WO2015131558A1 - 告警相关性数据挖掘方法和装置 - Google Patents

告警相关性数据挖掘方法和装置 Download PDF

Info

Publication number
WO2015131558A1
WO2015131558A1 PCT/CN2014/091688 CN2014091688W WO2015131558A1 WO 2015131558 A1 WO2015131558 A1 WO 2015131558A1 CN 2014091688 W CN2014091688 W CN 2014091688W WO 2015131558 A1 WO2015131558 A1 WO 2015131558A1
Authority
WO
WIPO (PCT)
Prior art keywords
alarm
code
matrix
connection strength
distance
Prior art date
Application number
PCT/CN2014/091688
Other languages
English (en)
French (fr)
Inventor
杜家强
文秀林
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to EP14884768.4A priority Critical patent/EP3208970A4/en
Publication of WO2015131558A1 publication Critical patent/WO2015131558A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0604—Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time
    • H04L41/0613—Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time based on the type or category of the network elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0604—Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time
    • H04L41/0622—Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time based on time
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • H04L41/064—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis involving time analysis

Definitions

  • the present invention relates to the field of alarm correlation data mining technology, and in particular, to an alarm correlation data mining method and apparatus.
  • the main task of modern telecommunication network management is to monitor the network in real time to ensure efficient, reliable, economical and safe operation of the telecommunication network.
  • telecommunication networks may have millions of alarms every day, and there are a lot of information in this massive alarm, such as alarm time, level, equipment, regional distribution, and each alarm life cycle. Distribution, and the inherent relationship between alarms and alarms, how to quickly find alarm correlation information in the telecommunication network from the massive alarm data, and help the network management personnel to deal with network failures is an urgent problem to be solved.
  • the main object of the present invention is to provide an alarm correlation data mining method and apparatus, which aims to solve the problem of quickly searching for alarm correlation information in a telecommunication network from massive alarm data.
  • An alarm correlation data mining method comprising the following steps:
  • a frequent path is mined according to the alarm group clustering set and the connection strength.
  • the setting range includes setting time and setting device
  • the step of acquiring the alarm data of the set range, and extracting the alarm code, the site ID, and the device ID from the alarm data includes:
  • the matrix comprises a transaction matrix and a traversal matrix
  • the generating a matrix according to the extracted alarm code, the site ID, and the device ID, and acquiring the alarm occurrence frequency, the inter-alarm distance, and the connection strength according to the generated matrix includes:
  • the alarm code is used as a row, the device ID or the site ID is a column to generate the transaction matrix; the alarm code is used as a row, and the alarm code is a column to generate the traversal matrix.
  • the step of acquiring the alarm population clustering set according to the alarm occurrence frequency and the inter-alarm distance includes:
  • the selected alarm codes are combined according to distances to obtain an alarm group cluster set.
  • the step of mining the frequent path according to the alarm group clustering set and the connection strength includes:
  • connection strength of the alarm group clustering set with a preset connection strength threshold Comparing the connection strength of the alarm group clustering set with a preset connection strength threshold, and filtering out an alarm code that is greater than or equal to a preset connection strength threshold, and performing path merging on the selected associated alarm code. , get frequent paths.
  • An alarm correlation data mining device includes an extraction module, a generation module, an acquisition module, and a mining module, wherein:
  • the extraction module is configured to: obtain alarm data of a set range, and extract an alarm code, a site ID, and a device ID from the alarm data;
  • the generating module is configured to: generate a matrix according to the extracted alarm code, the site ID, and the device ID, and acquire an alarm occurrence frequency, an inter-alarm distance, and a connection strength according to the generated matrix;
  • the acquiring module is configured to: obtain an alarm group clustering set according to the alarm occurrence frequency and the inter-alarm distance;
  • the mining module is configured to: mine a frequent path according to the alarm group clustering set and the connection strength.
  • the extracting module is configured to acquire the alarm data of the set range according to the following manner, and extract the alarm code, the site ID, and the device ID from the alarm data:
  • the generating module is configured to generate a matrix according to the extracted alarm code, the site ID, and the device ID as follows:
  • the device ID or the site ID is a column generating a transaction matrix; and the alarm code is a row, and the alarm code is a column to establish a traversal matrix.
  • the obtaining module includes a frequency comparison unit, a distance comparison unit, and a merging unit, where:
  • the frequency comparison unit is configured to: compare the alarm occurrence frequency with a preset frequency threshold, and filter out an alarm code that is greater than or equal to a preset frequency threshold;
  • the distance comparison unit is configured to: compare the distance between the alarms and a preset distance threshold, and filter out an alarm code that is smaller than a preset distance threshold;
  • the merging unit is configured to: combine the filtered alarm codes according to distances to obtain Alarm group clustering set.
  • the mining module is configured to mine the frequent path according to the alarm group clustering set and the connection strength as follows:
  • connection strength of the alarm group clustering set with a preset connection strength threshold Comparing the connection strength of the alarm group clustering set with a preset connection strength threshold, and filtering out an alarm code that is greater than or equal to a preset connection strength threshold, and performing path merging on the selected associated alarm code. , get frequent paths.
  • a computer program comprising program instructions that, when executed by a computer, cause the computer to perform any of the above-described alarm correlation data mining methods.
  • the frequent path-based alarm correlation data mining method extracts an alarm code, a site ID, and a device ID by acquiring alarm data of a set range; and according to the extracted alarm code, the site ID, and the The device ID, the generation matrix, the frequency of occurrence of the alarm, the distance between the alarms, and the connection strength; and the cluster of alarm groups obtained according to the frequency of the alarm occurrence and the distance between the alarms; The connection strength, excavating frequent paths.
  • the embodiment of the invention combines the telecommunication alarm feature and the data mining algorithm to effectively integrate the alarm code, the alarm position, the time sequence, and the number of occurrences, and proposes to use the matrix to store information of multiple dimensions of the alarm, and efficiently and quickly mine the alarm between the alarms. Correlation relationship, thereby improving operation and maintenance efficiency.
  • FIG. 1 is a schematic flowchart of an alarm correlation data mining method according to a first embodiment of the present invention
  • FIG. 2 is a schematic flowchart of an alarm correlation data mining method according to a second embodiment of the present invention.
  • FIG. 3 is an alarm obtained according to the alarm occurrence frequency and the inter-alarm distance according to FIG. Schematic diagram of the refinement process of the steps of group clustering;
  • FIG. 4 is a schematic flowchart of an alarm correlation data mining method according to a third embodiment of the present invention.
  • FIG. 5 is a schematic diagram of functional modules of an alarm correlation data mining device according to an embodiment of the present invention.
  • FIG. 6 is a schematic diagram of functional modules of the acquisition module of FIG. 5.
  • FIG. 1 is a schematic flowchart of a method for mining an alarm correlation data according to a first embodiment of the present invention.
  • the alarm correlation data mining method includes the following steps:
  • Step S100 Obtain alarm data of a set range, and extract an alarm code, a site ID, and a device ID.
  • the alarm correlation data mining device acquires the alarm data of the set range, wherein the setting range may be a specific time period set, or may be a specific type of device set, and is extracted from the alarm data of the set range. Corresponding alarm code, site ID and device ID.
  • Step S200 Generate a matrix according to the extracted alarm code, the site ID, and the device ID, and obtain an alarm occurrence frequency, an alarm interval, and a connection strength.
