cause Probability of occurrence; selecting the probability of occurrence of the failure cause that satisfies the preset range as the cause of failure of the alarm set. [72] In combination with the first or second or third or fourth possible implementation manner of the third aspect or the third aspect, in a fifth possible implementation manner, the alarm data processing unit calculates a pre- The probability of occurrence of each type of alarm in the alarm set in the time window is set to include: the frequency of occurrence of the alarm within the predetermined time window as the probability of occurrence of the alarm within the predetermined time window.

[73] In combination with the first or second or third or fourth or fifth possible implementation manner of the third aspect or the third aspect, in the sixth possible implementation manner, the alarm data The processing unit calculates a probability of occurrence of the fault cause corresponding to each type of alarm, including: initializing a probability of occurrence of the fault cause of each type of alarm; calculating and verifying that the fault cause of each type of alarm occurs within the predetermined time window Probability; update the probability of occurrence of the corresponding failure cause for each of the alarms.

[74] In combination with the first or second or third or fourth or fifth or sixth possible implementation of the third aspect or the third aspect, in a seventh possible implementation, The fault tier locating unit is specifically configured to perform hierarchical merging and categorizing the fault causes of the alarm set to obtain a merging reason of each layer; and calculating a fault cause step by step to complete the hierarchical positioning of the fault locating target.

[75] According to the foregoing technical solution, in the embodiment of the present invention, the alarm information is first extracted from the alarm design and description document, and then the fault occurrence targets are combined and classified according to the fault location target, and the current time window is calculated. The probability of the failure of the alarm set (or alarm sequence) in the network occurs, thereby achieving hierarchical positioning of the fault cause and improving the fault location efficiency. Further, by correlating the causes of alarm failures, the correlation of alarms is also improved. As well as the probability of the failure of the alarm being updated in real time, the accuracy of the fault location of the alarm is improved. BRIEF DESCRIPTION OF THE DRAWINGS [76] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments will be briefly described below. Obviously, the drawings in the following description It is merely some embodiments of the present invention, and those skilled in the art can obtain other drawings according to the drawings without any creative work. FIG. 1 is a flowchart of a method for locating a fault according to an embodiment of the present invention; [78] FIG. 2 is a schematic diagram of a bipartite graph of an alarm set and a fault cause set according to an embodiment of the present invention;

[79] FIG. 3 is a diagram showing an example of using a frequency of occurrence of an alarm to replace the probability of occurrence of an alarm provided in the embodiment; FIG.

FIG. 4 is a schematic diagram of a probability of occurrence of an update failure according to an embodiment of the present invention; [81] FIG. 5 is a schematic diagram of fault hierarchy positioning according to an embodiment of the present invention; [82] FIG. 6 is a schematic diagram of an embodiment of the present invention. FIG. 7 is a schematic structural diagram of a fault locating device according to an embodiment of the present invention; [84] FIG. 8 is another schematic structural diagram of a fault locating device according to an embodiment of the present invention; FIG. 9 is a schematic structural diagram of a server according to an embodiment of the present disclosure, and a specific implementation manner

The following embodiments of the present invention provide a fault location method and apparatus. In the embodiment of the present invention, the causes of failures are combined and classified, and the probability of occurrence of the faults after the merger and classification is calculated, thereby effectively improving the efficiency and accuracy of the fault location. The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. example. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

Referring to the drawings, FIG. 1 is a flowchart of a method for locating a fault according to an embodiment of the present invention. In this embodiment, an alarm design or a description file is included in a target network of a fault location, and the alarm includes: And the cause of the alarm. The method includes:

[89] Step 101: Obtain the alarm information of each device in the network, and establish a correspondence between the alarm name and the alarm failure cause in the alarm information.

[90] In this embodiment, the server can design and explain the alarm (or reference) from each device in the network. The alarm information is extracted from the file, and the alarm information includes: an alarm name, an alarm fault cause, and an alarm ID. The identifier is not limited thereto.

[91] In this embodiment, the alarm information of the device usually includes: an explanation of the alarm and a reference document for explaining and explaining the alarm. The alarm information includes: an alarm name and an alarm failure cause (a cause of the alarm); and may include: an ID (number) and an alarm level (indicating the severity of the alarm). In the fault location, the alarm name, the alarm ID, and the fault cause of the alarm are extracted, and the corresponding relationship between the alarm name and the alarm fault cause is established. The correspondence is shown in Table 1. For example, it is not limited to this:

[92] Table 1

[93] Step 102: Combine and classify the alarm fault causes according to the fault locating target, and obtain an alarm fault cause set; wherein, the alarm fault cause set is obtained by combining and categorizing various alarm fault causes in Table 1 to obtain a set. .

