WO2018059402A1 - 确定故障类型的方法和装置 - Google Patents

确定故障类型的方法和装置 Download PDF

Info

Publication number
WO2018059402A1
WO2018059402A1 PCT/CN2017/103506 CN2017103506W WO2018059402A1 WO 2018059402 A1 WO2018059402 A1 WO 2018059402A1 CN 2017103506 W CN2017103506 W CN 2017103506W WO 2018059402 A1 WO2018059402 A1 WO 2018059402A1
Authority
WO
WIPO (PCT)
Prior art keywords
sequence
fault
training data
user
data
Prior art date
Application number
PCT/CN2017/103506
Other languages
English (en)
French (fr)
Inventor
潘璐伽
赫彩凤
张建锋
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2018059402A1 publication Critical patent/WO2018059402A1/zh
Priority to US16/351,033 priority Critical patent/US11140021B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • H04L41/0636—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis based on a decision tree analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H04L41/145—Network analysis or design involving simulating, designing, planning or modelling of a network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/16—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks using machine learning or artificial intelligence
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/50—Network service management, e.g. ensuring proper service fulfilment according to agreements
    • H04L41/5003—Managing SLA; Interaction between SLA and QoS
    • H04L41/5019—Ensuring fulfilment of SLA
    • H04L41/5025—Ensuring fulfilment of SLA by proactively reacting to service quality change, e.g. by reconfiguration after service quality degradation or upgrade
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/50—Network service management, e.g. ensuring proper service fulfilment according to agreements
    • H04L41/5061—Network service management, e.g. ensuring proper service fulfilment according to agreements characterised by the interaction between service providers and their network customers, e.g. customer relationship management
    • H04L41/5067—Customer-centric QoS measurements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0852—Delays
    • H04L43/0864—Round trip delays