  • the alarm correlation data mining device generates a corresponding matrix according to the extracted alarm code, the site ID and the device ID, wherein the generated matrix includes a transaction matrix and a traversal matrix, and the alarm code is a row, the device ID or the site ID is a column, and the obtained
  • the transaction matrix based on the device ID or site ID is as follows:
  • the alarm code is the column, forming the alarm code-alarm code matrix to alarm Based on the code, the element aij indicates that all devices have an alarm first, the number of times aj occurs in the time window, and no alarm occurs in the middle.
  • the transaction matrix is taken as an example.
  • the hij is the number of times the alarm i occurs on the jth device.
  • Each row vector indicates that the alarm i actually occurs on all devices. Therefore, the row vector represents the composition of the alarm, and it also contains The alarm generation mode of the device; while the column vector represents different devices and also outlines the personalized characteristics of the device, then by measuring the similarity of the row vectors, the relevant alarm group clustering set can be obtained, and further analysis can be obtained.
  • the inherent mode of occurrence of the device ie frequent paths.
  • the alarm occurrence frequency is the sum of the number of occurrences of the alarm A among all the alarms generated by the set type device within a specified time range.
  • the connection strength is the sum of the number of times the alarm Ai actually occurs in a device in the specified time range, the same device type or the same device under the same site.
  • the connection strength between Ai and Aj that is, the Aij value of A in the traversal matrix, is recorded by traversing the matrix.
  • Step S300 Acquire an alarm group clustering set according to the alarm occurrence frequency and the inter-alarm distance.
  • the alarm correlation data mining device compares the acquired alarm occurrence frequency with the inter-alarm distance and the preset alarm occurrence frequency and the distance threshold, selects an alarm code that meets the requirement, and selects the filtered alarm code according to the distance. The combination is performed to obtain an alarm group clustering set.
  • Step S400 Mining a frequent path according to the alarm group clustering set and the connection strength.
  • the alarm correlation data mining device compares the obtained alarm group clustering set and the connection strength with a preset connection strength threshold, and filters out an alarm code that is greater than or equal to a preset connection strength threshold, and filters the filtered alarm code. After the associated processing, the path is merged to obtain frequent routes. path.
  • the alarm correlation data mining method provided by the embodiment combines the telecommunication alarm feature and the data mining algorithm to effectively integrate the alarm code, the alarm position, the time sequence, and the number of occurrences, and proposes to use the matrix to store information of multiple dimensions of the alarm. Efficiently and quickly dig out the associations between alarms to improve operation and maintenance efficiency.
  • the method may be based on a frequent path or may be based on other information, and the foregoing method may be applied as long as the technical problem of the present invention can be solved.
  • FIG. 2 is a schematic flowchart of a method for mining an alarm correlation data based on a frequent path according to a second embodiment of the present invention.
  • the step S100 includes:
  • Step S100A Obtain the set time and the alarm data of the setting device, and extract the alarm code, the site ID, and the device ID.
  • the alarm correlation data mining device based on the frequent path acquires alarm data of the device in the set time period and the set type, and extracts information such as the alarm code, the site ID, and the device ID.
  • the frequent path-based alarm correlation data mining method includes the following steps:
  • Step S310 Compare the alarm occurrence frequency with a preset frequency threshold, and filter out an alarm code that is greater than or equal to a preset frequency threshold.
  • the alarm correlation data mining device based on the frequent path compares the acquired alarm occurrence frequency with a preset frequency threshold, and selects an alarm code that is greater than or equal to a preset frequency threshold.
  • Step S320 Compare the distance between the alarms and a preset distance threshold, and filter out an alarm code that is smaller than a preset distance threshold.
  • the alarm correlation data mining device After the first screening, the alarm correlation data mining device based on the frequent path compares the distance between the alarms and the preset distance threshold again, and filters out the alarm code when the distance is smaller than the preset distance threshold.
  • Step S330 Combine the selected alarm codes according to distances to obtain an alarm group cluster set.
  • the alarm correlation data mining device based on the frequent path combines the alarm codes obtained after the two screenings according to the distance to obtain the alarm group clustering set.
  • the device ID of the column is identified as (device-1, device-2, device-3, device-4, device-5, devic-6);
  • the frequency of occurrence of alarms alarm-1 to alarm-6 (3, 1, 6, 6, 5, 9) is set, and the distance threshold is equal to 4, and all alarms whose frequency is greater than 4 are found.
  • the frequent alarm set is ⁇ alarm-3, alarm-4, alarm-5, alarm-6 ⁇ , extract the corresponding matrix and set the non-zero value to 1:
  • the step S400 includes:
  • Step S400A Compare the connection strength of the alarm group clustering set with a preset connection strength threshold, and filter out an alarm code that is greater than or equal to a preset connection strength threshold, and the associated alarm code after filtering. Perform path merging to get frequent paths.
  • the alarm correlation data mining device based on the frequent path compares the connection strength of the alarm group clustering set with the preset connection strength threshold, and filters out the alarm code that is greater than or equal to the preset connection strength threshold, and is associated with the filtered
  • the alarm code is combined to obtain a frequent path.
  • the alarm correlation data mining device based on the frequent path starts clustering after the alarm group is clustered, and assumes that the cluster set is ⁇ alarm-1, alarm-2...alarm-n ⁇ , and the traversal matrix Extract the row and column corresponding to alarm-1, alarm-2...alarm-n, and form matrix N[n][n].
  • matrix N find all N[i][j] Greater than or equal to the connection strength threshold term. If N[i][j] is greater than or equal to the connection strength threshold term, then (alarm-i, alarm-j) is considered to be a frequent path, and all frequent paths of length 2 are merged. Get frequent paths of length 3 until they cannot be merged, which results in frequent paths.
  • the traversal matrix corresponding to the session matrix is as follows:
  • connection strength threshold be equal to 3, and filter the frequent path ⁇ alarm-3,alamr-4> ⁇ whose connection strength is greater than or equal to 3 from N-1; and obtain the frequent path with the connection strength greater than or equal to 3 from N-2.
  • ⁇ alarm-4,alarm-5>, ⁇ alarm-5,alarm-6> ⁇ is merged to ⁇ alarm-4,alarm-5,alarm-6> ⁇ .
  • the alarm correlation data mining device based on the frequent path can set the correlation rule according to the inherent mode of the mining, for example, when the alarm alarm-4 occurs, according to the alarm inherent When the mode is judged, alarm-5, alarm-6 will occur in the time window.
  • the correlation rule can be used to set alarm-4 as the primary alarm, and alarm-5 and alarm-6 are set as the secondary alarms. This can reduce the amount of alarms and facilitate the operation and maintenance personnel to analyze the root cause alarms.
  • an embodiment of the present invention further provides an alarm correlation data mining device, where the frequent path based alarm correlation data mining device includes:
  • the extraction module 10 is configured to: obtain alarm data of a set range, and extract an alarm code, a site ID, and a device ID;
  • the generating module 20 is configured to: generate a matrix according to the extracted alarm code, the site ID, and the device ID, and obtain an alarm occurrence frequency, an inter-alarm distance, and a connection strength;
  • the obtaining module 30 is configured to: obtain an alarm group clustering set according to the alarm occurrence frequency and the inter-alarm distance;
  • the mining module 40 is configured to: mine the frequent path according to the alarm group clustering set and the connection strength.
  • the extraction module 10 of the alarm correlation data mining device based on the frequent path obtains the alarm data of the set range, wherein the setting range may be a specific time period set, or may be a specific type of device set.
  • the alarm data of the set range is extracted from the corresponding alarm code, site ID, and device ID.