[94] In this step, the server first sets the fault location target according to the device fault location principle. That is, since the alarm information is generally reported to the network management platform, the alarm information includes fault information of the entire network. The fault location target is the level that needs to be located. For a network system, the fault location target can be set to one device, or one module of the device, or the software, hardware, and configuration problems of the device module. The design principles of the fault location target can be related to the composition of the network and the module design of the device. [95] Then, the alarm fault causes are combined and classified according to the fault location target, and an alarm fault cause set is obtained. That is to say, after the fault location target is designed, the alarm fault causes can be combined and classified according to the fault location target. For example, it can be divided according to the module of the device. For example, a device may contain 3 modules, and the fault location target is to locate the module, and all the fault causes in the module can be combined and classified.

[96] In this embodiment, the causes of failures are combined and classified by using the Natural Language Process (NLP) method. An example of the combination of the causes of the failure is shown in Table 2:

[97] Table 2

[98] As can be seen from Table 2, in this embodiment, according to the fault location target, the cause of the alarm fault (ie, the initial fault cause) may be merged into a "merger reason (1)", or may be merged into a "merger cause (2). ". Obviously, the "merge reason (2)" is coarser than the "merge reason (1)".

[99] Optionally, in another embodiment, according to the fault location target, the alarm fault causes are combined and classified, and an alarm name set is also obtained; and the alarm name set after the combined classification is calculated (also The degree of association, referred to as an alarm set, is used to verify the validity of the merged classification. The alarm name set is a combination of the various types of alarm names in Table 1. Certainly, after the combination of the alarm failure causes, the corresponding alarm ID set may be obtained, where the alarm ID set is a set obtained by classifying and combining the various types of IDs in Table 1. [100] That is to say, for the alarm set / Α ₂ , ···, Α , if the alarm set association degree before the merge classification is /. The association degree of the alarm set after the combination is /:, then, when /: ≥ /. When merged into a valid merge.

[101] wherein, the association degree of the alarm name set (which may also be referred to as an alarm set) after the combined classification is calculated:

[102] First definition: alarm similarity and association degree of the alarm set [103] wherein the alarm similarity refers to the degree of similarity of the alarm. Set any two alarms Α and Β whose alarm failure cause sets are U (A) and U (B) respectively, then define the similarity between alarms A and B as:

_{S =} U(A n B)

A' ^B U{AVB)

[104] In this formula, U (AUB) is the union of the alarm failure cause sets U (A) and U (B), and υ (Α Π Β) is the alarm failure cause set U (Α) and U (Β) The intersection of the alarms and the 相似. [105] The degree of association of the alarm set refers to the degree of similar alarms in the alarm set. Let the alarm set I= {A1, Α2,···, An} be defined as the correlation degree of the alarm set I:

[106] Of course, in this embodiment, it is not limited to the degree of association of the foregoing calculation alarm set, and may be other similar methods, which is not limited in this embodiment. In this embodiment, the fault location targets are often different. For example, the alarm caused by a fault in a board may be the device that is expected to locate the fault, or the board where the fault occurs, or the hardware or software fault of the board. The alarm failure causes can be combined for different fault location targets. Specifically, the foregoing method may be used to combine the causes of the alarm faults. Of course, other methods may be used to combine the causes of the alarm faults, which is not limited in this embodiment. [108] Step 103: Obtain an alarm set of alarm data in the current network, and establish a correspondence between the alarm set and the alarm failure cause set; wherein the alarm set includes: a set of alarm names;

[109] The alarm data: refers to an alarm obtained from the current network, where the alarm includes an alarm name, a time when the alarm occurs, and an alarm frequency. The alarm set includes: various alarm names, the time when various types of alarms occur, and each Class alarm frequency, etc.

[110] wherein, in the step, the server establishes a correspondence between the alarm set and the alarm failure cause set, and may establish the alarm set and the location according to a correspondence between the alarm name and an alarm failure cause. A bipartite map of a set of alarm failure causes, wherein the bipartite graph is a special model in graph theory, and for an undirected graph of G=(V, E), if the vertex V can be split into two different The set A, B, and the vertices in E=<i, j> belong to A and B respectively, and then G is a bipartite graph.

[111] Set the alarm set of the current network to be I={A1, A2, ~, An}, and the corresponding fault cause set is F={fl, Ϊ2,..., fm}, and establish the alarm set and the fault cause set. Figure 2 shows a bipartite graph of its alarm set and fault cause set. [112] Step 104: determining a probability of occurrence of a fault cause corresponding to the alarm set in a predetermined time window;

[113] In this step, the probability of a cause of failure under a known set of alarms (which may also be referred to as an alarm sequence) is calculated. The probability of occurrence of each failure cause can be calculated using a Bayesian network, a Markov chain, or the like. The calculation method is as follows: setting a time window T, setting the alarm set in the time window to Ι={Α1, Α2, ···, An}, respectively calculating the probability of occurrence of the alarm in the time window and each corresponding to each alarm The probability of the occurrence of the failure, and then calculate the probability of the failure cause under the alarm set. The following takes the Bayesian network-based method as an example to describe the implementation process of calculating the probability of occurrence of the fault cause of the alarm set:

[114] First, calculating the probability of occurrence of each type of alarm in the alarm set in the time window;

[115] Set the alarm set (or alarm sequence) in the time window Ι = {Α1, Α2, ···, An}, the number of each alarm is nl, n2, ..., the total number of alarms is N. Use the frequency of the occurrence of the alarm to approximate the probability of the alarm occurring, g卩:

[116] w

[117] is the probability that the i-th alarm occurs, and N is the total number of alarms. Specifically, as shown in FIG. 3, FIG. 3 is a schematic diagram of the probability that the occurrence of an alarm is used instead of the probability of occurrence of an alarm in the embodiment.

[118] Next, calculating a probability of occurrence of the fault cause corresponding to each type of alarm; specifically: initializing a probability of occurrence of the fault cause of each type of alarm; calculating and verifying each of the types in the preset time window The probability of the cause of the alarm being faulty. [119] That is to say, for any alarm, set the cause of the c faults, and the probability of initializing the fault cause of each alarm ^ is:

1

P alarm, ⁼ ~ ( 0 < Z < 0 < J < C ) Further, the method may further include: updating a probability of occurrence of the fault cause corresponding to each alarm. A schematic diagram of the probability of updating the cause of the failure occurs as shown in FIG.

[120] As shown in FIG. 4, the cause of an alarm is analyzed from the alarm data of the existing network, and it is determined that the alarm is generated due to which fault cause. After the fault is verified, the next step is to calculate the cause of the fault of the alarm. When the alarm ator, . generated by the cause of the fault /αί is determined within a time window, the alarm failure reason is updated as follows:

_ I

P ._ P _other ^ P

[121] wherein, P _al is the probability of occurrence of the failure cause of each type of alarm, /^^^ is the probability of generating the alarm i for the failure cause j, 7^TM·,. ^ is the probability that an alarm i is generated for a cause other than the cause of the failure, and C is a constant.

[122] For example, if there are three kinds of fault causes / /^, / /^/ /^ for a certain alarm a/arm, the probability of initializing each fault cause is; „ _ftl =/ _∞ft2 =/. „ _ft3 When the fault is determined in a time window is fault fault faults^:

Pfauin— + (1— )—:

3 3 r 9

₌ 1 _ 1 _! 1 ₌ 2

P fauiti - 3 3 3 - 9

P faults 3 3 3 9

[123] Finally, the probability of occurrence of the fault cause corresponding to the alarm set in the time window is determined according to the probability of occurrence of each type of alarm and the probability of occurrence of each corresponding fault cause.

[124] That is to say, the example uses the Bayesian network method to calculate the probability of each fault cause of the alarm sequence in the time window as an example, and specifically includes: [125] Let the alarm sequence in the time window be I={A1, Α2,···, An}, a total of n different alarms, the frequency of each alarm is ni, the total number of alarms is N, ie 2,. N. Each alarm has ^..., ^ the cause of the fault, a total of fault

w. Then the probability of occurrence of the fault cause fault is: [126] p{faultj |< alarm alarm ₂ , .,alarm _n >) = ^ fiP _a i _arm}

[127] wherein, the probability of occurrence of the alarm ator in the time window, the calculation process is the same as the probability of occurrence of each alarm in the alarm set in the calculation time window, that is, the frequency of occurrence of the alarm is used to replace the probability of occurrence of the alarm. Fault j E alarm, indicating that fault is one of the causes of αΐαητ^, p _darmu indicates the probability of alarm a/ar, medium/, and the calculation process is detailed in the calculation of the fault cause corresponding to each alarm. The process of probability is the same, as detailed above.

[128] Step 105: Select a probability that the failure cause that meets the preset range occurs as a fault cause of the alarm set;

[129] Among all the causes of failure, the server selects the above-mentioned predetermined range (such as the cause of the failure with the highest probability of selection, or the selection of three failure causes with a relatively high probability, or the selection of the cause of the failure within a certain interval, etc.) The probability of the failure cause is the cause of the failure of the alarm set or alarm sequence. The preset range is dynamically set according to requirements, for example, it may be at least one of the top 10 with the highest probability of failure, etc., but is not limited thereto.

[130] For another example, select the top N with the highest probability of failure (such as the first one, the first five, the first eight or the first 10, etc., the value of N may need to be adaptively selected) as the alarm set in the time window. The set of fault causes (or sequence of fault causes).

[131] Step 106: Perform hierarchical hierarchical classification on the fault cause of the alarm set to implement hierarchical positioning of the fault cause.