Definitions

  • the present application relates to the field of data processing and, more particularly, to a method and apparatus for determining the type of fault.
  • KPI Key Performance Indicator
  • KQI Key Quality Indicator
  • KPI The starting point of KPI is to measure the user's feelings from the perspective of the network, which does not fully reflect the quality of network services.
  • KPI system When using the KPI system to measure the quality of network services, it is often the case that the KPIs of the entire network equipment are in good condition, but user complaints are gradually increasing.
  • KQI was introduced into the quality evaluation system of network services.
  • KQI is a service quality parameter that is mainly proposed for different businesses and is close to the user experience.
  • the essence of KQI is the end-to-end quality of service for some key services, such as the smoothness of video services, clarity, and the synchronization of voice and video.
  • KQI has improved the quality of service for key businesses to a certain extent, but it still has some limitations. Its indicator granularity is coarse, and it has a fixed mode in setting, which makes it difficult to describe the user's service quality in response to the user's complex and varied use environment.
  • the complaint-handling method can bring a better network experience to the user, which enables the operator to solve the customer service problem and improve the efficiency and quality, and can save labor costs.
  • the complaint-handling method can help the engineer quickly locate the problem and solve the problem.
  • the existing solution is that the operator's customer service personnel can judge the fault type of the user based on the experience of the network, such as the network fault notification, the user's terminal usage information, the KPI, the KQI, etc., based on the current network.
  • the processing efficiency of this method mainly depends on the professional level of the customer service personnel, the accuracy of the processing results is not stable, and the experience of the customer service personnel is also limited. There may be a blind spot for the judgment of the problem.
  • the present application provides a method and apparatus for determining the type of fault that can quickly and inexpensively determine the type of fault that a user has caused a fault.
  • a method for determining a fault type comprising: performing online real-time calculation on running data generated by each user of a plurality of users in a preset period, obtaining the And setting a fault categorization request, where the fault categorization request is used to request a fault type that is determined by the target user before the target time, where the target user is the Determining, according to the fault classification request, the fault classification model and the running feature value of the target user in at least one of the preset periods, determining that the target user is before the target moment The type of failure of the generated fault, wherein the fault classification model is trained based on training data of a known fault type.
  • the method for determining the fault type in the first aspect is to calculate the running characteristic value of the running data generated by the user in real time online, and when the user complaint is received, match the running characteristic value with the fault classification model to determine the fault type of the user generating the fault,
  • the process is an online process with fast processing speed and low labor costs.
  • the performing, in real-time calculation, the running data generated by each user of the multiple users in a preset period, obtaining the The running characteristic value corresponding to the running data generated in the preset period includes: acquiring the running data generated by each user in the preset period, where the running data includes signaling surface running data and At least one of the user plane running data; determining, according to the running data, an operating data sequence, where the running data sequence includes a signaling running data sequence corresponding to the signaling plane running data and the user plane running data corresponding to The user runs at least one of the data sequence; and determines the running feature value corresponding to the running data according to the running data sequence and the sequence feature set.
  • the signaling plane running data and the user plane running data generated by the user in the network are captured, and the abnormal information included in the timing pattern of the two types of data may be used in the fault type.
  • the determination can improve the accuracy of determining the type of fault.
  • the method further includes: acquiring the training data, where the training data includes at least one of signaling plane training data and user plane training data. And determining, according to the training data, a training data sequence, where the training data sequence includes at least one of a signaling training data sequence corresponding to the signaling plane training data and a user training data sequence corresponding to the user plane training data. Determining, according to the training data sequence and the sequence feature set, a training feature value corresponding to the training data; determining the fault classification model according to the training feature value and a fault type corresponding to the training data.
  • the method further includes: acquiring the training data, where the training data includes signaling plane training data and a user At least one of the face training data; determining, according to the training data, a training data sequence, where the training data sequence includes a signaling training data sequence corresponding to the signaling plane training data and a user corresponding to the user plane training data Determining, according to the training data sequence and the sequence feature set, a training feature value corresponding to the training data; determining, according to the training feature value and a fault type corresponding to the training data, The fault classification model.
  • the sequence feature set includes at least one of a mining sequence feature set and a predefined sequence feature set.
  • the method when the sequence feature set includes the mining sequence feature set, the method further includes: The training data sequence is subjected to sequence mining calculation to obtain the mining sequence feature set.
  • the performing a sequence mining calculation on the training data sequence to obtain the mining sequence feature set includes: The training data sequence determines a plurality of training data sub-sequences; performing sequence mining calculation on the plurality of training data sub-sequences by using a sequence mining algorithm, and determining the mined training data sub-sequences as elements in the mining sequence feature set.
  • the sequence mining algorithm includes at least one of a decision tree algorithm and a mode search tree MBT algorithm.
  • the fault classification request and the fault classification model are Determining, by the target user, the fault characteristic type of the fault generated by the target user before the target moment in the at least one preset period of the target period, including: acquiring the target moment according to the target moment And the running feature values respectively corresponding to the target users in the plurality of preset periods; reconstructing the plurality of the running feature values to obtain the reconstructed reconstructed feature values; and the reconstructed feature values Performing feature matching with the fault classification model to determine a fault type of the fault generated by the target user before the target moment.
  • an apparatus for determining a fault type including a real-time feature computing module, a receiving module, and a fault classification module for implementing respective functions of the first aspect and various possible implementations of the first aspect.
  • Each module can be implemented by hardware or by software.
  • the means for determining the type of failure may also include an offline modeling module to implement the corresponding implementation.
  • an apparatus for determining a type of fault including a processor, a network interface, and a memory.
  • the memory can be used to store code executed by the processor.
  • the means for determining the type of fault may also include an output device or an output interface coupled to the output device for outputting the result of the fault classification.
  • sequence feature set is a collection of features that are capable of characterizing the type of fault.
  • FIG. 1 is a schematic flowchart of a method for determining a fault type according to an embodiment of the present application.
  • FIG. 2 is a schematic flowchart of a method for determining a fault type according to another embodiment of the present application.
  • FIG. 3 is a schematic diagram of a correspondence between a distribution of values of a field AVG_UL_RTT and a fault type that may correspond to it according to an embodiment of the present application.
  • FIG. 4 is a schematic flowchart of obtaining a sequence feature set of a signaling plane according to an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of obtaining a sequence feature set of a user plane according to an embodiment of the present application.
  • FIG. 6 is a schematic block diagram of an apparatus for determining a fault type according to an embodiment of the present application.
  • FIG. 7 is a schematic block diagram of an apparatus for determining a fault type according to another embodiment of the present application.
  • the existing methods for determining the type of the fault are mostly manual. Therefore, the embodiment of the present application provides a convenient and fast method for determining the fault type based on the online.
  • the method for determining the type of fault in the embodiment of the present application can accurately evaluate the network quality of a user who uses a network service [for example, using a Mobile Broadband (MBB) network], and can describe the characteristics of the user and the usage habits. User network quality.
  • the method for determining the type of fault in the embodiment of the present application can also quickly determine the type of fault that causes the network quality problem of the complaining user, and assist the customer service personnel to quickly solve the problem.
  • MBB Mobile Broadband
  • the method 100 of determining the type of failure of the embodiment of the present application may include the following steps as shown in FIG. 1.
  • S110 Perform online real-time calculation on the running data generated by each user of the plurality of users in a preset period, and obtain an operating characteristic value corresponding to the running data generated by each user in the preset period.
  • S120 Receive a fault classification request, where the fault classification request is used to request a fault type that determines a fault generated by the target user before the target time, and the target user is any one of the multiple users.
  • S130 Determine, according to the fault classification request, a fault type of the fault generated by the target user before the target moment, based on the fault classification model and the running feature value of the target user in at least one of the preset periods.
  • the fault classification model is obtained by training according to training data of a known fault type.
  • the method for determining the fault type in the embodiment of the present application may be as shown in FIG. 2 .
  • S110 shown in FIG. 1 can be considered as the real-time feature calculation process shown in FIG. 2.
  • the real-time feature calculation does not need to store the original data, only needs to store a small amount of feature value data, which can save storage space, and the real-time processing process can save end-to-end query time.
  • the S110 may include: acquiring the running data generated by each user in the preset period, where the running data includes at least one of signaling plane running data and user plane running data; Data, determining an operation data sequence, the operation data sequence including at least one of a signaling operation data sequence corresponding to the signaling plane operation data and a user operation data sequence corresponding to the user plane operation data; And a data sequence and a sequence feature set, and determining the running feature value corresponding to the running data.
  • the sequence feature set is a set of multiple features capable of characterizing the fault type.
  • the sequence feature set may be manually selected or preset according to experience, or may be multiple features that can be distinguished in the fault classification according to the method in the following embodiments of the present application. Collection.
  • each user will generate a large amount of operational data.
  • these operational data are stored in a detailed database.
  • the running data may include at least one of signaling plane running data and user plane running data. Therefore, the S110 captures the signaling plane running data and the user plane running data generated by the user in the network, and can use the abnormal information included in the timing pattern of the two types of data in determining the fault type. Improve the accuracy of determining the type of failure.
  • the method for determining the type of the fault in the embodiment of the present application may obtain the running data generated by each user in the most recent preset period from the detailed database by determining the real-time feature calculating module in the device of the fault type.
  • the device that determines the type of failure acquires operational data generated by each user within a preset period.
  • the preset period may be determined by the network system according to the computing power of the system or the operating data generated by the system, or may be set by the network administrator; the preset period may be a constant fixed value, or may be along with the network.
  • the environment is flexible, and the embodiment of the present application does not limit this. In a specific example, the preset period can be 5 minutes or 10 minutes.
  • the real-time feature computing module determines the running data sequence according to the running data.
  • the operational data may include at least one of signaling plane running data and user plane running data. Therefore, the determined running data sequence may also include at least one of a signaling running data sequence corresponding to the signaling plane running data and a user running data sequence corresponding to the user plane running data.
  • the real-time feature computing module may determine the running feature value corresponding to the running data according to the running data sequence and the sequence feature set.
  • the sequence feature set is used to describe the format of the feature and the rules for calculating the feature.
  • the sequence feature set can include at least one of a mining sequence feature set and a predefined sequence feature set.
  • the predefined sequence feature set may be an artificially predefined sequence feature set
  • the mining sequence feature set may be a sequence feature set learned by a machine through a mining algorithm, and the generation of the mining sequence feature set and specific content will be described in detail below. in particular.
  • the method for determining the fault type in the embodiment of the present application may further include: performing mining calculation on the training data sequence to obtain the mining sequence feature set.
  • the user's operational feature values shown in Table 1 include two parts, a predefined feature value and a mining sequence feature value.
  • the number 1-4 is a mining sequence feature value, wherein the numbers 1 and 2 are sequence feature values corresponding to the signaling operation data sequence, and the numbers 3 and 4 are sequence feature values corresponding to the user operation data sequence; the numbers 5 and 6 are Predefined sequence feature values. It should be understood that for different users and calculation cycles, the sequence feature values vary with the operational data.
  • the real-time feature calculation module stores the calculated running feature values corresponding to each preset period of each user in the running feature value database for use in the fault classification process.
  • the device for determining the fault type in the embodiment of the present application may receive a fault classification request that is input by the complaint user through a page or the like, or may be attended by a customer service personnel, and the customer service personnel input a fault classification request to the device that determines the fault type through the service page.
  • the fault classification request may include the user identifier of the complaint user and the failure time reflected by the complaint user.
  • the device that determines the fault type determines the user corresponding to the user identifier as the target user, and determines the target time according to the fault time for subsequent processing.
  • the process can also involve customer service personnel, and the customer service personnel input the target into the device that determines the fault type through the service page. User ID of the time and target user.
  • the S130 shown in FIG. 1 can be considered as the fault classification process shown in FIG. 2. Specifically, when the network quality is not good, the user can feedback the problem of poor network quality through the customer service web interface, the customer service application (APP) interface or the customer service phone.
  • the S130 may specifically include: acquiring, according to the target time, the running feature values respectively corresponding to the target users in the plurality of preset periods before the target time; and reconstructing the plurality of the running feature values Obtaining a reconstructed reconstructed feature value; performing matching on the reconstructed feature value with the fault classification model to determine a fault type of the fault generated by the target user before the target time.
  • the target time the running feature values corresponding to the target user in the plurality of preset periods before the target time are obtained.
  • the target time may be determined according to the failure time mentioned in the foregoing and the time period before and after.
  • the length of the time period for obtaining the running data can be obtained by the following method. For example, according to the target user's complaint, the failure time is 14:00 on May 26, 2016, and the failure time is determined as the target time.
  • the operation data is acquired, the user can be acquired on May 25, 2016 14: The operating data from 00 to 14:00 on May 26, 2016, the length of the time period is 24 hours.
  • the selection of the length of the time period can be adjusted depending on the application.
  • the target user corresponds to multiple running feature values in multiple preset periods, and reconstructs multiple running feature values to obtain the reconstructed reconstructed feature values.
  • the reconstruction process may be simply accumulating, merging or combining multiple running feature values, for example, accumulating the number of lost packets generated by multiple preset periods; or performing more complex operations on multiple running feature values.
  • the operation for example, takes a maximum value, filters by a preset rule, and the like, which is not limited by the embodiment of the present application.
  • the preset period of the online calculation running characteristic value is set to 5 minutes, and the user generates the operation within 24 hours.
  • the feature value has 288 records. After obtaining these 288 records, they need to be reconstructed into a reconstructed feature value.
  • the implementation of the present application may perform feature matching on the reconstructed feature value (obtained from multiple running feature values) or one running feature value and the fault classification model to determine the fault type of the fault generated by the target user.
  • the fault classification model may be pre-configured by the device, or may be obtained by training according to the training data of the known fault type. The specific process of obtaining the fault classification model is described in detail below. The process may be referred to as FIG. 2 .
  • the offline modeling process in the process can be performed by an offline modeling module in the system that determines the type of failure.
  • the offline modeling process can occur prior to steps S110 through S130 of the method 100 of determining the type of failure of the embodiment of the present application. That is, the method 100 may further include: acquiring the training data, the training data including at least one of signaling plane training data and user plane training data; determining, according to the training data, a training data sequence, the training data sequence The signaling plane runs at least one of a signaling training data sequence corresponding to the training and a user training data sequence corresponding to the user plane training data; and determining, according to the training data sequence and the sequence feature set, the training data a training feature value; determining the fault classification model according to the training feature value and a fault type corresponding to the training data.