  • the generation module 20 of the frequent path-based alarm correlation data mining device generates a corresponding matrix according to the extracted alarm code, the site ID and the device ID, wherein the generated matrix includes a transaction matrix and a traversal matrix, wherein the generated matrix includes a transaction.
  • the traversal matrix takes the alarm code as the line, the alarm code is the column, and forms the alarm code-alarm code matrix, which is based on the alarm code.
  • the element aij indicates that all the devices have the alarm ai first, and the number of times aj occurs in the time window. There is no alarm in the middle.
  • the transaction matrix is taken as an example.
  • the hij is the number of times the alarm i occurs on the jth device.
  • Each row vector indicates that the alarm i actually occurs on all devices. Therefore, the row vector represents the composition of the alarm, and it also contains The alarm generation mode of the device; while the column vector represents different devices and also outlines the personalized characteristics of the device, then by measuring the similarity of the row vectors, the relevant alarm group clustering set can be obtained, and further analysis can be obtained.
  • the inherent mode of occurrence of the device ie frequent paths.
  • the alarm occurrence frequency is the sum of the number of occurrences of the alarm A among all the alarms generated by the set type device within a specified time range.
  • Connection strength is within the specified time range, the same device type or phase In the alarm range of different devices in the same site, the alarm Ai actually occurs on a device, and the sum of the times of the alarm Aj in the sequence of the time sequence is called the connection strength between Ai and Aj.
  • the matrix is traversed to record the strength of the connection between Ai and Aj, that is, the Aij value of A in the traversal matrix.
  • the acquisition module 30 of the alarm correlation data mining device based on the frequent path compares the acquired alarm occurrence frequency and the inter-alarm distance with a preset alarm occurrence frequency and a distance threshold, and filters out the alarm code that meets the requirement, and The filtered alarm codes are combined according to distances to obtain an alarm group clustering set.
  • the mining module 40 of the alarm correlation data mining device based on the frequent path compares the obtained alarm group clustering set and the connection strength with the preset connection strength threshold, and filters out the alarm code that is greater than or equal to the preset connection strength threshold. After performing the associated processing on the filtered alarm code, the path is merged to obtain a frequent path.
  • the frequent path-based alarm correlation data mining device provided by the embodiment combines the telecommunication alarm feature and the data mining algorithm to effectively integrate the alarm code, the alarm position, the time sequence, and the number of occurrences, and proposes to use the matrix to store multiple alarms.
  • the information of the dimension can quickly and efficiently dig out the association relationship between the alarms, thereby improving the operation and maintenance efficiency.
  • the extraction module 10 is further configured to: acquire a set time and set alarm data of the device, and extract the alarm code, the site ID, and The device ID.
  • the extraction module 10 of the alarm correlation data mining device acquires alarm data of the device within the set time period and the set type, and extracts information such as the alarm code, the site ID, and the device ID.
  • the alarm correlation data mining apparatus provided in this embodiment, the obtaining module 30 includes:
  • the frequency comparison unit 31 is configured to: compare the alarm occurrence frequency with a preset frequency threshold, and filter out an alarm code that is greater than or equal to a preset frequency threshold;
  • the distance comparison unit 32 is configured to: compare the distance between the alarms and a preset distance threshold, and filter out an alarm code when the distance is smaller than a preset distance threshold;
  • the merging unit 33 is configured to: combine the filtered alarm codes according to distances to obtain an alarm group clustering set.
  • the alarm correlation data mining device compares the obtained alarm occurrence frequency with a preset frequency threshold, and selects an alarm code that is greater than or equal to a preset frequency threshold.
  • the alarm correlation data mining device compares the distance between the alarms and the preset distance threshold again, and selects an alarm code that is smaller than the preset distance threshold.
  • the alarm correlation data mining device combines the alarm codes obtained after the two screenings according to the distance, and obtains an alarm group clustering set.
  • the following examples illustrate:
  • the alarm code of the row is identified as (alarm-1, alarm-2, alarm-3, alarm-4, alarm-5, alarm-6), and the device ID of the column is identified as (device-1, Device-2, device-3, device-4, device-5, devic-6);
  • the frequency of occurrence of alarms alarm-1 to alarm-6 (3, 1, 6, 6, 5, 9) is set, and the distance threshold is equal to 4, and all alarms whose frequency is greater than 4 are found.
  • the frequent alarm set is ⁇ alarm-3, alarm-4, alarm-5, alarm-6 ⁇ , extract the corresponding matrix and set the non-zero value to 1:
  • the mining module 40 is further configured to compare the connection strength of the alarm group clustering set with a preset connection strength threshold, and filter out a preset connection strength threshold greater than or equal to The alarm code combines the path of the selected alarm code to obtain a frequent path.
  • the mining module 40 of the alarm correlation data mining device compares the connection strength of the alarm group clustering set with the preset connection strength threshold, and filters out the alarm code that is greater than or equal to the preset connection strength threshold, and is associated with the filtered
  • the alarm code is combined to obtain a frequent path.
  • the mining module 40 of the alarm correlation data mining device starts the path mining work, and assumes that the cluster set is ⁇ alarm-1, alarm-2...alarm-n ⁇ , and extracts the alarm from the traversal matrix.
  • 1,alarm-2...alarm-n corresponding rows and columns, constitute a matrix N[n][n], in the matrix N, find all N[i][j] greater than or equal to the connection strength threshold term, If N[i][j] is greater than or equal to the connection strength threshold item, it is considered that (alarm-i, alarm-j) is a frequent path, and all the frequent paths of length 2 are combined to obtain a frequent path of length 3. Until you can't merge, you get a frequent path.
  • the traversal matrix corresponding to the session matrix is as follows:
  • step S300 According to the example of step S300
  • connection strength threshold be equal to 3, and filter the frequent path ⁇ alarm-3,alamr-4> ⁇ whose connection strength is greater than or equal to 3 from N-1; and obtain the frequent path with the connection strength greater than or equal to 3 from N-2.
  • ⁇ alarm-4,alarm-5>, ⁇ alarm-5,alarm-6> ⁇ is merged to ⁇ alarm-4,alarm-5,alarm-6> ⁇ .
  • the alarm correlation data mining device can set the correlation rule according to the inherent mode of the mining, for example, after the alarm alarm-4 occurs, according to the inherent mode of the alarm, Alarm-5, alarm-6 will occur in the time window.
  • the correlation rule can be used to set alarm-4 as the primary alarm, alarm-5, alarm-6 as the secondary alarm. This can reduce the amount of alarms and facilitate the operation and maintenance personnel to analyze the root cause alarms.
  • the apparatus of the present invention may also be based on frequent paths or based on other information, and the foregoing apparatus may be applied as long as the technical problem of the present invention can be solved.
  • the embodiment of the invention further discloses a computer program, comprising program instructions, which when executed by a computer, enable the computer to perform any of the above-described alarm correlation data mining methods.
  • the alarm correlation data mining method extracts an alarm code, a site ID, and a device ID by acquiring alarm data of a set range; and according to the extracted alarm code, the site ID, and the device ID, Generating a matrix, obtaining an alarm occurrence frequency, an inter-alarm distance, and a connection strength; acquiring an alarm population cluster set according to the alarm occurrence frequency and the inter-alarm distance; and clustering the alarm group according to the alarm group and the connection strength , dig out frequent paths.
  • the embodiment of the invention combines the telecommunication alarm feature and the data mining algorithm to effectively integrate the alarm code, the alarm position, the time sequence, and the number of occurrences, and proposes to use the matrix to store information of multiple dimensions of the alarm, and efficiently and quickly mine the alarm between the alarms. Correlation relationship, thereby improving operation and maintenance efficiency. Therefore, the present invention has strong industrial applicability.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Testing And Monitoring For Control Systems (AREA)