[132] In this embodiment, the cause of the failure is combined and classified, and the category with the largest cause of the failure is obtained, and the calculation is performed. The cause of the fault, and then calculate the cause of the fault step by step until the fault location target is completed.

[133] The fault hierarchy positioning diagram is shown in Figure 5. As shown in Figure 5, the alarm set (or alarm sequence) in the known time window alarm alarm ^ alarm, calculate and merge the classified fault causes, determine the classification The cause of the failure; use the alarm set or alarm sequence, and calculate the cause of the upper-level failure that is merged into the cause of the failure. Until the fault is located. If the fault location target is the original cause, it is not until the original cause is located.

[134] To facilitate understanding of fault level positioning, the process is illustrated by an example below.

[135] Extracting the initial cause of the fault under the alarm set or the alarm sequence, and classifying the initial cause of the fault, obtaining the reason for the merger (1), continuing to merge the classification, and obtaining the reason for the merger (2), and the corresponding fault cause merge classification diagram Figure 6 shows. Then, according to the method for calculating the probability of occurrence of the fault cause corresponding to each type of alarm in the foregoing process, firstly, using the merging reason (2) level, the probability of "monitoring device" among the fault causes of the alarm set or the alarm sequence is calculated to be the largest. The probability of determining the cause of the alarm is "monitoring device". The monitoring device is composed of three reasons: "monitoring device configuration", "monitoring device" and "monitoring device cable". The alarm set or alarm sequence is used to calculate the cause of the alarm under the cause of the fault at the level ( The probability of the fault cause of the combined classification is the probability of the fault under this level. For example, there may be three fault causes for an alarm. The probability of each fault is 1, and the combined classification is one. The probability is 1), calculate

3

This level of "monitoring device configuration" has the highest probability. If you need to locate the initial cause, use the alarm sequence and continue to calculate the upper layer according to the above method to determine that the "monitoring device is plugged in" is the cause of the alarm failure.

In the embodiment of the present invention, the alarm information is extracted from the alarm design and description document, and then the fault occurrence targets are combined and classified according to the fault location target, and the alarm set in the current network in the time window is calculated (or The probability of the occurrence of the fault of the alarm sequence, thereby achieving hierarchical positioning of the fault cause and improving the fault location efficiency. Further, by correlating the causes of alarm failures, the correlation of alarms is also improved. As well as the probability of the failure of the alarm being updated in real time, the accuracy of the fault location of the alarm is improved.

[137] Based on the implementation process of the foregoing method, the embodiment of the present invention further provides a fault locating device, which is shown in FIG. 7. The device includes: an extracting unit 71, a first establishing unit 72, and a processing unit 73. The obtaining unit 74, the second establishing unit 75, the determining unit 76, the selecting unit 77 and the positioning unit 78, wherein The extracting unit 71 is configured to extract the alarm information of each device in the network, and specifically, extract the alarm information from the alarm design and description documents of each device in the network.

The first establishing unit 72 is configured to establish a correspondence between the alarm name and the alarm fault cause in the alarm information, and specifically configured to establish a bipartite graph of the alarm set and the alarm fault cause set. The definition of the bipartite graph is as described above, and will not be described here.

[140] The processing unit 73 is configured to perform a combined classification on the alarm fault cause according to the fault location target, to obtain an alarm fault cause set.

[1] Optionally, the processing unit includes: a setting unit and a classification unit, where the setting unit is configured to set a fault location target according to a device fault location principle; and the classification unit is configured to follow The fault locating target combines and classifies the alarm fault causes to obtain a set of alarm fault causes.

[142] The obtaining unit 74 is configured to acquire an alarm set of alarm data in the live network.

[143] The second establishing unit 75 is configured to establish a correspondence between the alarm set and the alarm failure cause set, where the alarm set includes: a set of alarm names;

The determining unit 76 is configured to determine a probability of occurrence of a fault cause corresponding to the alarm set in a preset time window;

[145] Optionally, the determining unit includes: a first probability calculating unit, a second probability calculating unit, and a probability determining unit, where the first probability calculating unit is configured to calculate each of the preset time window alarm sets The probability of occurrence of the alarm is specifically used to use the frequency of occurrence of the alarm in the preset time window as the probability of occurrence of the alarm in the time window; the second probability calculation unit is configured to calculate the occurrence of the fault corresponding to each alarm The probability determining unit is configured to determine, according to the probability of occurrence of each type of alarm and the probability of occurrence of each fault cause, the probability of occurrence of the fault cause corresponding to the alarm set in the preset time window.

[146] Optionally, the second probability calculation unit includes: an initialization unit and a verification unit, where the initialization unit is configured to initialize a probability that a fault cause of each alarm occurs; the verification unit is configured to The time window calculates and verifies the probability of occurrence of the fault cause of each type of alarm. Further, the method further includes: an update unit, configured to update a probability of occurrence of a corresponding fault cause of each type of alarm.