  • the process of obtaining the training data may be as follows: obtaining a user ID of a batch of historical complaint users from the outside, the time and fault type of the faults generated by the complaint users are known, and the fault types are confirmed to be correct. According to the user ID and the failure time of the historical complaint user, the running data of the historical complaint user for a period of time before the failure time is extracted from the detailed database as the training data.
  • the training feature values are obtained based on the training data. This process is consistent with the process described above for obtaining operational eigenvalues based on operational data. Here, an example in which the training feature value is obtained based on the training data will be described.
  • the sequence feature set includes a predefined sequence feature set, it can be predefined based on the training data. Eigenvalues.
  • the elements of the predefined sequence feature set may include packet loss rate, transmission rate, average delay, and other indicators, and the like.
  • the predefined feature value may be obtained from the training data, and the training data may be pre-processed to generate the training data sequence, and the predefined feature value is extracted from the training data sequence, which is not limited in this embodiment of the present application.
  • the training data may be preprocessed to obtain a training data sequence.
  • the training data sequence may include at least one of a signaling training data sequence corresponding to the signaling plane training data and a user training data sequence corresponding to the user plane training data, according to the content included in the training data.
  • For the signaling plane training data fields such as a signaling type, a signaling state, and a network standard are selected from the signaling plane training data, and are listed in chronological order.
  • Table 2 shows the format of the signaling plane training data after the above fields are extracted.
  • Table 2 Format of the signaling plane training data after the field is extracted
  • the coding and recombination are performed in chronological order, that is, the data serialization processing is performed, and the signaling training data sequence 11000, 11000, 32017, 26100 is obtained.
  • a part of the field is selected from the user plane training data, and the format of the user plane training data after the extracted field shown in Table 3 is obtained.
  • Table 3 Format of user plane training data after extracting fields
  • FIG. 3 shows a schematic diagram of the correspondence between the distribution of the values of the fields AVG_UL_RTT and the types of faults that may correspond to them. According to the above correspondence, the values of AVG_UL_RTT can be classified into two categories: AVG_UL_RTT_High and AVG_UL_RTT_Low. According to this, the value of the numerical type of AVG_UL_RTT is converted into a transaction type.
  • the value of field 1 can be converted to a transaction type of GET_NUM_High or GET_NUM_Low;
  • the value of field 2 (GET_FST_FAILED_CODE) can be converted to a transaction type of GET_FST_FAILED_CODE_Range1, GET_FST_FAILED_CODE_Range2, ... or GET_FST_FAILED_CODE_Range6, .
  • Table 4 Format of user plane training data after extracting fields
  • a training data sequence for each user (including at least one of a signaling training data sequence and a user training data sequence) is obtained.
  • the training data sequence of each user is matched with the elements in the sequence feature set. If the element identifier 1 exists in the training data sequence, the element identifier 0 is not present in the training data sequence.
  • the set of these identities (0 or 1) form training trait values corresponding to the training data. This set can also be referred to as a set of training feature values. In the following, a detailed description of how to obtain a sequence feature set will be given.
  • Table 5 is an example of the signaling training data sequence exemplified above, and exemplarily shows the correspondence between the training feature values of multiple users and their fault types.
  • an element of a sequence feature set might include the following elements:
  • Figure 4 shows a schematic flow diagram of obtaining a sequence feature set of a signaling plane.
  • the process may specifically include:
  • the signaling plane training data is used as an input of a process for obtaining a sequence feature set of the signaling plane.
  • S420 Perform field selection on the signaling plane training data according to the method described above.
  • S430 Perform data serialization processing according to the method described above to obtain a signaling training data sequence.
  • S440 Perform sequence mining calculation on the signaling training data sequence to obtain a sequence feature set of the signaling plane.
  • the sequence mining calculation here can be a single dimension sequence mining.
  • Figure 5 shows a schematic flow chart for obtaining a sequence feature set of a user plane.
  • the process may specifically include:
  • the user plane training data is used as an input of a process of obtaining a sequence feature set of the user plane.
  • S520 Perform field selection on the user plane training data according to the method described above.
  • S540 Perform data serialization processing according to the method described above to obtain a user training data sequence.
  • S550 Perform sequence mining calculation on the user training data sequence to obtain a sequence feature set of the user plane.
  • the sequence mining calculation here can be multi-dimensional sequence mining.
  • the above sequence feature set may include at least one of a predefined sequence feature set and a mining sequence feature set.
  • a predefined sequence feature set and a mining sequence feature set.
  • the generated fault classification model can be uploaded to the fault classification module for use in the fault classification process.
  • the fault classification model can represent the correspondence between the training feature value and the running feature value to the fault type, thereby helping the customer service personnel to quickly locate the fault type of the complaining user, and is beneficial for the engineer to recover the fault.
  • the signaling training data sequence 11000, 11000, 32017, 26100 is obtained in the foregoing.
  • the sequence includes multiple subsequences:
  • the method of the embodiment of the present application can use the Sequence Pattern Mining algorithm to mine the elements of the sequence feature set.
  • the sequence feature set here refers to the mining sequence feature set.
  • the method in the embodiment of the present application may further include: performing a sequence mining calculation on the training data sequence to obtain a mining sequence feature set.
  • sequence pattern is defined as a set consisting of different sequences as elements. Wherein any two elements are different, and each child element in the sequence as an element is arranged in order.
  • a conventional sequence mining algorithm is to mine a set of subsequences (also referred to as sequence patterns) that occur frequently in relative time or in other sequences, and applications are generally limited to discrete sequences.
  • the conventional sequence mining algorithm usually finds all the frequent subsequences in the mined data sequence according to a minimum support threshold specified by the user, that is, the frequency of occurrence of the subsequence in the mined data sequence is not lower than The minimum support threshold mentioned above. Frequent subsequences are used as elements of the sequence pattern.
  • the conventional sequence mining algorithm is not suitable for determining the mining sequence feature set in the embodiment of the present application. This is because the conventional sequence mining algorithm filters the subsequences based on the frequency at which the subsequences appear, that is, the more frequently occurring subsequences are selected by the algorithm. In the embodiment of the present application, when the fault type is identified, the fault type can be distinguished by those sub-sequences that have a low frequency but are highly distinguishable. Therefore, the embodiment of the present application can select an appropriate sequence mining algorithm according to requirements, such as at least one of a decision tree algorithm and a Model-based Search Tree (MBT) algorithm.
  • MBT Model-based Search Tree
  • a decision tree when a decision tree is constructed using a decision tree algorithm, it can be constructed according to parameters such as information entropy and GINI coefficients.
  • the subsequences selected by the decision tree algorithm can be regarded as sub-sequences with identification, and these sub-sequences are used as elements of the feature set of the mining signaling sequence, and of course, elements of the feature set of the mining sequence.
  • the subsequences we can dig into are ⁇ 26100 ⁇ and ⁇ 11000, 11000, 32017 ⁇ .
  • the network standard, signaling type, and signaling status represented by 26100 are 4G, attached, and rejected, respectively.
  • the network standard, signaling type, and signaling status indicated by 11000, 11000, and 32017 are 3G, attached, and successful respectively; 3G, attach, success, and 2G, Gb interface paging, timeout.
  • ⁇ 26100 ⁇ and ⁇ 11000, 11000, 32017 ⁇ are features with strong recognition.
  • a user training data sequence is obtained.
  • a user's user training data sequence is ⁇ (A1, B1), (A2, C2), (D1, E2) ⁇ .
  • the features with strong recognition in the user training data sequence are mined as the elements for mining the feature set of the user sequence, and of course the elements of the feature set of the mining sequence.
  • performing the sequence mining calculation on the training data sequence to obtain the mining sequence feature set may include: determining a plurality of training data sub-sequences according to the training data sequence; and using the sequence mining algorithm to perform the multiple The training data sub-sequence performs sequence mining calculation, and the mined training data sub-sequence is determined as an element in the mining sequence feature set.
  • Mining the signaling sequence feature set and mining the user sequence feature set to form a mining sequence feature set can upload the mining sequence feature set to the online feature calculation module for use in calculating the running feature value of the user in real time.
  • the sequence feature set and the fault classification model may be periodically refreshed. Periodically input a batch of user IDs of the complaining users, fault time, ensure correct and reliable fault types to the offline modeling module, and the offline modeling module extracts a plurality of preset periods corresponding to the complaint users in the fault time from the detailed database.
  • the generated data, the calculated feature value, incrementally refreshes the fault classification model and the sequence feature set, and the refreshed sequence feature set and the fault classification model are respectively refreshed to the online feature calculation module and the fault type determination module.
  • the process of obtaining the refreshed sequence feature set and the fault classification model may be consistent with the description in the foregoing, and will not be described again here.
  • the running characteristic value of the running data generated by the user is calculated in real time online, and when the user complaint is received, the running characteristic value is matched with the fault classification model to determine the fault type of the user generating the fault.
  • the process is an online process with fast processing speed and low labor cost.
  • FIG. 6 shows a schematic block diagram of an apparatus 600 for determining a fault type in an embodiment of the present application.
  • the apparatus 600 for determining the type of failure may include:
  • the real-time feature calculation module 610 is configured to perform on-line real-time calculation on the operation data generated by each user of the plurality of users in a preset period, and obtain the corresponding operation data generated by each user in the preset period.
  • Running characteristic value
  • the receiving module 620 is configured to receive a fault classification request, where the fault classification request is used to request a fault type of determining a fault generated by the target user before the target moment, where the target user is any one of the multiple users;
  • the fault classification module 630 is configured to determine, according to the fault classification request received by the receiving module 620, the target user according to the fault classification model and the running feature value of the target user in at least one of the preset periods.
  • the device for determining the fault type in the embodiment of the present application calculates the running characteristic value of the running data generated by the user in real time online, and when the user complaint is received, matches the running characteristic value with the fault classification model to determine the fault type of the user generating the fault.
  • the process is an online process with fast processing speed and low labor cost.
  • the real-time feature calculation module 610 may be specifically configured to: acquire the operation data generated by each user in the preset period, where the operation data includes a signaling plane operation. At least one of data and user plane running data; determining, according to the operating data, a running data sequence, the running data sequence comprising At least one of a signaling operation data sequence corresponding to the signaling plane operation data and a user operation data sequence corresponding to the user plane operation data; determining, according to the operation data sequence and the sequence feature set, the operation data corresponding to The running feature value.
  • the apparatus 600 may further include an offline modeling module 640, configured to: acquire the training data, where the training data includes at least one of signaling plane training data and user plane training data. And determining, according to the training data, a training data sequence, where the training data sequence includes at least one of a signaling training data sequence corresponding to the signaling plane training data and a user training data sequence corresponding to the user plane training data. And determining, according to the training data sequence and the sequence feature set, a training feature value corresponding to the training data; determining the fault classification model according to the training feature value and a fault type corresponding to the training data.
  • an offline modeling module 640 configured to: acquire the training data, where the training data includes at least one of signaling plane training data and user plane training data. And determining, according to the training data, a training data sequence, where the training data sequence includes at least one of a signaling training data sequence corresponding to the signaling plane training data and a user training data sequence corresponding to the user plane training data. And determining, according to the training data
  • the sequence feature set includes at least one of a mining sequence feature set and a predefined sequence feature set.
  • the offline modeling module 640 may be configured to perform sequence mining calculation on the training data sequence to obtain the mining sequence feature. set.
  • the offline modeling module 640 may be specifically configured to: determine a plurality of training data sub-sequences according to the training data sequence; and sequence the multiple training data sub-sequences by using a sequence mining algorithm The mining calculation determines the sub-sequence of the mined training data as an element in the feature set of the mining sequence.
  • the sequence mining algorithm includes at least one of a decision tree algorithm and a mode search tree MBT algorithm.
  • the fault classification module 630 may be configured to: obtain, according to the target moment, the corresponding one of the target users in the plurality of preset periods before the target moment Running the feature value; reconstructing the plurality of the running feature values to obtain the reconstructed reconstructed feature value; performing feature matching on the reconstructed feature value and the fault classification model to determine that the target user is in the The type of fault that occurred before the target time.
  • the real-time feature calculation module 610, the fault classification module 630, and the offline modeling module 640 may be implemented by a processor, and the receiving module 620 may be implemented by a network interface.
  • device 700 can include a processor 710, a network interface 720, and a memory 730.
  • the memory 730 can be used to store code and the like executed by the processor 710.
  • Apparatus 700 can also include an output device or an output interface 740 coupled to the output device for outputting a result of the fault classification.
  • Output devices include displays, printers, and the like.
  • bus system 750 which in addition to the data bus includes a power bus, a control bus, and a status signal bus.
  • the device 600 shown in FIG. 6 or the device 700 shown in FIG. 7 can implement the various processes implemented in the foregoing embodiments of FIG. 1 to FIG. 5. To avoid repetition, details are not described herein again.
  • the processor may be an integrated circuit chip with signal processing capabilities.
  • each step of the foregoing method embodiment may be completed by an integrated logic circuit of hardware in a processor or an instruction in a form of software.
  • the processor may be a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a Field Programmable Gate Array (FPGA), or the like. Programming logic devices, discrete gates or transistor logic devices, discrete hardware components. Can be The methods, steps, and logical block diagrams disclosed in the embodiments of the present application are now implemented.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present application may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like.
  • the storage medium is located in the memory, and the processor reads the information in the memory and combines the hardware to complete the steps of the above method.
  • the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory may be a read-only memory (ROM), a programmable read only memory (PROM), an erasable programmable read only memory (Erasable PROM, EPROM), or an electric Erase programmable read only memory (EEPROM) or flash memory.
  • the volatile memory can be a Random Access Memory (RAM) that acts as an external cache.
  • RAM Random Access Memory
  • many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (Synchronous DRAM).
  • SDRAM Double Data Rate SDRAM
  • DDR SDRAM Double Data Rate SDRAM
  • ESDRAM Enhanced Synchronous Dynamic Random Access Memory
  • SLDRAM Synchronous Connection Dynamic Random Access Memory
  • DR RAM direct memory bus random access memory
  • the network interface is configured to receive a sequence of behaviors of at least one program file sent from a sandbox server in an enterprise network. Specifically, the network interface may receive the MD5 value corresponding to the program file sent by the sandbox server and the behavior sequence of the program file.
  • the network interface 1220 can be a network interface or multiple network interfaces. The network interface 1220 can receive a sequence of behaviors sent by a sandbox server, and can also receive a sequence of behaviors sent by multiple sandbox servers.
  • the network interface may be a wired interface, such as a Fiber Distributed Data Interface (FDDI) or a Gigabit Ethernet (GE) interface; the network interface may also be a wireless interface.
  • FDDI Fiber Distributed Data Interface
  • GE Gigabit Ethernet
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separate, displayed as a unit
  • the components may or may not be physical units, ie may be located in one place or may be distributed over multiple network elements. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product.
  • the technical solution of the present application which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including
  • the instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present application.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Environmental & Geological Engineering (AREA)
  • Medical Informatics (AREA)
  • Databases & Information Systems (AREA)
  • Evolutionary Computation (AREA)
  • Artificial Intelligence (AREA)
  • Software Systems (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Quality & Reliability (AREA)
  • Debugging And Monitoring (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