Abstract

一种告警相关性数据挖掘方法和装置，该方法包括：通过获取设定范围的告警数据，提取告警码、站点ID和设备ID；根据提取的所述告警码、所述站点ID和所述设备ID，生成矩阵，获取告警发生频度、告警间距离和连接强度；根据所述告警发生频度和所述告警间距离，获取告警群体聚类集合；根据所述告警群体聚类集合和所述连接强度，挖掘出频繁路径。本发明技术方案结合电信告警特点和数据挖掘算法，有效整合告警码，告警位置，时间顺序，发生次数的方式，提出了利用矩阵进行存储告警多个维度的信息，高效快速地挖掘出告警间的关联关系，从而提升运维效率。

Description

告警相关性数据挖掘方法和装置 技术领域
本发明涉及告警相关性数据挖掘技术领域，尤其涉及告警相关性数据挖掘方法和装置。
背景技术
现代电信网络管理的主要任务是对网络进行实时监控，确保电信网络高效、可靠、经济和安全的运行。随着电信技术迅猛发展，电信网络每天可能有上百万次的告警量，而在这海量告警当中蕴含了大量信息，如告警时间，级别，设备，区域的分布情况，每个告警生命周期的分布情况，以及告警与告警间的内在关系，如何从海量告警数据中快速查找电信网络中的告警相关性信息，帮助网络管理人员处理网络故障，是一个亟待解决的问题。
发明内容
本发明的主要目的在于提供一种告警相关性数据挖掘方法和装置，旨在解决从海量告警数据中快速查找电信网络中的告警相关性信息的问题。
为解决上述问题，采用如下技术方案：
一种告警相关性数据挖掘方法，该方法包括以下步骤：
获取设定范围的告警数据，从所述告警数据中提取告警码、站点ID和设备ID；
根据提取的所述告警码、所述站点ID和所述设备ID，生成矩阵，根据所生成的矩阵获取告警发生频度、告警间距离和连接强度；
根据所述告警发生频度和所述告警间距离，获取告警群体聚类集合；
根据所述告警群体聚类集合和所述连接强度，挖掘出频繁路径。
可选地，所述设定范围包括设定时间和设定设备；
所述获取设定范围的告警数据，从所述告警数据中提取告警码、站点ID和设备ID的步骤包括：
获取设定时间和设定设备的告警数据，从所述告警数据中提取所述告警码、所述站点ID和所述设备ID。
可选地，所述矩阵包括事务矩阵和遍历矩阵；
所述根据提取的所述告警码、所述站点ID和所述设备ID，生成矩阵，根据所生成的矩阵获取告警发生频度、告警间距离和连接强度的步骤包括：
以所述告警码为行，所述设备ID或所述站点ID为列生成所述事务矩阵；以告警码为行，告警码为列生成所述遍历矩阵。
可选地，所述根据所述告警发生频度和所述告警间距离，获取告警群体聚类集合的步骤包括：
将所述告警发生频度和预设的频度阈值进行比较，筛选出大于或等于预设的频度阈值的告警码；
将筛选出的大于或等于预设的频度阈值的告警码的告警间距离和预设的距离阈值进行比较，筛选出小于预设的距离阈值时的告警码；
对所述筛选出的告警码按照距离进行合并，获得告警群体聚类集合。
可选地，所述根据所述告警群体聚类集合和所述连接强度，挖掘出频繁路径的步骤包括：
将所述告警群体聚类集合的所述连接强度和预设的连接强度阈值进行比较，筛选出大于或等于预设的连接强度阈值的告警码，对筛选后的相关联的告警码进行路径合并，得出频繁路径。
一种告警相关性数据挖掘装置，包括提取模块、生成模块、获取模块和挖掘模块，其中：
所述提取模块设置成：获取设定范围的告警数据，从所述告警数据中提取告警码、站点ID和设备ID；
所述生成模块设置成：根据提取的所述告警码、所述站点ID和所述设备ID，生成矩阵，根据所生成的矩阵获取告警发生频度、告警间距离和连接强度；
所述获取模块设置成：根据所述告警发生频度和所述告警间距离，获取告警群体聚类集合；
所述挖掘模块设置成：根据所述告警群体聚类集合和所述连接强度，挖掘出频繁路径。
可选地，所述提取模块设置成按照如下方式获取设定范围的告警数据，从所述告警数据中提取告警码、站点ID和设备ID：
获取设定时间和设定设备的告警数据，提取所述告警码、所述站点ID和所述设备ID。
可选地，所述生成模块设置成按照如下方式根据提取的所述告警码、所述站点ID和所述设备ID，生成矩阵：
以所述告警码为行，所述设备ID或所述站点ID为列生成事务矩阵；以所述告警码为行，所述告警码为列建立遍历矩阵。
可选地，所述获取模块包括频度比较单元、距离比较单元和合并单元，其中：
所述频度比较单元设置成：将所述告警发生频度和预设的频度阈值进行比较，筛选出大于或等于预设的频度阈值的告警码；
所述距离比较单元设置成：将所述告警间距离和预设的距离阈值进行比较，筛选出小于预设的距离阈值时的告警码；
所述合并单元设置成：对所述筛选出的告警码按照距离进行合并，获得 告警群体聚类集合。
可选地，所述挖掘模块设置成按照如下方式根据所述告警群体聚类集合和所述连接强度，挖掘出频繁路径：
将所述告警群体聚类集合的所述连接强度和预设的连接强度阈值进行比较，筛选出大于或等于预设的连接强度阈值的告警码，对筛选后的相关联的告警码进行路径合并，得出频繁路径。
一种计算机程序，包括程序指令，当该程序指令被计算机执行时，使得该计算机可执行上述任意的告警相关性数据挖掘方法。
一种载有上述计算机程序的载体。
本发明实施例提供的基于频繁路径的告警相关性数据挖掘方法，通过获取设定范围的告警数据，提取告警码、站点ID和设备ID；根据提取的所述告警码、所述站点ID和所述设备ID，生成矩阵，获取告警发生频度、告警间距离和连接强度；根据所述告警发生频度和所述告警间距离，获取告警群体聚类集合；根据所述告警群体聚类集合和所述连接强度，挖掘出频繁路径。本发明实施例结合电信告警特点和数据挖掘算法，有效整合告警码，告警位置，时间顺序，发生次数的方式，提出了利用矩阵进行存储告警多个维度的信息，高效快速地挖掘出告警间的关联关系，从而提升运维效率。
附图概述
图1为本发明第一实施例的告警相关性数据挖掘方法流程示意图；
图2为本发明第二实施例的告警相关性数据挖掘方法流程示意图；
图3为图1中所述根据所述告警发生频度和所述告警间距离，获取告警 群体聚类集合的步骤的细化流程示意图；
图4为本发明第三实施例的告警相关性数据挖掘方法流程示意图；
图5为本发明实施例的告警相关性数据挖掘装置功能模块示意图；
图6为图5中获取模块的功能模块示意图。
本发明目的的实现、功能特点及优点将结合实施例，参照附图做进一步说明。
本发明的较佳实施方式
应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。
本发明实施例提供一种告警相关性数据挖掘方法，参照图1，图1为本发明第一实施例的告警相关性数据挖掘方法流程示意图，在第一实施例中，本发明实施例提供的告警相关性数据挖掘方法，包括以下步骤：
步骤S100、获取设定范围的告警数据，提取告警码、站点ID和设备ID。
告警相关性数据挖掘装置获取设定范围的告警数据，其中，设定范围可以是设定的具体时间段，也可以是设定的具体某一类型的设备，从设定范围的告警数据中提取相应的告警码、站点ID和设备ID等信息。
步骤S200、根据提取的所述告警码、所述站点ID和所述设备ID，生成矩阵，获取告警发生频度、告警间距离和连接强度。
告警相关性数据挖掘装置根据提取的告警码、站点ID和设备ID，生成相应的矩阵，其中，生成的矩阵包括事务矩阵和遍历矩阵，以告警码为行，设备ID或者站点ID为列，得到以设备ID或者站点ID为基础的事务矩阵如下所示：
Figure PCTCN2014091688-appb-000001
遍历矩阵以告警码为行，告警码为列，形成告警码-告警码矩阵，以告警 码为基础，元素aij表示所有设备中，先发生告警，在时间窗口范围内顺序发生aj的次数，且中间无告警发生。
Figure PCTCN2014091688-appb-000002
现以事务矩阵为例进行阐述，其中，hij为第j个设备发生告警i的次数，其中，每个行向量表示所有设备实际发生告警i的情况，因此行向量代表了告警的组成，又蕴含了设备的告警发生模式；而列向量代表了不同的设备，也勾勒出设备的个性化的特征，那么通过度量行向量的相似性，就能得到相关的告警群体聚类集合，进一步分析可以得到设备固有的发生模式，即频繁路径。