[147] Optionally, the classification unit is further configured to: perform the alarm failure according to the fault location target After the categorization is performed, the alarm name set is also obtained. The device further includes: a calculating unit, configured to calculate a correlation degree of the alarm name set after the merging, the correlation degree is used to verify that the merged category is valid. Sex.

[148] The selecting unit 77 is configured to select a probability that the fault cause that meets the preset range occurs as a probability of occurrence of a fault cause corresponding to the alarm set.

The locating unit 78 is configured to perform hierarchical hierarchical classification on the fault cause of the alarm set, and implement hierarchical positioning of the fault cause.

[150] Optionally, the positioning unit includes: a hierarchical classification unit and a hierarchical positioning unit, where the hierarchical classification unit is configured to perform hierarchical hierarchical classification on the fault causes of the alarm set, and obtain a combination reason of each layer. The hierarchical positioning unit is configured to calculate the cause of the fault step by step to complete the hierarchical positioning of the fault location target.

[151] The optional device may be integrated in the terminal, or may be deployed independently. This embodiment is not limited.

[152] For the implementation process of the functions and functions of the various units in the device, refer to the implementation process of the corresponding steps in the foregoing method, and details are not described herein again. [153] Correspondingly, the embodiment of the present invention further provides a fault locating device, which is shown in FIG. 8. The device includes: an alarm information extracting unit 81, an alarm information processing unit 82, an alarm data processing unit 83, and Fault hierarchy locating unit 84, wherein

[154] The alarm information extraction unit 81 is configured to generate alarm information of each device in the network, and establish a correspondence between the alarm name and the alarm failure cause in the alarm information. [155] The alarm information processing unit 82 And merging and classifying the alarm fault causes according to the fault locating target, and obtaining an alarm fault cause set;

[156] The alarm data processing unit 83 is configured to acquire an alarm set of alarm data, and establish a correspondence between the alarm set and the alarm failure cause set; wherein the alarm set includes: an alarm name set; Setting a probability that the fault cause corresponding to the alarm set in the time window occurs; selecting a probability that the fault cause occurs in the preset range as a fault cause of the alarm set;

[157] The fault hierarchy locating unit 84 is configured to perform hierarchical merging on the fault cause of the alarm set. Classification, achieving hierarchical positioning of the cause of the failure.

[158] Optionally, the alarm information processing unit 82 is specifically configured to: set a fault location target according to a device fault location principle; perform the combined classification of the alarm fault cause according to the fault location target, and obtain an alarm fault cause. set. [159] Optionally, the alarm information processing unit 82 combines and classifies the alarm failure causes according to the fault location target, and obtains the combined classification of the alarm name sets, and is also used to calculate the combined classification. The degree of association of the subsequent alarm name set, the correlation degree is used to verify the validity of the merged classification.

[160] Optionally, the alarm data processing unit 83 establishes a correspondence between the alarm set and the alarm failure cause set, and includes: establishing, according to a correspondence between the alarm name and an alarm failure cause, A bipartite graph of the set of alarms and the set of alarm failure causes.

[016] Optionally, the alarm data processing unit 83 determines a probability of occurrence of a fault cause corresponding to the alarm set in the preset time window, and includes: calculating a probability of occurrence of each alarm in the alarm set in the time window; Determining a probability of occurrence of a fault cause corresponding to each type of alarm; determining a probability of occurrence of a fault cause corresponding to the alarm set in the time window according to a probability of occurrence of each type of alarm and a probability of occurrence of each type of fault cause; The probability of occurrence of the fault cause that meets the preset range is selected as the fault cause of the alarm set.

[162] Optionally, the alarm data processing unit 83 calculates a probability of occurrence of each alarm in the alarm set in the predetermined time window, including: using a frequency of occurrence of the alarm within the predetermined time window as a probability of occurrence of the alarm within the predetermined time window .

[163] Optionally, the alarm data processing unit 83 calculates a probability of occurrence of the fault cause corresponding to each type of alarm, including: initializing a probability of occurrence of the fault cause of each alarm; within the predetermined time window Calculate and verify the probability of occurrence of the failure cause of each of the alarms.

[164] Optionally, the alarm data processing unit 83 calculates a probability of occurrence of the fault cause corresponding to each type of alarm, and further includes: updating a probability of occurrence of a corresponding fault cause of each type of the alarm.

[165] Optionally, the alarm data processing unit 83 determines a probability of occurrence of a fault cause corresponding to the alarm set in the time window, and includes: selecting a probability that a maximum fault cause occurs or selecting a preset preset criterion The probability that the cause of the fault occurs is the cause of the fault of the alarm set.

[166] Optionally, the fault tier locating unit 84 is configured to perform hierarchical merging and categorizing the fault causes of the alarm set to obtain a merging reason of each layer; calculate a fault cause to the upper tier to complete the fault. The hierarchical positioning of the target. The optional device may be integrated in the terminal, or may be deployed independently. This embodiment is not limited.