本申请公开了一种确定故障类型的方法和装置，该方法包括：对多个用户中每个用户在预设周期内产生的运行数据进行在线实时计算，获得每个用户在预设周期内产生的运行数据对应的运行特征值；接收故障分类请求，故障分类请求用于请求确定目标用户在目标时刻之前所产生的故障的故障类型；根据故障分类请求，基于故障分类模型和目标用户在至少一个预设周期内的运行特征值，确定目标用户在目标时刻之前所产生的故障的故障类型。本申请的确定故障类型的方法，通过在线实时计算用户产生的运行数据的运行特征值，在接收到用户投诉时，将运行特征值与故障分类模型进行匹配，确定用户产生故障的故障类型，该流程为在线的流程，处理速度快，人工成本低。

Description

确定故障类型的方法和装置
本申请要求于2016年9月30日提交中国专利局、申请号为201610867164.3、申请名称为“确定故障类型的方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及数据处理领域，并且更具体地，涉及一种确定故障类型的方法和装置。
背景技术
随着电信网络服务在管理方面的不断成熟，在技术方面的不断发展，电信网络业务种类越来越丰富，市场竞争越来越激烈。运营商意识到要提高终端用户的满意度，必须从用户使用的角度来衡量网络服务的好坏。为此，运营商以及电信设备制造商专门制定了一系列的指标，例如，关键性能指标(Key Performance Indicator，KPI)和关键质量指标(Key Quality Indicator，KQI)等，用于评估用户的网络服务的质量和网络设备的运行健康状态。
KPI的出发点是从网络的角度来揣度用户的感受，其并不能全面反映网络服务的质量。在用KPI体系来衡量网络服务的质量时，经常出现的情况是，整个网络设备的KPI均处于良好的状态，但是用户投诉却逐渐增多。为了进一步提高网络服务的质量，KQI被引入到网络服务的质量的评价体系中来。KQI是主要针对不同业务提出贴近用户感受的业务质量参数。KQI的本质是一些关键业务的端到端的服务质量，例如视频业务的流畅程度、清晰度、语音和视频的同步程度等。KQI在一定程度上提高了关键业务的服务质量，但是它仍然有一些局限性。其指标粒度较粗，并且在设置上具有固定模式，使得其在应对用户复杂多变的使用环境上对用户业务质量的刻画显得力不从心。
另一方面，运营商为了提高用户的网络体验，允许用户在网络体验不好时进行投诉。如何在用户投诉时快速准确的判断用户的网络体验不好的问题所在并及时进行处理便成为运营商一直致力解决的问题。投诉—处理方式可以带给用户更好的网络体验,使得运营商处理客服问题的解决效率和质量均有较大的提升，能够节约人力成本。当投诉的问题为网络问题时，投诉—处理方式可以帮助工程师快速定位问题并解决问题。
现有的一种方案是，运营商的客服人员在处理客户的投诉时，根据现网查询网络故障公告、用户的终端使用信息以及KPI、KQI等，凭借自己的经验判断用户的故障类型。这种方法的处理效率主要取决于客服人员的专业程度，处理结果的准确性得不到稳定保障，而且客服人员的经验也存在局限性，对于问题的判断可能存在盲区。
通常情况下，当网络中出现异常时，会在用户数据中的报错日志中体现，或者在信令数据中的某些字段会标识出信令信息是成功的还是失败的。因此，现有的另外一种方案是，运营商的客服人员在处理客户的投诉时，分析报错日志或信令数据中所携带的错误码进行故障类型的判断。运用该方案进行故障类型判断时，一般是单独分析信令数据或错误日志 所携带的错误码，以此来判断投诉用户的故障类型。该方案依然需要较多的人工干预，确定故障类型的效率不高。
发明内容
本申请提供一种确定故障类型的方法和装置，能够快速且低成本地确定用户产生故障的故障类型。
第一方面，提供了一种确定故障类型的方法，该方法包括：对多个用户中每个用户在预设周期内产生的运行数据进行在线实时计算，获得所述每个用户在所述预设周期内产生的所述运行数据对应的运行特征值；接收故障分类请求，所述故障分类请求用于请求确定目标用户在目标时刻之前所产生的故障的故障类型，所述目标用户为所述多个用户中的任意一个用户；根据所述故障分类请求，基于故障分类模型和所述目标用户在至少一个所述预设周期内的运行特征值，确定所述目标用户在所述目标时刻之前所产生的故障的故障类型，其中，所述故障分类模型是根据已知故障类型的训练数据进行训练得到的。
第一方面的确定故障类型的方法，通过在线实时计算用户产生的运行数据的运行特征值，在接收到用户投诉时，将运行特征值与故障分类模型进行匹配，确定用户产生故障的故障类型，该流程为在线的流程，处理速度快，人工成本低。
结合第一方面，在第一方面第一种可能的实现方式中，所述对多个用户中每个用户在预设周期内产生的运行数据进行在线实时计算，获得所述每个用户在所述预设周期内产生的所述运行数据对应的运行特征值，包括：获取所述每个用户在所述预设周期内产生的所述运行数据，所述运行数据包括信令面运行数据和用户面运行数据中的至少一种；根据所述运行数据，确定运行数据序列，所述运行数据序列包括所述信令面运行数据对应的信令运行数据序列和所述用户面运行数据对应的用户运行数据序列中的至少一种；根据所述运行数据序列和序列特征集，确定所述运行数据对应的所述运行特征值。第一种可能的实现方式中，捕获用户在网络中所产生的信令面运行数据和用户面运行数据，可以将这两类数据在时序上的模式所包含的异常信息，使用在对故障类型的确定上，能够提升确定故障类型的准确性。
结合第一方面，在第一方面第二种可能的实现方式中，所述方法还包括：获取所述训练数据，所述训练数据包括信令面训练数据和用户面训练数据中的至少一种；根据所述训练数据，确定训练数据序列，所述训练数据序列包括所述信令面训练数据对应的信令训练数据序列和所述用户面训练数据对应的用户训练数据序列中的至少一种；根据所述训练数据序列和序列特征集，确定所述训练数据对应的训练特征值；根据所述训练特征值和所述训练数据对应的故障类型，确定所述故障分类模型。
结合第一方面的第一种可能的实现方式，在第一方面第三种可能的实现方式中，所述方法还包括：获取所述训练数据，所述训练数据包括信令面训练数据和用户面训练数据中的至少一种；根据所述训练数据，确定训练数据序列，所述训练数据序列包括所述信令面训练数据对应的信令训练数据序列和所述用户面训练数据对应的用户训练数据序列中的至少一种；根据所述训练数据序列和所述序列特征集，确定所述训练数据对应的训练特征值；根据所述训练特征值和所述训练数据对应的故障类型，确定所述故障分类模型。
结合第一方面的第一种至第三种可能的实现方式，在第一方面第四种可能的实现方式 中，所述序列特征集包括挖掘序列特征集和预定义序列特征集中的至少一种。
结合第一方面的第四种可能的实现方式，在第一方面第五种可能的实现方式中，当所述序列特征集包括所述挖掘序列特征集时，所述方法还包括：对所述训练数据序列进行序列挖掘计算，获得所述挖掘序列特征集。
结合第一方面的第五种可能的实现方式，在第一方面第六种可能的实现方式中，所述对所述训练数据序列进行序列挖掘计算，获得所述挖掘序列特征集，包括：根据所述训练数据序列确定多个训练数据子序列；采用序列挖掘算法对所述多个训练数据子序列进行序列挖掘计算，将挖掘出的训练数据子序列确定为所述挖掘序列特征集中的元素。
结合第一方面的第六种可能的实现方式，在第一方面第七种可能的实现方式中，所述序列挖掘算法包括决策树算法和模式搜索树MBT算法中的至少一种。
结合第一方面及第一方面的第一种至第七种可能的实现方式，在第一方面第八种可能的实现方式中，所述根据所述故障分类请求，基于故障分类模型和所述目标用户在至少一个所述预设周期内的运行特征值，确定所述目标用户在所述目标时刻之前所产生的故障的故障类型，包括：根据所述目标时刻，获取所述目标时刻之前所述目标用户的在多个所述预设周期分别对应的所述运行特征值；对多个所述运行特征值进行重构，获得重构后的重构特征值；将所述重构特征值与所述故障分类模型进行特征匹配，确定所述目标用户在所述目标时刻之前所产生的故障的故障类型。
第二方面，提供了一种确定故障类型的装置，包括实时特征计算模块、接收模块和故障分类模块，用于实现第一方面及第一方面的各种可能的实现方式的相应功能。各模块可以通过硬件实现，也可以通过硬件执行相应的软件实现。确定故障类型的装置还可以包括离线建模模块，以实现相应的实现方式。
应理解，第二方面的确定故障类型的装置的各个模块可以用于实现第一方面及第一方面的各种可能的实现方式的方法，此处不再赘述。
第三方面，提供了一种确定故障类型的装置，包括处理器、网络接口和存储器。其中，存储器可以用于存储处理器执行的代码。确定故障类型的装置还可以包括输出设备或与输出设备连接的输出接口，以用于输出故障分类的结果。
应理解，序列特征集为能够表征故障类型的多个特征的集合。
附图说明
图1是本申请一个实施例的确定故障类型的方法的示意性流程图。
图2是本申请另一个实施例的确定故障类型的方法的示意性流程图。
图3是本申请一个实施例的字段AVG_UL_RTT的取值的分布与其可能对应的故障类型的对应关系的示意图。
图4是本申请一个实施例的获得信令面的序列特征集的示意性流程图。
图5是本申请一个实施例的获得用户面的序列特征集的示意性流程图。
图6是本申请一个实施例的确定故障类型的装置的示意性框图。
图7是本申请另一个实施例的确定故障类型的装置的示意性框图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
现有的确定故障类型的方法多是依赖于人工的，因此本申请实施例提供一种方便快捷的基于在线的确定故障类型的方法。本申请实施例的确定故障类型的方法可以精确地对使用网络服务[例如，使用移动宽带(Mobile Broadband，MBB)网络]的用户的网络质量进行评估，能够结合用户本身的特点和使用习惯，刻画用户网络质量。本申请实施例的确定故障类型的方法还可以快速确定引发投诉用户的网络质量问题的故障类型，协助客服人员快速处理问题。
本申请实施例的确定故障类型的方法100可以包括如图1所示的以下步骤。
S110，对多个用户中每个用户在预设周期内产生的运行数据进行在线实时计算，获得所述每个用户在所述预设周期内产生的所述运行数据对应的运行特征值。
S120，接收故障分类请求，所述故障分类请求用于请求确定目标用户在目标时刻之前所产生的故障的故障类型，所述目标用户为所述多个用户中的任意一个用户。
S130，根据所述故障分类请求，基于故障分类模型和所述目标用户在至少一个所述预设周期内的运行特征值，确定所述目标用户在所述目标时刻之前所产生的故障的故障类型，其中，所述故障分类模型是根据已知故障类型的训练数据进行训练得到的。
具体而言，本申请实施例的确定故障类型的方法可以如图2所示。其中，图1中所示的S110可以认为是图2所示的实时特征计算过程。实时特征计算无需存储原始数据，仅需要存储少量特征值数据，可以节约存储空间，同时实时处理的过程能够节省端到端的查询时间。
S110具体可以包括：获取所述每个用户在所述预设周期内产生的所述运行数据，所述运行数据包括信令面运行数据和用户面运行数据中的至少一种；根据所述运行数据，确定运行数据序列，所述运行数据序列包括所述信令面运行数据对应的信令运行数据序列和所述用户面运行数据对应的用户运行数据序列中的至少一种；根据所述运行数据序列和序列特征集，确定所述运行数据对应的所述运行特征值。