从生成的矩阵中，获取相应的告警发生频度、告警间距离和连接强度。其中，告警发生频度是在指定时间范围内，设定类型设备发生的所有告警中，告警A发生次数的总和。连接强度是在指定时间范围内，相同设备类型或相同站点下的不同设备下的所有告警范围内，某设备实际发生告警Ai，在时间窗口内接连顺序发生告警Aj的次数总和，称为Ai和Aj间的连接强度，在本实施例中，通过遍历矩阵来记录Ai和Aj间的连接强度即遍历矩阵中A的Aij值。告警间距离从设备ID与告警码矩阵中抽取两行X，Y。其中若Xi(或Yi)>0，令Xi(或Yi)＝1，于是X，Y间的页面距离Hd(X，Y)定义为Hd(X，Y)＝(Xi＝1)。
步骤S300、根据所述告警发生频度和所述告警间距离，获取告警群体聚类集合。
告警相关性数据挖掘装置根据获取的告警发生频度和所述告警间距离和预设的告警发生频度和距离阈值进行比较，筛选出符合要求的告警码，并对筛选后的告警码按照距离进行合并，获得告警群体聚类集合。
步骤S400、根据所述告警群体聚类集合和所述连接强度，挖掘出频繁路径。
告警相关性数据挖掘装置根据获取的告警群体聚类集合和连接强度，与预设的连接强度阈值进行比较，筛选出大于或等于预设的连接强度阈值的告警码，并对筛选后的告警码进行相关联处理后，进行路径合并，得出频繁路 径。
本实施例提供的告警相关性数据挖掘方法，结合电信告警特点和数据挖掘算法，有效整合告警码，告警位置，时间顺序，发生次数的方式，提出了利用矩阵进行存储告警多个维度的信息，高效快速地挖掘出告警间的关联关系，从而提升运维效率。
可选地，所述方法可以是基于频繁路径的，也可以是基于其他信息的，只要能解决本发明的技术问题都可以应用上述方法。
进一步参照图2，图2为本发明第二实施例的基于频繁路径的告警相关性数据挖掘方法流程示意图，在第一实施例的基础上，所述步骤S100包括：
步骤S100A、获取设定时间和设定设备的告警数据，提取所述告警码、所述站点ID和所述设备ID。
基于频繁路径的告警相关性数据挖掘装置获取设定时间段内和设定类型设备的告警数据，并从中提取告警码、站点ID和设备ID等信息。
进一步参照图3，本实施例提供的基于频繁路径的告警相关性数据挖掘方法，所述步骤S300包括：
步骤S310、将所述告警发生频度和预设的频度阈值进行比较，筛选出大于或等于预设的频度阈值的告警码。
基于频繁路径的告警相关性数据挖掘装置将获取的告警发生频度和预设的频度阈值进行比较，从中筛选出大于或等于预设的频度阈值的告警码。
步骤S320、将所述告警间距离和预设的距离阈值进行比较，筛选出小于预设的距离阈值时的告警码。
基于频繁路径的告警相关性数据挖掘装置经过第一次筛选后，再次将告警间距离和预设的距离阈值进行比较，筛选出小于预设的距离阈值时的告警码。
步骤S330、对所述筛选出的告警码按照距离进行合并，获得告警群体聚类集合。
基于频繁路径的告警相关性数据挖掘装置将两次筛选后获得的告警码按照距离进行合并，获得告警群体聚类集合。下面举例对说明：
在事务矩阵中，将行的告警码标识为(alarm-1，alarm-2，alarm-3，alarm-4， alarm-5，alarm-6)，对列的设备ID标识为(device-1，device-2，device-3，device-4，device-5，devic-6)；
Figure PCTCN2014091688-appb-000003
经过计算得到所有告警间的发生频度alarm-1～alarm-6：(3，1，6，6，5，9)，设距离阈值等于4，找出所有发生频度大于4的告警，则频繁告警集为{alarm-3，alarm-4，alarm-5，alarm-6}，抽取对应的矩阵并把非0值设为1：
Figure PCTCN2014091688-appb-000004
计算频繁页面间的距离：
d(alarm-3，alarm-4)＝1；
d(alarm-3，alarm-5)＝3；
d(alarm-3，alarm-6)＝1；
d(alarm-4，alarm-5)＝2；
d(alarm-4，alarm-6)＝0；
d(alarm-5，alarm-6)＝0；
设置距离阈值等于2，筛选出距离小于2的距离并进行合并，得出2个集合：
一个为d(alarm-3，alarm-4)＝1；d(alarm-3，alarm-6)＝1；得到告警集(alarm-3，alarm-4，alarm-6)。
另一个为d(alarm-4，alarm-6)＝0；d(alarm-5，alarm-6)＝0；得到告警集(alarm-4,alarm-5，alarm-6)。
进一步参照图4，本实施例提供的基于频繁路径的告警相关性数据挖掘方法，所述步骤S400包括：
步骤S400A、将所述告警群体聚类集合的所述连接强度和预设的连接强度阈值进行比较，筛选出大于或等于预设的连接强度阈值的告警码，对筛选后的相关联的告警码进行路径合并，得出频繁路径。
基于频繁路径的告警相关性数据挖掘装置将告警群体聚类集合的连接强度和预设的连接强度阈值进行比较，筛选出大于或等于预设的连接强度阈值的告警码，对筛选后的相关联的告警码进行路径合并，得出频繁路径。下面举例进行说明：
基于频繁路径的告警相关性数据挖掘装置得到告警群体聚类后，开始进行路径挖掘工作，假定聚类集合为{alarm-1，alarm-2......alarm-n}，从遍历矩阵中抽取alarm-1，alarm-2......alarm-n对应的行和列，组成矩阵N[n][n],在矩阵N中，找出所有的N[i][j]大于或等于连接强度阈值项，若N[i][j]大于或等于连接强度阈值项,则认为(alarm-i，alarm-j)为频繁路径，将所有长度为2的频繁路径进行合并，得到长度为3的频繁路径，直到不能合并为止，这样便得出频繁路径。
具体地，会话矩阵对应的遍历矩阵如下：
Figure PCTCN2014091688-appb-000005
Figure PCTCN2014091688-appb-000006
Figure PCTCN2014091688-appb-000007
设连接强度阈值等于3，从N-1筛选出连接强度大于或等于3的频繁路径{<alarm-3，alamr-4>}；从N-2中得到连接强度大于或等于3的频繁路径{<alarm-4，alarm-5>，<alarm-5，alarm-6>}合并后为{<alarm-4，alarm-5，alarm-6>}。从而获得频繁路径{<alarm-3，alarm-4>，<alarm-4，alarm-5，alarm-6>}。
从而告警间的固有发生模式通过频繁路径被挖掘出来，基于频繁路径的告警相关性数据挖掘装置可以根据挖掘的固有模式进行相关性规则的设定，如当告警alarm-4发生后，根据告警固有发生模式判断，alarm-5，alarm-6会在时间窗口内后继发生，采用相关性规则可以将alarm-4设置为主告警，alarm-5，alarm-6设置为次要告警。这样既可以减少告警量，也可以方便运维人员分析根源告警。
如图5所示，本发明实施例进一步提供一种告警相关性数据挖掘装置，所述基于频繁路径的告警相关性数据挖掘装置包括：
提取模块10，设置成：获取设定范围的告警数据，提取告警码、站点ID和设备ID；
生成模块20，设置成：根据提取的所述告警码、所述站点ID和所述设备ID，生成矩阵，获取告警发生频度、告警间距离和连接强度；
获取模块30，设置成：根据所述告警发生频度和所述告警间距离，获取告警群体聚类集合；
挖掘模块40，设置成：根据所述告警群体聚类集合和所述连接强度，挖掘出频繁路径。
基于频繁路径的告警相关性数据挖掘装置的提取模块10获取设定范围的告警数据，其中，设定范围可以是设定的具体时间段，也可以是设定的具体某一类型的设备，从设定范围的告警数据中提取相应的告警码、站点ID和设备ID等信息。
基于频繁路径的告警相关性数据挖掘装置的生成模块20根据提取的告警码、站点ID和设备ID，生成相应的矩阵，其中，生成的矩阵包括事务矩阵和遍历矩阵，其中，生成的矩阵包括事务矩阵和遍历矩阵，以告警码为行，设备ID或者站点ID为列，得到以设备ID或者站点ID为基础的事务矩阵如下所示：
Figure PCTCN2014091688-appb-000008
遍历矩阵以告警码为行，告警码为列，形成告警码-告警码矩阵，以告警码为基础，元素aij表示所有设备中，先发生告警ai，在时间窗口范围内顺序发生aj的次数，且中间无告警发生。
Figure PCTCN2014091688-appb-000009