[168] The implementation process of the functions and functions of the various units in the device is described in detail in the implementation process of the corresponding steps in the above method.

Correspondingly, the embodiment of the present invention further provides a server. The structure of the server is as shown in FIG. 9. The server 9 includes: a memory 91, a transceiver 92, and a processor 93, wherein [170] the memory 91, used for storing alarm design and description documents of each device in the network;

The transceiver 92 is configured to acquire an alarm design and description file of each device in the storage 81, and extract alarm information from the alarm design and description document;

The processor 93 is configured to establish a correspondence between the alarm name and the alarm fault cause in the alarm information. According to the fault location target, the alarm fault causes are combined and classified to obtain an alarm fault cause set. ;

The transceiver 92 is further configured to acquire an alarm set of alarm data in the live network.

The processor 93 is further configured to establish a correspondence between the alarm set and the alarm failure cause set, where the alarm set includes: an alarm name set; and determining the alarm set in a preset time window. The probability of occurrence of the corresponding fault cause is selected; the probability of occurrence of the fault cause that meets the preset range is selected as the fault cause of the alarm set; the fault cause of the alarm set is hierarchically classified to achieve hierarchical positioning of the fault cause.

[175] Optionally, the processor combines the alarm fault causes according to the fault location target, and obtains the alarm fault cause set, including: setting a fault location target according to the device fault location principle; And combining the alarm fault causes to obtain a set of alarm fault causes. [176] Optionally, the processor combines the alarm failure causes according to the fault location target And the processor is further configured to calculate the association degree of the alarm name set after the combination classification, where the correlation degree is used to verify the validity of the merged classification.

[177] Optionally, the establishing, by the processor, the corresponding relationship between the alarm set and the alarm fault cause set, the method includes: establishing, according to a correspondence between the alarm name and an alarm fault cause, the alarm set and A bipartite graph of the set of alarm failure causes.

[178] Optionally, the determining, by the processor, a probability that the fault cause corresponding to the alarm set in the preset time window occurs, including: calculating a probability of occurrence of each alarm in the alarm set in the preset time window; The probability of occurrence of the fault cause corresponding to each type of alarm; determining the probability of occurrence of the fault cause corresponding to the alarm set in the preset time window according to the probability of occurrence of each type of alarm and the probability of occurrence of each type of fault cause And selecting, according to the preset range, a probability that the fault cause occurs as a fault cause of the alarm set;

Optionally, the calculating, by the processor, the probability of occurrence of each type of alarm in the set of alarms in the predetermined time window comprises: using a frequency of occurrence of the alarm within the predetermined time window as a probability of occurrence of the alarm within the predetermined time window.

[180] Optionally, the calculating, by the processor, the probability of occurrence of the fault cause corresponding to each type of alarm includes: initializing a probability of occurrence of the fault cause of each type of alarm; calculating and verifying the location within the predetermined time window The probability of the cause of the failure of each type of alarm.

[181] Optionally, the calculating, by the processor, the probability of occurrence of the fault cause corresponding to each type of alarm further includes: updating a probability of occurrence of a corresponding fault cause of each type of alarm.

[182] Optionally, the determining, by the processor, a probability of occurrence of a fault cause corresponding to the alarm set in the preset time window, including: selecting a probability of occurrence of a maximum fault cause or selecting the fault that meets a preset range The probability of occurrence of the cause is the cause of the failure of the alarm set.

[183] Optionally, the processor performs hierarchical hierarchical classification on the fault cause of the alarm set, and implements hierarchical positioning of the fault cause, including: hierarchically merging and categorizing the fault causes of the alarm set, and obtaining layers of each The reason for the combination; the cause of the failure is calculated step by step to the upper layer to complete the hierarchical positioning of the fault location target. Correspondingly, the embodiment of the present invention further provides a terminal, where the terminal includes: a server, the server, such as the server, includes: a memory and a processor, and functions and functions of the memory and the processor are detailed. The above is not described here. In the embodiment of the present invention, the UE may be any one of the following, and may be static or mobile. The static UE may specifically be a terminal, a mobile station (mobi le station), and a user. For a subscriber unit or a station, the mobile UE may specifically include a cel lular phone, a personal digital assistant (PDA), a modem, a wireless communication device, and a handheld device ( Handhel d), laptop computer ^ cordless phone or wire less local loop (WLL) station, etc., the above UEs can be distributed throughout the wireless network.