在本申请实施例中，序列特征集为能够表征故障类型的多个特征的集合。具体而言，序列特征集可以是根据经验人工选择出来的或预设的，或者可以是根据本申请实施例中下文中的方法挖掘得到的，能够在故障分类中起到区分作用的多个特征的集合。
在网络的实际运行过程中，每个用户均会产生大量的运行数据。例如，在Hadoop分布式文件系统(Hadoop Distributed File System，HDFS)中，这些运行数据会被存入详单数据库中。从运行数据中可以分析出用户的网络质量。其中，运行数据可以包括信令面运行数据和用户面运行数据中的至少一种。由此，S110捕获用户在网络中所产生的信令面运行数据和用户面运行数据，可以将这两类数据在时序上的模式所包含的异常信息，使用在对故障类型的确定上，能够提升确定故障类型的准确性。
本申请实施例的确定故障类型的方法，可以通过确定故障类型的装置中的实时特征计算模块，按照预设周期从详单数据库中获取每个用户在最近的预设周期内产生的运行数据。换而言之，确定故障类型的装置获取每个用户在预设周期内产生的运行数据。
应理解，预设周期可以是网络系统根据系统的计算能力或系统产生的运行数据确定的，也可以是网络管理人员设定的；预设周期可以是不变的固定值，也可以随着网络环境灵活变化，本申请实施例对此不作限定。在一个具体的例子中，预设周期可以是5分钟或 10分钟。
实时特征计算模块在获取运行数据后，根据所述运行数据，确定运行数据序列。由于前文中提到，运行数据可以包括信令面运行数据和用户面运行数据中的至少一种。因此，相应地，所确定的运行数据序列也可以包括信令面运行数据对应的信令运行数据序列和用户面运行数据对应的用户运行数据序列中的至少一种。由信令面运行数据确定信令运行数据序列的具体过程，以及由用户面运行数据确定用户运行数据序列的具体过程，会在下文中详细描述。
在得到运行数据序列后，实时特征计算模块可以根据运行数据序列和序列特征集，确定运行数据对应的运行特征值。其中，序列特征集用于描述特征的格式和计算特征的规则。序列特征集可以包括挖掘序列特征集和预定义序列特征集中的至少一种。预定义序列特征集可以是人工预定义的序列特征集，挖掘序列特征集可以是通过挖掘算法由机器学习出来的序列特征集，挖掘序列特征集的生成以及具体内容将会在下文中进行详细描述。具体而言。当序列特征集包括挖掘序列特征集时，本申请实施例的确定故障类型的方法还可以包括：对训练数据序列进行挖掘计算，获得挖掘序列特征集。
下面通过表1举例说明实时特征计算过程中得到的一个用户的运行特征值的示例。
表1运行特征值的示例
编号 序列特征集的元素 特征值
1 {26100} 1
2 {11000,11000,32017} 0
3 {A1,A2} 1
4 {B1,C2,E2} 1
5 丢包数 23
6 平均时延 12
表1示出的用户的运行特征值包括两部分，预定义特征值和挖掘序列特征值。其中，编号1-4为挖掘序列特征值，其中，编号1和2是信令运行数据序列对应的序列特征值，编号3和4是用户运行数据序列对应的序列特征值；编号5和6为预定义序列特征值。应理解，对于不同的用户以及计算周期，序列特征值是随运行数据的不同而变化的。
实时特征计算模块将计算得到的每个用户在多个预设周期对应的运行特征值存储在运行特征值数据库中，以供故障分类过程使用。
图1中所示的S120可以认为是图2所示的输入的过程。本申请实施例的确定故障类型的装置可以接收投诉用户通过页面等输入的故障分类请求，也可以有客服人员参与，由客服人员通过业务页面向确定故障类型的装置中输入故障分类请求。故障分类请求中可以包括投诉用户的用户标识、以及投诉用户反映的故障时间。确定故障类型的装置将该用户标识对应的用户确定为目标用户，根据故障时间确定目标时刻，以进行后续的处理。当然该过程也可以有客服人员参与，客服人员通过业务页面向确定故障类型的装置中输入目标 时刻和目标用户的用户标识。
图1中所示的S130可以认为是图2所示的故障分类过程。具体而言，当网络质量不佳时，用户可以通过客服网页界面、客服应用(APP)界面或客服电话反馈网络质量不佳的问题。S130具体可以包括：根据所述目标时刻，获取所述目标时刻之前所述目标用户的在多个所述预设周期分别对应的所述运行特征值；对多个所述运行特征值进行重构，获得重构后的重构特征值；将所述重构特征值与所述故障分类模型进行特征匹配，确定所述目标用户在所述目标时刻之前所产生的故障的故障类型。
根据目标时刻，获取目标时刻之前目标用户的在多个预设周期分别对应的运行特征值。具体地，目标时刻可以是根据前文中提到的故障时间以及前后一段时间确定的。获取运行数据的时间段的长度可以通过以下方法。例如，根据目标用户投诉的故障时间是2016年5月26日14:00点，将该故障时间确定为目标时刻，则在获取运行数据的时候，可以获取用户在2016年5月25日14:00点～2016年5月26日14:00点的运行数据，时间段的长度为24小时。根据应用的不同，可以对时间段的长度的选择进行调整。
目标用户在多个预设周期对应多个运行特征值，对多个运行特征值进行重构，获得重构后的重构特征值。该重构过程可以是对多个运行特征值进行简单的累加、合并或组合，例如将多个预设周期所产生的丢包数进行累加；也可以是对多个运行特征值进行更复杂的运算，例如取最大值、以预设规则过滤等等，本申请实施例对此不作限定。
在一个具体的例子中，由于每个预设周期对应的运行特征值是在线实时计算得到的，假设在线计算运行特征值的预设周期设定为5分钟，该用户在24小时内产生的运行特征值有288条记录。获取到这288条记录后，需要把它们重构成一条重构特征值。
应理解，本申请实施可以对重构特征值(由多个运行特征值获得)或一个运行特征值与故障分类模型进行特征匹配，确定目标用户所产生的故障的故障类型。其中，故障分类模型可以是装置预先配置好的，也可以是根据已知故障类型的训练数据进行训练得到的，下面对得到故障分类模型的具体过程进行详细描述，该过程可以称为图2中的离线建模过程，可以由确定故障类型的系统中的离线建模模块执行。
一般而言，离线建模过程可以发生在本申请实施例的确定故障类型的方法100的步骤S110至S130之前。即方法100还可以包括：获取所述训练数据，所述训练数据包括信令面训练数据和用户面训练数据中的至少一种；根据所述训练数据，确定训练数据序列，所述训练数据序列所述信令面运行训练对应的信令训练数据序列和所述用户面训练数据对应的用户训练数据序列中的至少一种；根据所述训练数据序列和序列特征集，确定所述训练数据对应的训练特征值；根据所述训练特征值和所述训练数据对应的故障类型，确定所述故障分类模型。
其中，获取训练数据的过程可以如下：从外部获取一批历史的投诉用户的用户标识，这些投诉用户产生的故障的时间和故障类型是已知的，并且这些故障类型是被证实判断正确的。根据历史的投诉用户的用户标识和故障时间，从详单数据库中提取历史的投诉用户在故障时间之前一段时间的运行数据作为训练数据。
接下来，根据训练数据得到训练特征值。该过程与前文中描述的根据运行数据得到运行特征值的过程是一致的。这里，以根据训练数据得到训练特征值为例进行说明。
一方面，如果序列特征集中包括预定义序列特征集，则可以根据训练数据得到预定义 特征值。预定义序列特征集的元素可以包括丢包率、传输速率、平均时延以及其它指标，等等。具体地，预定义特征值可以直接从训练数据中得到，也可以对训练数据进行预处理生成训练数据序列之后，由训练数据序列提取出预定义特征值，本申请实施例对此不作限定。
另一方面，如果序列特征集中包括挖掘序列特征集，则可以对训练数据进行预处理，获得训练数据序列。根据训练数据中所包括的内容，训练数据序列可以包括信令面训练数据对应的信令训练数据序列和用户面训练数据对应的用户训练数据序列中的至少一种。
下面具体介绍信令训练数据序列和用户训练数据序列的具体生成过程。
对于信令面训练数据，从信令面训练数据中选择信令类型、信令状态、网络制式等字段，并按时间顺序进行罗列。表2示出了提取上述字段后的信令面训练数据的格式。
表2提取字段后的信令面训练数据的格式
用户标识 时间 信令类型 信令状态 网络制式
user1 12:01 000 1 1
user1 12:02 000 1 1
user1 12:03 017 3 2
user1 12:04 100 2 6
根据表2的提取字段后的信令训练数据的格式，按时间先后顺序进行编码重组，即进行数据序列化处理，得到信令训练数据序列11000,11000,32017,26100。
对于用户面训练数据，从用户面训练数据中选取部分字段，得到表3示出的提取字段后的用户面训练数据的格式。
表3提取字段后的用户面训练数据的格式
Figure PCTCN2017103506-appb-000001
如表3所示，表3中一些字段(例如，字段1、字段2和字段3)的取值是数值型的， 不适于进行序列，需要进行离散化处理，将其取值变为事物型的。例如，字段3(AVG_UL_RTT)的取值是数值型的。图3示出了字段AVG_UL_RTT的取值的分布与其可能对应的故障类型的对应关系的示意图。根据上述对应关系，可以把AVG_UL_RTT的取值分为2类：AVG_UL_RTT_High和AVG_UL_RTT_Low。据此，将AVG_UL_RTT的数值型的取值转换成事物型。类似地，字段1(GET_NUM)的取值转换成事物型可以为GET_NUM_High或GET_NUM_Low；字段2(GET_FST_FAILED_CODE)的取值转换成事物型可以为GET_FST_FAILED_CODE_Range1，GET_FST_FAILED_CODE_Range2，……或GET_FST_FAILED_CODE_Range6，……。
将表3进行转换以后，得到如表4所示的提取字段后的用户面训练数据的格式。
表4提取字段后的用户面训练数据的格式
Figure PCTCN2017103506-appb-000002
转换得到表4所示的内容以后，同样将上述内容按时间先后顺序进行排序得到用户训练数据序列({GET_NUM_High,GET_FST_FAILED_CODE_Range6,AVG_UL_RTT_High,0},{GET_NUM_High,GET_FST_FAILED_CODE_Range6,AVG_UL_RTT_Low,0},…)。
由此，得到了每个用户的训练数据序列(包括信令训练数据序列和用户训练数据序列中的至少一种)。将每个用户的训练数据序列和序列特征集中的元素进行匹配，如果训练数据序列中存在该元素标识1，如果训练数据序列中不存在该元素标识0。这些标识(0或1)的集合形成训练数据对应的训练特征值。该集合也可以称为训练特征值集。下文中，会对如何获得序列特征集进行详细说明。
训练数据的故障类型均是已知的。表5以上文中举出的信令训练数据序列为例，示例性的示出了多个用户的训练特征值和其故障类型的对应关系。例如，序列特征集的元素可能包括以下元素：
{26100}和{11000,11000,32017}。
表5多个用户的训练特征值和其故障类型的对应关系
Figure PCTCN2017103506-appb-000003
具体而言，对信令面训练数据进行处理和挖掘，最终可以得到信令面的序列特征集。图4示出了获得信令面的序列特征集的示意性流程图。该流程具体可以包括：
S410，将信令面训练数据作为获得信令面的序列特征集的流程的输入。
S420，如前文所述的方法对信令面训练数据进行字段选取。
S430，如前文所述的方法进行数据序列化处理，得到信令训练数据序列。