现以事务矩阵为例进行阐述，其中，hij为第j个设备发生告警i的次数，其中，每个行向量表示所有设备实际发生告警i的情况，因此行向量代表了告警的组成，又蕴含了设备的告警发生模式；而列向量代表了不同的设备，也勾勒出设备的个性化的特征，那么通过度量行向量的相似性，就能得到相关的告警群体聚类集合，进一步分析可以得到设备固有的发生模式，即频繁路径。
从生成的矩阵中，获取相应的告警发生频度、告警间距离和连接强度。其中，告警发生频度是在指定时间范围内，设定类型设备发生的所有告警中，告警A发生次数的总和。连接强度是在指定时间范围内，相同设备类型或相 同站点下的不同设备下的所有告警范围内，某设备实际发生告警Ai，在时间窗口内接连顺序发生告警Aj的次数总和，称为Ai和Aj间的连接强度，在本实施例中，通过遍历矩阵来记录Ai和Aj间的连接强度即遍历矩阵中A的Aij值。告警间距离从设备ID与告警码矩阵中抽取两行X，Y。其中若Xi(或Yi)>0，令Xi(或Yi)＝1，于是X，Y间的页面距离Hd(X，Y)定义为Hd(X，Y)＝(Xi＝1)。
基于频繁路径的告警相关性数据挖掘装置的获取模块30根据获取的告警发生频度和所述告警间距离和预设的告警发生频度和距离阈值进行比较，筛选出符合要求的告警码，并对筛选后的告警码按照距离进行合并，获得告警群体聚类集合。
基于频繁路径的告警相关性数据挖掘装置的挖掘模块40根据获取的告警群体聚类集合和连接强度，与预设的连接强度阈值进行比较，筛选出大于或等于预设的连接强度阈值的告警码，并对筛选后的告警码进行相关联处理后，进行路径合并，得出频繁路径。
本实施例提供的基于频繁路径的告警相关性数据挖掘装置，结合电信告警特点和数据挖掘算法，有效整合告警码，告警位置，时间顺序，发生次数的方式，提出了利用矩阵进行存储告警多个维度的信息，高效快速地挖掘出告警间的关联关系，从而提升运维效率。
进一步参见图5，本实施例提供的告警相关性数据挖掘装置，所述提取模块10，还设置成：获取设定时间和设定设备的告警数据，提取所述告警码、所述站点ID和所述设备ID。
告警相关性数据挖掘装置的提取模块10获取设定时间段内和设定类型设备的告警数据，并从中提取告警码、站点ID和设备ID等信息。
如图6所示，本实施例提供的告警相关性数据挖掘装置，所述获取模块30包括：
频度比较单元31，设置成：将所述告警发生频度和预设的频度阈值进行比较，筛选出大于或等于预设的频度阈值的告警码；
距离比较单元32，设置成：将所述告警间距离和预设的距离阈值进行比较，筛选出小于预设的距离阈值时的告警码；
合并单元33，设置成：对所述筛选出的告警码按照距离进行合并，获得告警群体聚类集合。
告警相关性数据挖掘装置将获取的告警发生频度和预设的频度阈值进行比较，从中筛选出大于或等于预设的频度阈值的告警码。
告警相关性数据挖掘装置经过第一次筛选后，再次将告警间距离和预设的距离阈值进行比较，筛选出小于预设的距离阈值时的告警码。
告警相关性数据挖掘装置将两次筛选后获得的告警码按照距离进行合并，获得告警群体聚类集合。下面举例对说明：
在事务矩阵中，将行的告警码标识为(alarm-1，alarm-2，alarm-3，alarm-4，alarm-5，alarm-6)，对列的设备ID标识为(device-1，device-2，device-3，device-4，device-5，devic-6)；
Figure PCTCN2014091688-appb-000010
经过计算得到所有告警间的发生频度alarm-1～alarm-6：(3，1，6，6，5，9)，设距离阈值等于4，找出所有发生频度大于4的告警，则频繁告警集为{alarm-3，alarm-4，alarm-5，alarm-6}，抽取对应的矩阵并把非0值设为1：
Figure PCTCN2014091688-appb-000011
计算频繁页面间的距离：
d(alarm-3，alarm-4)＝1；
d(alarm-3，alarm-5)＝3；
d(alarm-3，alarm-6)＝1；
d(alarm-4，alarm-5)＝2；
d(alarm-4，alarm-6)＝0；
d(alarm-5，alarm-6)＝0；
设置距离阈值等于2，筛选出距离小于2的距离并进行合并，得出2个集合：
一个为d(alarm-3，alarm-4)＝1；d(alarm-3，alarm-6)＝1；得到告警集(alarm-3，alarm-4，alarm-6)。
另一个为d(alarm-4，alarm-6)＝0；d(alarm-5，alarm-6)＝0；得到告警集(alarm-4,alarm-5，alarm-6)。
进一步参见图5，所述挖掘模块40，还设置成：将所述告警群体聚类集合的所述连接强度和预设的连接强度阈值进行比较，筛选出大于或等于预设的连接强度阈值的告警码，对筛选后的相关联的告警码进行路径合并，得出频繁路径。
告警相关性数据挖掘装置的挖掘模块40将告警群体聚类集合的连接强度和预设的连接强度阈值进行比较，筛选出大于或等于预设的连接强度阈值的告警码，对筛选后的相关联的告警码进行路径合并，得出频繁路径。下面举例进行说明：
告警相关性数据挖掘装置的挖掘模块40得到告警群体聚类后，开始进行路径挖掘工作，假定聚类集合为{alarm-1，alarm-2……alarm-n}，从遍历矩阵中抽取alarm-1，alarm-2……alarm-n对应的行和列，组成矩阵N[n][n],在矩阵N中，找出所有的N[i][j]大于或等于连接强度阈值项，若N[i][j]大于或等于连接强度阈值项,则认为(alarm-i，alarm-j)为频繁路径，将所有长度为2的频繁路径进行合并，得到长度为3的频繁路径，直到不能合并为止，这样便得出频繁路径。
具体地，会话矩阵对应的遍历矩阵如下：
根据步骤S300示例的结
Figure PCTCN2014091688-appb-000012
果可知，{alarm-3，alarm-4，alarm-6}，和{alarm-4，alarm-5，alarm-6}，通过抽取对应的行与列建立新矩阵如下：
Figure PCTCN2014091688-appb-000013
Figure PCTCN2014091688-appb-000014
设连接强度阈值等于3，从N-1筛选出连接强度大于或等于3的频繁路径{<alarm-3，alamr-4>}；从N-2中得到连接强度大于或等于3的频繁路径{<alarm-4，alarm-5>，<alarm-5，alarm-6>}合并后为{<alarm-4，alarm-5，alarm-6>}。从而获得频繁路径{<alarm-3，alarm-4>，<alarm-4，alarm-5，alarm-6>}。
从而告警间的固有发生模式通过频繁路径被挖掘出来，告警相关性数据挖掘装置可以根据挖掘的固有模式进行相关性规则的设定，如当告警alarm-4发生后，根据告警固有发生模式判断，alarm-5，alarm-6会在时间窗口内后继发生，采用相关性规则可以将alarm-4设置为主告警，alarm-5，alarm-6设置为次要告警。这样既可以减少告警量，也可以方便运维人员分析根源告警。
可选地，本发明的装置也可以是基于频繁路径的，也可以是基于其他信息的，只要能解决本发明的技术问题都可以应用上述装置。
本发明实施例还公开了一种计算机程序，包括程序指令，当该程序指令被计算机执行时，使得该计算机可执行上述任意的告警相关性数据挖掘方法。
一种载有上述计算机程序的载体。
以上仅为本发明的优选实施例，并非因此限制本发明的专利范围，凡是 利用本发明说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本发明的专利保护范围内。
工业实用性
本发明实施例提供的告警相关性数据挖掘方法，通过获取设定范围的告警数据，提取告警码、站点ID和设备ID；根据提取的所述告警码、所述站点ID和所述设备ID，生成矩阵，获取告警发生频度、告警间距离和连接强度；根据所述告警发生频度和所述告警间距离，获取告警群体聚类集合；根据所述告警群体聚类集合和所述连接强度，挖掘出频繁路径。本发明实施例结合电信告警特点和数据挖掘算法，有效整合告警码，告警位置，时间顺序，发生次数的方式，提出了利用矩阵进行存储告警多个维度的信息，高效快速地挖掘出告警间的关联关系，从而提升运维效率。因此本发明具有很强的工业实用性。