[186] It should be noted that, in this context, relational terms such as first and second are used merely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply these entities. There is any such actual relationship or order between operations. Furthermore, the terms "including", "comprising" or "comprising" or "includes" or "includes" or "includes" or "includes" or "includes" Other elements, or elements that are inherent to such a process, method, item, or device. In the absence of more limitations, the elements defined by the phrase "comprising a ..." do not exclude the presence of additional identical elements in the process, method, article or device that comprises the element.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented by means of software plus a necessary general hardware platform, and of course, can also be through hardware, but in many cases the former is more Good implementation. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, may be embodied in the form of a software product, which may be stored in a storage medium such as a ROM/RAM, a disk. , an optical disk, etc., includes instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present invention or portions of the embodiments.

The above description is only a preferred embodiment of the present invention, and it should be noted that those skilled in the art can make several improvements and refinements without departing from the principles of the present invention. Retouching should also be considered as the scope of protection of the present invention.

Claims

Rights request

1. A fault location method, characterized by including:

Extract the alarm information of each device in the network, and establish the corresponding relationship between the alarm name in the alarm information and the cause of the alarm failure;

The alarm fault causes are combined and classified according to the fault location target to obtain a set of alarm fault causes.

Obtain an alarm set of alarm data in the existing network, and establish a corresponding relationship between the alarm set and the alarm failure cause set; wherein, the alarm set includes: an alarm name set;

Determine the probability of occurrence of the fault cause corresponding to the alarm set within the predetermined time window;

Select the probability of occurrence of the fault cause that satisfies the preset range as the fault cause of the alarm set;

The fault causes of the alarm set are hierarchically merged and classified to realize hierarchical positioning of the fault causes.

2. The method according to claim 1, characterized in that, according to the fault location target, the alarm fault causes are combined and classified, and the obtained alarm fault cause set includes:

Set fault location targets according to the principle of equipment fault location;

According to the fault location target, the alarm fault causes are combined and classified to obtain a set of alarm fault causes.

3. The method according to claim 2, characterized in that, the alarm failure causes are combined and classified according to the fault location target, and an alarm name set is obtained; the method further includes: calculating and summarizing the alarms The correlation degree of the name set, the correlation degree is used to verify the validity of the merged classification.

4. The method according to claim 1, characterized in that establishing the corresponding relationship between the alarm set and the alarm failure cause set includes:

According to the corresponding relationship between the alarm name and the alarm failure cause, a bipartite graph of the alarm set and the alarm failure cause set is established.

5. The method according to claim 1, wherein the determining the probability of occurrence of the fault cause corresponding to the alarm set within the predetermined time window includes: Calculate the probability of occurrence of each alarm in the alarm set within the predetermined time window;

Calculate the probability of occurrence of the fault cause corresponding to each alarm;

According to the probability of occurrence of each alarm and the corresponding probability of occurrence of each fault cause, the probability of occurrence of the fault cause corresponding to the alarm set within the predetermined time window is determined.

6. The method according to claim 5, characterized in that the calculation of the probability of occurrence of each alarm in the alarm set within the predetermined time window includes:

Use the frequency of alarm occurrences within the predetermined time window as the probability of alarm occurrence within the preset time window.

7. The method according to claim 5, wherein the calculating the probability of occurrence of the fault cause corresponding to each alarm includes:

Initialize the probability of occurrence of the fault cause of each alarm;

Calculate and verify the probability of occurrence of the fault cause for each alarm within the predetermined time window; and update the probability of occurrence of the fault cause corresponding to each alarm.

8. The method according to any one of claims 1 to 7, characterized in that, hierarchically merging and classifying the fault causes of the alarm set to achieve hierarchical positioning of fault causes, including:

The fault causes of the alarm set are hierarchically merged and classified to obtain the merged causes of each layer; the fault causes are calculated to the upper layers step by step to complete the hierarchical positioning of the fault location target.

9. A fault locating device, characterized by including:

Extraction unit, used to extract alarm information from each device in the network;

The first establishment unit is used to establish the correspondence between the alarm name and the cause of the alarm failure in the alarm information;

A processing unit, configured to merge and classify the alarm fault causes according to the fault location target to obtain a set of alarm fault causes;

The acquisition unit is used to obtain the alarm collection of alarm data in the existing network;

The second establishment unit is used to establish the corresponding relationship between the alarm set and the alarm failure cause set; wherein the alarm set includes: an alarm name set;

Determining unit, used to determine the probability of occurrence of the fault cause corresponding to the alarm set within the predetermined time window;

A selection unit configured to select a probability of occurrence of the fault cause that satisfies a preset range as the alarm. The cause of the failure of the collection;

The positioning unit is used to hierarchically merge and classify the fault causes of the alarm set to realize hierarchical positioning of the fault causes.

10. The device according to claim 9, characterized in that the processing unit includes: a setting unit, used to set the fault location target according to the equipment fault location principle;

A classification unit, configured to combine and classify the alarm fault causes according to the fault location target to obtain a set of alarm fault causes.