S440，对信令训练数据序列进行序列挖掘计算，得到信令面的序列特征集。其中，这里的序列挖掘计算可以是单一维度的序列挖掘。
S450，输出上述信令面的序列特征集。
对用户面训练数据进行处理和挖掘，最终可以得到用户面的序列特征集。图5示出了获得用户面的序列特征集的示意性流程图。该流程具体可以包括：
S510，将用户面训练数据作为获得用户面的序列特征集的流程的输入。
S520，如前文所述的方法对用户面训练数据进行字段选取。
S530，如前文所述的方法进行数据离散化处理。
S540，如前文所述的方法进行数据序列化处理，得到用户训练数据序列。
S550，对用户训练数据序列进行序列挖掘计算，得到用户面的序列特征集。其中，这里的序列挖掘计算可以是多维度的序列挖掘。
S560，输出上述用户面的序列特征集。
上述序列特征集可以包括预定义序列特征集和挖掘序列特征集中的至少一种。根据该 对应关系，或者对该对应关系进行进一步挖掘，即进行故障分类模型建模，生成故障分类模型。可以将生成的故障分类模型，上传到故障分类模块，以供故障分类过程使用。故障分类模型可以表示训练特征值以及运行特征值对故障类型的对应关系，从而可以帮助客服人员快速地定位投诉用户的故障类型，有利于工程师对故障进行恢复。
下面详细介绍本申请实施例获得序列特征集的过程。
对于信令面训练数据，前文得到信令训练数据序列11000,11000,32017,26100。对该序列而言，其包括多个子序列：
{11000},{32017},{26100}
{11000,11000},{11000,32017},{32017,26100}
{11000,11000,32017},{11000,32017,26100}
{11000,11000,32017,26100}
而后，本申请实施例的方法可以采用序列模式挖掘(Sequence Pattern Mining)算法，挖掘出序列特征集的元素。这里的序列特征集是指挖掘序列特征集。相应地，当所述序列特征集包括挖掘序列特征集时，本申请实施例的方法还可以包括：对训练数据序列进行序列挖掘计算，获得挖掘序列特征集。
其中，序列模式定义为一个由不同序列作为元素组成的集合。其中，任意两个元素不相同，每个作为元素的序列中的子元素按顺序有序排列。常规的序列挖掘算法是挖掘相对时间内或其他序列中出现频率高的子序列的集合(也称为序列模式)，应用一般限于离散型的序列。常规的序列挖掘算法通常根据用户指定的一个最小支持度阈值，挖掘时找出被挖掘的数据序列中所有的频繁子序列，即该子序列在被挖掘的数据序列中的出现的频率不低于上述最小支持度阈值。将频繁子序列作为序列模式的元素。
但是，常规的序列挖掘算法并不适用于本申请实施例中确定挖掘序列特征集。这是因为常规的序列挖掘算法对子序列的筛选是基于子序列出现的频率的，即出现频率越多的子序列会被算法选出来。而本申请实施例在识别故障类型时，能够对故障类型进行区分的往往是那些出现频率较低，但是区分性强的子序列。因此，本申请实施例可以根据需求选择合适的序列挖掘算法，例如决策树算法和模式搜索树(Model-based search Tree，MBT)算法中的至少一种。
例如，采用决策树算法构造决策树时，可以根据信息熵、GINI系数等参数来构造。通过决策树算法选择出来的子序列，可以认为是具有辨识度的子序列，将这些子序列作为挖掘信令序列特征集的元素，当然也是挖掘序列特征集的元素。在上面的示例中，我们可以从中挖到的子序列为{26100}和{11000,11000,32017}。
其中26100表示的网络制式、信令类型、信令状态分别为4G、附着、拒绝。11000,11000,32017表示的网络制式、信令类型、信令状态分别为3G、附着、成功；3G、附着、成功和2G、Gb接口寻呼、超时。{26100}和{11000,11000,32017}均为辨识度较强的特征。
类似地，对于每个用户的用户面训练数据，获得用户训练数据序列。例如，一个用户的用户训练数据序列为{(A1,B1),(A2,C2),(D1,E2)}。
它对应的子序列可以为：
(A1),(A2),(B1),(C2),(D1),(E2)
(A1,A2),(A1,C2),(B1,A2),(B1,C2),(A2,D1),(A2,E2),(C2,D1),(C2,E2)
(A1,A2,D1),(A1,A2,E2),(A1,C2,D1),(A1,C2,E2),(B1,A2,D1),(B1,A2,E2),(B1,C2,D1)
(B1,C2,E2)……
采用序列挖掘算法，在所有可能出现的子序列组合中，挖掘出用户训练数据序列中辨识度较强的特征，作为挖掘用户序列特征集的元素，当然也是挖掘序列特征集的元素。
综上，所述对所述训练数据序列进行序列挖掘计算，获得所述挖掘序列特征集，可以包括：根据所述训练数据序列确定多个训练数据子序列；采用序列挖掘算法对所述多个训练数据子序列进行序列挖掘计算，将挖掘出的训练数据子序列确定为所述挖掘序列特征集中的元素。
挖掘信令序列特征集和挖掘用户序列特征集组成挖掘序列特征集。本申请实施例的方法可以将挖掘序列特征集上传到在线特征计算模块，供其在实时计算用户的运行特征值时使用。
在本申请实施例的方法中，可以对序列特征集和故障分类模型进行周期性刷新。周期性输入一批投诉用户的用户标识，故障时间，确保正确可靠的故障类型到离线建模模块，离线建模模块从详单数据库中提取这部分投诉用户在故障时间对应的多个预设周期内产生的数据，计算特征值，增量地对故障分类模型和序列特征集进行刷新，刷新后的序列特征集和故障分类模型分别刷新到在线特征计算模块和故障类型确定模块。获得刷新的序列特征集和故障分类模型的过程可以与前文中的描述一致，此处不再进行赘述。
本申请实施例的确定故障类型的方法，通过在线实时计算用户产生的运行数据的运行特征值，在接收到用户投诉时，将运行特征值与故障分类模型进行匹配，确定用户产生故障的故障类型，该流程为在线的流程，处理速度快，人工成本低。
图6示出了本申请实施例的确定故障类型的装置600的示意性框图。该确定故障类型的装置600可以包括：
实时特征计算模块610，用于对多个用户中每个用户在预设周期内产生的运行数据进行在线实时计算，获得所述每个用户在所述预设周期内产生的所述运行数据对应的运行特征值；
接收模块620，用于接收故障分类请求，所述故障分类请求用于请求确定目标用户在目标时刻之前所产生的故障的故障类型，所述目标用户为所述多个用户中的任意一个用户；
故障分类模块630，用于根据所述接收模块620接收的所述故障分类请求，基于故障分类模型和所述目标用户在至少一个所述预设周期内的运行特征值，确定所述目标用户在所述目标时刻之前所产生的故障的故障类型，其中，所述故障分类模型是根据已知故障类型的训练数据进行训练得到的。
本申请实施例的确定故障类型的装置，通过在线实时计算用户产生的运行数据的运行特征值，在接收到用户投诉时，将运行特征值与故障分类模型进行匹配，确定用户产生故障的故障类型，该流程为在线的流程，处理速度快，人工成本低。
可选地，作为一个实施例，所述实时特征计算模块610具体可以用于：获取所述每个用户在所述预设周期内产生的所述运行数据，所述运行数据包括信令面运行数据和用户面运行数据中的至少一种；根据所述运行数据，确定运行数据序列，所述运行数据序列包括 所述信令面运行数据对应的信令运行数据序列和所述用户面运行数据对应的用户运行数据序列中的至少一种；根据所述运行数据序列和序列特征集，确定所述运行数据对应的所述运行特征值。
可选地，作为一个实施例，所述装置600还可以包括离线建模模块640，用于：获取所述训练数据，所述训练数据包括信令面训练数据和用户面训练数据中的至少一种；根据所述训练数据，确定训练数据序列，所述训练数据序列包括所述信令面训练数据对应的信令训练数据序列和所述用户面训练数据对应的用户训练数据序列中的至少一种；根据所述训练数据序列和所述序列特征集，确定所述训练数据对应的训练特征值；根据所述训练特征值和所述训练数据对应的故障类型，确定所述故障分类模型。
可选地，作为一个实施例，所述序列特征集包括挖掘序列特征集和预定义序列特征集中的至少一种。
可选地，作为一个实施例，当所述序列特征集包括所述挖掘序列特征集时，离线建模模块640可以用于：对所述训练数据序列进行序列挖掘计算，获得所述挖掘序列特征集。
可选地，作为一个实施例，所述离线建模模块640具体可以用于：根据所述训练数据序列确定多个训练数据子序列；采用序列挖掘算法对所述多个训练数据子序列进行序列挖掘计算，将挖掘出的训练数据子序列确定为所述挖掘序列特征集中的元素。
可选地，作为一个实施例，所述序列挖掘算法包括决策树算法和模式搜索树MBT算法中的至少一种。
可选地，作为一个实施例，所述故障分类模块630具体可以用于：根据所述目标时刻，获取所述目标时刻之前所述目标用户的在多个所述预设周期分别对应的所述运行特征值；对多个所述运行特征值进行重构，获得重构后的重构特征值；将所述重构特征值与所述故障分类模型进行特征匹配，确定所述目标用户在所述目标时刻之前所产生的故障的故障类型。
应理解，本申请实施例中，实时特征计算模块610、故障分类模块630和离线建模模块640可以由处理器实现，接收模块620可以由网络接口实现。
如图7所示，装置700可以包括处理器710、网络接口720和存储器730。其中，存储器730可以用于存储处理器710执行的代码等。装置700还可以包括输出设备或与输出设备连接的输出接口740，以用于输出故障分类的结果。输出设备包括显示器，打印机等等。
装置700中的各个组件通过总线系统750耦合在一起，其中总线系统750除包括数据总线之外，还包括电源总线、控制总线和状态信号总线。
图6所示的装置600或图7所示的装置700能够实现前述图1至图5的实施例中所实现的各个过程，为避免重复，这里不再赘述。
应注意，本申请上述方法实施例可以应用于处理器中，或者由处理器实现。处理器可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实 现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。
可以理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(Synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)。应注意，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
所述网络接口用于接收来自于企业网络中的沙箱服务器发送的至少一个程序文件的行为序列。具体地，网络接口可以接收沙箱服务器发送的程序文件对应的MD5值以及程序文件的行为序列。网络接口1220可以是一个网络接口，也可以是多个网络接口。网络接口1220可以接收一个沙箱服务器发送的行为序列，也可以接收多个沙箱服务器分别发送的行为序列。网络接口可以是有线接口，例如光纤分布式数据接口(Fiber Distributed Data Interface，FDDI)、千兆以太网(Gigabit Ethernet，GE)接口；网络接口也可以是无线接口。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的 部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以权利要求的保护范围为准。