Claims (12)

  1. 一种告警相关性数据挖掘方法，该方法包括以下步骤：
    获取设定范围的告警数据，从所述告警数据中提取告警码、站点ID和设备ID；
    根据提取的所述告警码、所述站点ID和所述设备ID，生成矩阵，根据所生成的矩阵获取告警发生频度、告警间距离和连接强度；
    根据所述告警发生频度和所述告警间距离，获取告警群体聚类集合；
    根据所述告警群体聚类集合和所述连接强度，挖掘出频繁路径。
  2. 如权利要求1所述的告警相关性数据挖掘方法，其中：
    所述设定范围包括设定时间和设定设备；
    所述获取设定范围的告警数据，从所述告警数据中提取告警码、站点ID和设备ID的步骤包括：
    获取设定时间和设定设备的告警数据，从所述告警数据中提取所述告警码、所述站点ID和所述设备ID。
  3. 如权利要求1所述的告警相关性数据挖掘方法，其中：
    所述矩阵包括事务矩阵和遍历矩阵；
    所述根据提取的所述告警码、所述站点ID和所述设备ID，生成矩阵，根据所生成的矩阵获取告警发生频度、告警间距离和连接强度的步骤包括：
    以所述告警码为行，所述设备ID或所述站点ID为列生成所述事务矩阵；以告警码为行，告警码为列生成所述遍历矩阵。
  4. 如权利要求1所述的告警相关性数据挖掘方法，其中，所述根据所述告警发生频度和所述告警间距离，获取告警群体聚类集合的步骤包括：
    将所述告警发生频度和预设的频度阈值进行比较，筛选出大于或等于预设的频度阈值的告警码；
    将筛选出的大于或等于预设的频度阈值的告警码的告警间距离和预设的距离阈值进行比较，筛选出小于预设的距离阈值时的告警码；
    对所述筛选出的告警码按照距离进行合并，获得告警群体聚类集合。
  5. 如权利要求1至4中任一项所述的告警相关性数据挖掘方法，其中，所述根据所述告警群体聚类集合和所述连接强度，挖掘出频繁路径的步骤包括：
    将所述告警群体聚类集合的所述连接强度和预设的连接强度阈值进行比较，筛选出大于或等于预设的连接强度阈值的告警码，对筛选后的相关联的告警码进行路径合并，得出频繁路径。
  6. 一种告警相关性数据挖掘装置，包括提取模块、生成模块、获取模块和挖掘模块，其中：
    所述提取模块设置成：获取设定范围的告警数据，从所述告警数据中提取告警码、站点ID和设备ID；
    所述生成模块设置成：根据提取的所述告警码、所述站点ID和所述设备ID，生成矩阵，根据所生成的矩阵获取告警发生频度、告警间距离和连接强度；
    所述获取模块设置成：根据所述告警发生频度和所述告警间距离，获取告警群体聚类集合；
    所述挖掘模块设置成：根据所述告警群体聚类集合和所述连接强度，挖掘出频繁路径。
  7. 如权利要求6所述的告警相关性数据挖掘方法，其中，所述提取模块设置成按照如下方式获取设定范围的告警数据，从所述告警数据中提取告警码、站点ID和设备ID：
    获取设定时间和设定设备的告警数据，提取所述告警码、所述站点ID和所述设备ID。
  8. 如权利要求6所述的告警相关性数据挖掘装置，其中，所述生成模块设置成按照如下方式根据提取的所述告警码、所述站点ID和所述设备ID，生成矩阵：
    以所述告警码为行，所述设备ID或所述站点ID为列生成事务矩阵；以 所述告警码为行，所述告警码为列建立遍历矩阵。
  9. 如权利要求6所述的告警相关性数据挖掘方法，其中，所述获取模块包括频度比较单元、距离比较单元和合并单元，其中：
    所述频度比较单元设置成：将所述告警发生频度和预设的频度阈值进行比较，筛选出大于或等于预设的频度阈值的告警码；
    所述距离比较单元设置成：将所述告警间距离和预设的距离阈值进行比较，筛选出小于预设的距离阈值时的告警码；
    所述合并单元设置成：对所述筛选出的告警码按照距离进行合并，获得告警群体聚类集合。
  10. 如权利要求6至9中任一项所述的告警相关性数据挖掘方法，其中，所述挖掘模块设置成按照如下方式根据所述告警群体聚类集合和所述连接强度，挖掘出频繁路径：
    将所述告警群体聚类集合的所述连接强度和预设的连接强度阈值进行比较，筛选出大于或等于预设的连接强度阈值的告警码，对筛选后的相关联的告警码进行路径合并，得出频繁路径。
  11. 一种计算机程序，包括程序指令，当该程序指令被计算机执行时，使得该计算机可执行权利要求1-5中任一项所述的告警相关性数据挖掘方法。
  12. 一种载有权利要求11所述计算机程序的载体。
PCT/CN2014/091688 2014-10-14 2014-11-19 告警相关性数据挖掘方法和装置 WO2015131558A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP14884768.4A EP3208970A4 (en) 2014-10-14 2014-11-19 Alarm correlation data mining method and device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410542079.0 2014-10-14
CN201410542079.0A CN105577403A (zh) 2014-10-14 2014-10-14 基于频繁路径的告警相关性数据挖掘方法和装置