11. The device according to claim 10, characterized in that,

The classification unit is also configured to obtain a set of alarm names after merging and classifying the alarm fault causes according to the fault location target; the device further includes:

The calculation unit is used to calculate the correlation degree of the merged and classified alarm name sets, and the correlation degree is used to verify the validity of the merged classification.

12. The device according to claim 9, wherein the first establishing unit is specifically configured to establish the alarm set and the alarm fault according to the corresponding relationship between the alarm name and the alarm fault cause. Bipartite graph of cause sets.

13. The device according to claim 9, characterized in that the determining unit includes: a first probability calculation unit, used to calculate the probability of occurrence of each alarm in the alarm set within the predetermined time window;

The second probability calculation unit is used to calculate the probability of occurrence of the fault cause corresponding to each alarm; the probability determination unit is used to determine the probability of occurrence of each alarm according to the probability of occurrence of each alarm and the corresponding probability of each fault cause. The probability of occurrence of the fault cause corresponding to the alarm set within the predetermined time window.

14. The device according to claim 13, characterized in that,

The first probability calculation unit is specifically configured to use the frequency of alarm occurrence within the predetermined time window as the probability of alarm occurrence within the preset time window.

15. The device according to claim 13, characterized in that the second probability calculation unit includes: An initialization unit, used to initialize the probability of occurrence of the fault cause of each alarm; a verification unit, used to calculate and verify the probability of occurrence of the fault cause of each alarm within the predetermined time window;

An update unit, configured to update the probability of occurrence of the corresponding fault cause for each alarm.

16. The device according to any one of claims 9 to 15, characterized in that the positioning unit includes:

A hierarchical classification unit, used for hierarchically merging and classifying the fault causes of the alarm set to obtain the merging causes of each layer;

The hierarchical positioning unit is used to calculate the fault cause step by step to the upper level to complete the hierarchical positioning of the fault location target.

17. A fault locating device, characterized by including:

An alarm information extraction unit is used to extract alarm information from each device in the network, and establish a correspondence between the alarm name in the alarm information and the cause of the alarm failure;

An alarm information processing unit is used to merge and classify the alarm fault causes according to the fault location target to obtain a set of alarm fault causes;

An alarm data processing unit is used to obtain an alarm set of alarm data, and establish a correspondence between the alarm set and the alarm failure cause set; wherein the alarm set includes: an alarm name set; determining the alarm within a predetermined time window The probability of occurrence of the fault cause corresponding to the set; select the probability of occurrence of the fault cause that satisfies the preset range as the fault cause of the alarm set;

The fault hierarchical positioning unit is used to hierarchically merge and classify the fault causes of the alarm set to realize hierarchical positioning of the fault causes.

18. The device according to claim 17, characterized in that the alarm information processing unit is specifically configured to set a fault location target according to the equipment fault location principle; and determine the cause of the alarm fault according to the fault location target. Combine the categories to obtain a set of alarm fault causes.

19. The device according to claim 18, characterized in that, the alarm information processing unit merges and classifies the alarm fault causes according to the fault location target, and obtains the merged and classified alarm name set. When , it is also used to calculate the correlation degree of the merged and classified alarm name sets, and the correlation degree is used to verify the validity of the merged classification.

20. The device according to claim 17, wherein the alarm data processing unit establishes a corresponding relationship between the alarm set and the alarm failure cause set, including: based on the relationship between the alarm name and the alarm failure cause. The corresponding relationship is to establish a bipartite graph of the alarm set and the alarm failure cause set.

21. The device according to claim 17, wherein the alarm data processing unit determines the probability of occurrence of the fault cause corresponding to the alarm set within the preset time window, including: calculating The probability of occurrence of each alarm; calculating the probability of occurrence of the fault cause corresponding to each alarm; determining the probability of occurrence of each fault cause within the preset time window based on the probability of occurrence of each alarm and the corresponding probability of occurrence of each fault cause. The probability of occurrence of the fault cause corresponding to the alarm set is selected; and the probability of occurrence of the fault cause that satisfies the preset range is selected as the fault cause of the alarm set.

22. The device according to claim 21, wherein the alarm data processing unit calculates the probability of occurrence of each alarm in the alarm set within the preset time window, including: using the frequency of alarm occurrence within the preset time window as The probability of alarm occurrence within the predetermined time window.

23. The device according to claim 21, wherein the alarm data processing unit calculates the probability of occurrence of the fault cause corresponding to each alarm, including: initializing the probability of occurrence of the fault cause of each alarm; Calculate and verify the probability of occurrence of the fault cause of each alarm within the predetermined time window; update the probability of occurrence of the corresponding fault cause of each alarm.

24. The device according to any one of claims 17 to 23, characterized in that the fault level positioning unit is specifically used to perform hierarchical merging and classification of the fault causes of the alarm set to obtain the merging causes of each layer; Calculate the cause of the fault step by step to the upper level to complete the hierarchical positioning of the fault location target.