Claims (12)

  1. 一种确定故障类型的方法，其特征在于，包括：
    对多个用户中每个用户在预设周期内产生的运行数据进行在线实时计算，获得所述每个用户在所述预设周期内产生的所述运行数据对应的运行特征值；
    接收故障分类请求，所述故障分类请求用于请求确定目标用户在目标时刻之前所产生的故障的故障类型，所述目标用户为所述多个用户中的任意一个用户；
    根据所述故障分类请求，基于故障分类模型和所述目标用户在至少一个所述预设周期内的运行特征值，确定所述目标用户在所述目标时刻之前所产生的故障的故障类型，其中，所述故障分类模型是根据序列特征集和已知故障的训练数据对应的故障类型进行训练得到的，所述序列特征集为能够表征故障类型的多个特征的集合并根据所述已知故障类型的训练数据进行序列挖掘获得。
  2. 根据权利要求1所述的方法，其特征在于，所述对多个用户中每个用户在预设周期内产生的运行数据进行在线实时计算，获得所述每个用户在所述预设周期内产生的所述运行数据对应的运行特征值，包括：
    获取所述每个用户在所述预设周期内产生的所述运行数据，所述运行数据包括信令面运行数据和用户面运行数据中的至少一种；
    根据所述运行数据，确定运行数据序列，所述运行数据序列包括所述信令面运行数据对应的信令运行数据序列和所述用户面运行数据对应的用户运行数据序列中的至少一种；
    根据所述运行数据序列和所述序列特征集，确定所述运行数据对应的所述运行特征值。
  3. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    获取所述训练数据，所述训练数据包括信令面训练数据和用户面训练数据中的至少一种；
    根据所述训练数据，确定训练数据序列，所述训练数据序列包括所述信令面训练数据对应的信令训练数据序列和所述用户面训练数据对应的用户训练数据序列中的至少一种；
    根据所述训练数据序列和所述序列特征集，确定所述训练数据对应的训练特征值；
    根据所述训练特征值和所述训练数据对应的故障类型，确定所述故障分类模型。
  4. 根据权利要求1至3中任一项所述的方法，其特征在于，所述方法还包括：
    根据所述训练数据序列确定多个训练数据子序列；
    采用序列挖掘算法对所述多个训练数据子序列进行序列挖掘计算，将挖掘出的训练数据子序列确定为所述序列特征集中的元素。
  5. 根据权利要求4所述的方法，其特征在于，所述序列挖掘算法包括决策树算法和模式搜索树MBT算法中的至少一种。
  6. 根据权利要求1至5中任一项所述的方法，其特征在于，所述根据所述故障分类请求，基于故障分类模型和所述目标用户在至少一个所述预设周期内的运行特征值，确定所述目标用户在所述目标时刻之前所产生的故障的故障类型，包括：
    根据所述目标时刻，获取所述目标时刻之前所述目标用户的在多个所述预设周期分别 对应的所述运行特征值；
    对多个所述运行特征值进行重构，获得重构后的重构特征值；
    将所述重构特征值与所述故障分类模型进行特征匹配，确定所述目标用户在所述目标时刻之前所产生的故障的故障类型。
  7. 一种确定故障类型的装置，其特征在于，包括：
    实时特征计算模块，用于对多个用户中每个用户在预设周期内产生的运行数据进行在线实时计算，获得所述每个用户在所述预设周期内产生的所述运行数据对应的运行特征值；
    接收模块，用于接收故障分类请求，所述故障分类请求用于请求确定目标用户在目标时刻之前所产生的故障的故障类型，所述目标用户为所述多个用户中的任意一个用户；
    故障分类模块，用于根据所述获取模块获取的所述故障分类请求，基于故障分类模型和所述目标用户在至少一个所述预设周期内的运行特征值，确定所述目标用户在所述目标时刻之前所产生的故障的故障类型，其中，所述故障分类模型是根据序列特征集和已知故障的训练数据对应的故障类型进行训练得到的，所述序列特征集为能够表征故障类型的多个特征的集合并根据所述已知故障类型的训练数据进行序列挖掘获得。
  8. 根据权利要求7所述的装置，其特征在于，所述实时特征计算模块具体用于：
    获取所述每个用户在所述预设周期内产生的所述运行数据，所述运行数据包括信令面运行数据和用户面运行数据中的至少一种；
    根据所述运行数据，确定运行数据序列，所述运行数据序列包括所述信令面运行数据对应的信令运行数据序列和所述用户面运行数据对应的用户运行数据序列中的至少一种；
    根据所述运行数据序列和所述序列特征集，确定所述运行数据对应的所述运行特征值。
  9. 根据权利要求8所述的装置，其特征在于，所述装置还包括离线建模模块，用于：
    获取所述训练数据，所述训练数据包括信令面训练数据和用户面训练数据中的至少一种；
    根据所述训练数据，确定训练数据序列，所述训练数据序列包括所述信令面训练数据对应的信令训练数据序列和所述用户面训练数据对应的用户训练数据序列中的至少一种；
    根据所述训练数据序列和所述序列特征集，确定所述训练数据对应的训练特征值；
    根据所述训练特征值和所述训练数据对应的故障类型，确定所述故障分类模型。
  10. 根据权利要求7至9中任一项所述的装置，其特征在于，所述装置还包括离线建模模块，用于：
    根据所述训练数据序列确定多个训练数据子序列；
    采用序列挖掘算法对所述多个训练数据子序列进行序列挖掘计算，将挖掘出的训练数据子序列确定为所述序列特征集中的元素。
  11. 根据权利要求10所述的装置，其特征在于，所述序列挖掘算法包括决策树算法和模式搜索树MBT算法中的至少一种。
  12. 根据权利要求7至11中任一项所述的装置，其特征在于，所述故障分类模块具体用于：
    根据所述目标时刻，获取所述目标时刻之前所述目标用户的在多个所述预设周期分别 对应的所述运行特征值；
    对多个所述运行特征值进行重构，获得重构后的重构特征值；
    将所述重构特征值与所述故障分类模型进行特征匹配，确定所述目标用户在所述目标时刻之前所产生的故障的故障类型。
PCT/CN2017/103506 2016-09-30 2017-09-26 确定故障类型的方法和装置 WO2018059402A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/351,033 US11140021B2 (en) 2016-09-30 2019-03-12 Method and apparatus for determining fault type

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610867164.3A CN107888397B (zh) 2016-09-30 2016-09-30 确定故障类型的方法和装置
CN201610867164.3 2016-09-30

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/351,033 Continuation US11140021B2 (en) 2016-09-30 2019-03-12 Method and apparatus for determining fault type

Publications (1)

Publication Number Publication Date
WO2018059402A1 true WO2018059402A1 (zh) 2018-04-05

Family

ID=61763651

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/103506 WO2018059402A1 (zh) 2016-09-30 2017-09-26 确定故障类型的方法和装置

Country Status (3)

Country Link
US (1) US11140021B2 (zh)
CN (1) CN107888397B (zh)
WO (1) WO2018059402A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111178423A (zh) * 2019-12-25 2020-05-19 国网电子商务有限公司 一种故障预警方法及装置
CN113778837A (zh) * 2021-08-06 2021-12-10 北京奇艺世纪科技有限公司 页面故障确定方法、装置、电子设备及存储介质