Publications (1)

Publication Number Publication Date
WO2015131558A1 true WO2015131558A1 (zh) 2015-09-11

Family

ID=54054440

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/091688 WO2015131558A1 (zh) 2014-10-14 2014-11-19 告警相关性数据挖掘方法和装置

Country Status (3)

Country Link
EP (1) EP3208970A4 (zh)
CN (1) CN105577403A (zh)
WO (1) WO2015131558A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113472582A (zh) * 2020-07-15 2021-10-01 北京沃东天骏信息技术有限公司 用于信息技术监控中的警报关联和警报聚合的系统和方法
CN113839806A (zh) * 2021-08-12 2021-12-24 中国地质大学（武汉） 基于时滞关联检测的根源报警分析方法和存储介质
CN115225453A (zh) * 2022-06-09 2022-10-21 广东省智能网联汽车创新中心有限公司 一种车辆告警管理方法与系统

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110401567B (zh) * 2019-07-25 2022-04-26 中国工商银行股份有限公司 告警数据的处理方法、装置、计算设备、介质
CN110391936B (zh) * 2019-07-25 2022-03-01 长沙学院 一种基于时序性告警的聚类方法
CN110457185B (zh) * 2019-07-25 2024-01-23 北京奇艺世纪科技有限公司 一种异常报警方法、装置及电子设备
CN111352808B (zh) * 2020-03-03 2023-04-25 腾讯云计算（北京）有限责任公司 告警数据处理方法、装置、设备及存储介质
CN112685393B (zh) * 2020-12-24 2022-05-13 国网福建省电力有限公司 一种用于电力通信网的智能化告警归并方法及系统
WO2024157120A1 (en) * 2023-01-25 2024-08-02 Telefonaktiebolaget Lm Ericsson (Publ) Detection and isolation of faults in multi-domain communication networks based on frequent patterns

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101277218A (zh) * 2008-05-04 2008-10-01 中兴通讯股份有限公司 一种网络告警的动态分析系统和方法
CN101577636A (zh) * 2009-06-05 2009-11-11 中兴通讯股份有限公司 告警的相关性矩阵确定、告警相关性分析方法与装置
CN101808015A (zh) * 2009-02-18 2010-08-18 普天信息技术研究院有限公司 一种告警信息相关性的分析方法和装置

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050091356A1 (en) * 2003-10-24 2005-04-28 Matthew Izzo Method and machine-readable medium for using matrices to automatically analyze network events and objects
CN101605045A (zh) * 2008-06-10 2009-12-16 中兴通讯股份有限公司 一种告警通知消息的上报方法
US8645966B2 (en) * 2010-03-11 2014-02-04 International Business Machines Corporation Managing resource allocation and configuration of model building components of data analysis applications
CN102685221B (zh) * 2012-04-29 2014-12-03 华北电力大学（保定） 一种状态监测数据的分布式存储与并行挖掘方法
CN103873463A (zh) * 2014-02-26 2014-06-18 北京优炫软件股份有限公司 多级过滤防火墙系统及多级过滤方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101277218A (zh) * 2008-05-04 2008-10-01 中兴通讯股份有限公司 一种网络告警的动态分析系统和方法
CN101808015A (zh) * 2009-02-18 2010-08-18 普天信息技术研究院有限公司 一种告警信息相关性的分析方法和装置
CN101577636A (zh) * 2009-06-05 2009-11-11 中兴通讯股份有限公司 告警的相关性矩阵确定、告警相关性分析方法与装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3208970A4 *

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113472582A (zh) * 2020-07-15 2021-10-01 北京沃东天骏信息技术有限公司 用于信息技术监控中的警报关联和警报聚合的系统和方法
CN113839806A (zh) * 2021-08-12 2021-12-24 中国地质大学（武汉） 基于时滞关联检测的根源报警分析方法和存储介质
CN113839806B (zh) * 2021-08-12 2023-06-09 中国地质大学（武汉） 基于时滞关联检测的根源报警分析方法和存储介质
CN115225453A (zh) * 2022-06-09 2022-10-21 广东省智能网联汽车创新中心有限公司 一种车辆告警管理方法与系统
CN115225453B (zh) * 2022-06-09 2024-03-01 广东省智能网联汽车创新中心有限公司 一种车辆告警管理方法与系统

Also Published As

Publication number Publication date
EP3208970A4 (en) 2018-05-23
CN105577403A (zh) 2016-05-11
EP3208970A1 (en) 2017-08-23

Similar Documents

Publication Publication Date Title
WO2015131558A1 (zh) 告警相关性数据挖掘方法和装置
CN106375339B (zh) 基于事件滑动窗口的攻击模式检测方法
CN106415507B (zh) 日志分析装置、攻击检测装置、攻击检测方法以及程序
CN107590250A (zh) 一种时空轨迹生成方法及装置
US20140207820A1 (en) Method for parallel mining of temporal relations in large event file
Savage et al. Detection of money laundering groups: Supervised learning on small networks
CN104518905A (zh) 一种故障定位方法及装置
WO2019051042A1 (en) APPARATUS AND METHOD FOR REAL-TIME ANALYSIS, PREDICTION AND ABORIGINAL DATA BASE TRANSACTION LOG ACTIVITY REPORT
CN105893208A (zh) 基于隐半马尔可夫模型的云计算平台系统故障预测方法
CN104217004B (zh) 一种交易系统的数据库热点的监控方法及装置
CN113723452A (zh) 一种基于kpi聚类的大规模异常检测系统
Fu et al. Online temporal-spatial analysis for detection of critical events in cyber-physical systems
CN103942739A (zh) 建筑项目风险知识库的构建方法
CN115018456A (zh) 一种隐蔽工程跟踪审计的数据融合系统及其方法
Vu Deep Abnormality Detection in Video Data.
Han et al. BigST: Linear Complexity Spatio-Temporal Graph Neural Network for Traffic Forecasting on Large-Scale Road Networks
CN109308225A (zh) 一种虚拟机异常检测方法、装置、设备及存储介质
CN116074092A (zh) 一种基于异构图注意力网络的攻击场景重构系统
CN103136440B (zh) 数据处理方法和装置
CN105069158B (zh) 数据挖掘方法及系统
Ahmadi et al. Application of horizontal visibility graph as a robust measure of neurophysiological signals synchrony
CN108243058B (zh) 一种基于告警定位故障的方法和装置
CN103336800A (zh) 基于行为分析的指纹存储比对的方法
CN108829794A (zh) 基于区间图的告警分析方法
Kanhere et al. A methodology for outlier detection in audit logs for financial transactions

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14884768

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

REEP Request for entry into the european phase

Ref document number: 2014884768

Country of ref document: EP