Families Citing this family (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108833172B (zh) * 2018-06-21 2021-05-25 中国联合网络通信集团有限公司 一种网络故障报警的处理方法、装置和网络系统
CN110943874B (zh) * 2018-09-21 2021-11-19 中国移动通信有限公司研究院 一种家庭宽带网络的故障检测方法、装置和可读介质
CN110990395B (zh) * 2018-09-29 2023-04-07 北京国双科技有限公司 一种数据处理方法及装置
CN109780812B (zh) * 2019-01-04 2022-10-28 海尔智家股份有限公司 冰箱的运行状态数据的处理方法和装置
CN111859047A (zh) * 2019-04-23 2020-10-30 华为技术有限公司 一种故障解决方法及装置
CN110337118B (zh) * 2019-04-24 2022-08-26 中国联合网络通信集团有限公司 用户投诉快速处理方法及装置
CN110365528A (zh) * 2019-07-10 2019-10-22 广州瀚信通信科技股份有限公司 一种基于家庭宽带大数据的处理投诉分析方法
CN110856203B (zh) * 2019-11-19 2023-04-28 中国联合网络通信集团有限公司 终端网络诊断方法及系统
CN110941554B (zh) * 2019-11-25 2023-10-27 腾讯科技（深圳）有限公司 一种复现故障的方法及装置
CN111130855B (zh) * 2019-12-05 2022-08-12 中国联合网络通信集团有限公司 一种问题定位方法和装置
CN111651601B (zh) * 2020-06-02 2023-04-18 全球能源互联网研究院有限公司 用于电力信息系统的故障分类模型的训练方法及分类方法
CN113515434A (zh) * 2021-01-04 2021-10-19 腾讯科技（深圳）有限公司 异常分类方法、装置、异常分类设备及存储介质
CN112860968A (zh) * 2021-02-02 2021-05-28 北京三快在线科技有限公司 一种异常检测的方法以及装置
CN115442832B (zh) * 2021-06-03 2024-04-09 中国移动通信集团四川有限公司 投诉问题定位方法、装置及电子设备
CN113691405B (zh) * 2021-08-25 2023-12-01 北京知道创宇信息技术股份有限公司 一种访问异常诊断方法、装置、存储介质及电子设备
CN115396882B (zh) * 2022-08-24 2024-06-21 烽火通信科技股份有限公司 一种实现网络告警分类模型计算的方法和装置
CN116163943B (zh) * 2023-03-27 2023-09-08 蚌埠市联合压缩机制造有限公司 一种运行状态实时监测的压缩机

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101867486A (zh) * 2010-06-08 2010-10-20 江苏大学 一种无线传感器网络故障诊断方法
CN101917297A (zh) * 2010-08-30 2010-12-15 烽火通信科技股份有限公司 基于贝叶斯网络的核心网故障诊断方法及系统
US20110199911A1 (en) * 2010-02-18 2011-08-18 Oki Electric Industry Co., Ltd. Network fault detection system
CN102487343A (zh) * 2010-12-06 2012-06-06 中国人民解放军理工大学 卫星通信系统隐故障诊断预测方法
CN104794136A (zh) * 2014-01-22 2015-07-22 华为技术有限公司 故障分析方法和装置
CN106162710A (zh) * 2015-04-10 2016-11-23 富士通株式会社 故障检测装置、方法和系统

Family Cites Families (24)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7725571B1 (en) * 1999-05-24 2010-05-25 Computer Associates Think, Inc. Method and apparatus for service analysis in service level management (SLM)
US6970804B2 (en) * 2002-12-17 2005-11-29 Xerox Corporation Automated self-learning diagnostic system
WO2007060721A1 (ja) * 2005-11-24 2007-05-31 Hewlett-Packard Development Company, L.P. ネットワーク管理装置およびネットワークの管理方法
CN1848602A (zh) * 2006-03-22 2006-10-18 珠海市伊特高科技有限公司 远程通讯配电监控系统及方法
US7533070B2 (en) * 2006-05-30 2009-05-12 Honeywell International Inc. Automatic fault classification for model-based process monitoring
CN101459925B (zh) 2007-12-11 2010-10-20 中国移动通信集团公司 电信网络投诉管理系统及方法
CN101217693A (zh) 2007-12-26 2008-07-09 中国移动通信集团湖北有限公司 Gprs用户投诉处理方法及集中处理系统
CN101951630A (zh) 2010-10-12 2011-01-19 武汉虹旭信息技术有限责任公司 一种提高cdma网络客服支撑能力的方法
CN102411106B (zh) * 2011-11-18 2014-01-15 广东电网公司广州供电局 电力变压器故障监测方法及装置
US8898092B2 (en) * 2012-01-31 2014-11-25 International Business Machines Corporation Leveraging user-to-tool interactions to automatically analyze defects in it services delivery
CN103036649B (zh) * 2012-12-17 2016-04-27 上海应用技术学院 基于高速列车的故障预警信息异构复用无线传输方法
CN103906112B (zh) 2012-12-28 2018-04-03 中国电信股份有限公司 通信网络性能的分析方法与系统
CN104021264B (zh) * 2013-02-28 2017-06-20 华为技术有限公司 一种缺陷预测方法及装置
CN103760901B (zh) * 2013-12-31 2016-06-29 北京泰乐德信息技术有限公司 一种基于关联规则分类器的轨道交通故障识别方法
US9628340B2 (en) * 2014-05-05 2017-04-18 Ciena Corporation Proactive operations, administration, and maintenance systems and methods in networks using data analytics
CN105306246B (zh) 2014-07-31 2018-08-21 中国移动通信集团浙江有限公司 一种自动应答网络类投诉的方法、装置和服务器
CN104349366B (zh) 2014-11-03 2017-09-01 四川公用信息产业有限责任公司 一种基于gis的无线网络问题关联分析方法
CN104301156B (zh) 2014-11-03 2018-04-24 杭州东方通信软件技术有限公司 一种客户投诉前移的预处理方法及其网络设备
CN104731083B (zh) * 2015-02-03 2017-06-20 浙江大学 一种基于自适应特征提取的工业故障诊断方法及应用
US10241852B2 (en) * 2015-03-10 2019-03-26 Siemens Aktiengesellschaft Automated qualification of a safety critical system
CN105045256B (zh) * 2015-07-08 2018-11-20 北京泰乐德信息技术有限公司 基于数据对比分析的轨道交通实时故障诊断方法和系统
CN105116872A (zh) * 2015-07-13 2015-12-02 哈尔滨工业大学 一种工业过程中基于度量学习与时间序列的故障诊断方法
CN105099791B (zh) 2015-09-02 2018-05-18 越亮传奇科技股份有限公司 一种基于网络信令监测数据的终端故障定位方法和系统
US10708795B2 (en) * 2016-06-07 2020-07-07 TUPL, Inc. Artificial intelligence-based network advisor

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110199911A1 (en) * 2010-02-18 2011-08-18 Oki Electric Industry Co., Ltd. Network fault detection system
CN101867486A (zh) * 2010-06-08 2010-10-20 江苏大学 一种无线传感器网络故障诊断方法
CN101917297A (zh) * 2010-08-30 2010-12-15 烽火通信科技股份有限公司 基于贝叶斯网络的核心网故障诊断方法及系统
CN102487343A (zh) * 2010-12-06 2012-06-06 中国人民解放军理工大学 卫星通信系统隐故障诊断预测方法
CN104794136A (zh) * 2014-01-22 2015-07-22 华为技术有限公司 故障分析方法和装置
CN106162710A (zh) * 2015-04-10 2016-11-23 富士通株式会社 故障检测装置、方法和系统

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111178423A (zh) * 2019-12-25 2020-05-19 国网电子商务有限公司 一种故障预警方法及装置
CN111178423B (zh) * 2019-12-25 2023-05-23 国网数字科技控股有限公司 一种故障预警方法及装置
CN113778837A (zh) * 2021-08-06 2021-12-10 北京奇艺世纪科技有限公司 页面故障确定方法、装置、电子设备及存储介质
CN113778837B (zh) * 2021-08-06 2023-09-26 北京奇艺世纪科技有限公司 页面故障确定方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
US11140021B2 (en) 2021-10-05
US20190215232A1 (en) 2019-07-11
CN107888397A (zh) 2018-04-06
CN107888397B (zh) 2020-12-25

Similar Documents

Publication Publication Date Title
WO2018059402A1 (zh) 确定故障类型的方法和装置
CN110177108B (zh) 一种异常行为检测方法、装置及验证系统
US11294754B2 (en) System and method for contextual event sequence analysis
US20180255470A1 (en) Network Event Prediction Method and Apparatus and Method and Apparatus for Establishing Network-Event Prediction Model
WO2018103453A1 (zh) 检测网络的方法和装置
CN108664480B (zh) 一种多数据源用户信息整合方法和装置
CN105446706B (zh) 用于评估表单页面使用效果及提供原始数据的方法及装置
CN107704387B (zh) 用于系统预警的方法、装置、电子设备及计算机可读介质
US11144376B2 (en) Veto-based model for measuring product health
US10291493B1 (en) System and method for determining relevant computer performance events
US9479414B1 (en) System and method for analyzing computing performance
JP6751168B2 (ja) 異常要因推定装置、異常要因推定方法及びプログラム
CN113313280B (zh) 云平台的巡检方法、电子设备及非易失性存储介质
CN111666193B (zh) 基于实时日志解析的终端功能监控与测试的方法与系统
US20190289480A1 (en) Smart Building Sensor Network Fault Diagnostics Platform
CN107888394B (zh) 网络故障原因定位的方法及装置
CN110647086B (zh) 一种基于运行大数据分析的智能运维监控系统
CN112437022A (zh) 网络流量识别方法、设备及计算机存储介质
CN116991677A (zh) 时序异常检测方法、装置、终端设备以及存储介质
WO2016200413A1 (en) Application session analysis and recommendation system
CN110647448A (zh) 一种移动应用操作日志数据实时分析方法、服务器和系统
CN117882062A (zh) 用于连续数据剖析的系统和方法
CN105897503B (zh) 基于资源信息增益的Hadoop集群瓶颈检测方法
CN114860543A (zh) 异常检测方法、装置、设备与计算机可读存储介质
CN113778831A (zh) 一种数据应用性能分析方法、装置、设备和介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17854852

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17854852

Country of ref document: EP

Kind code of ref document: A1