WO2019141144A1 - 确定网络故障的方法和装置 - Google Patents

确定网络故障的方法和装置 Download PDF

Info

Publication number
WO2019141144A1
WO2019141144A1 PCT/CN2019/071578 CN2019071578W WO2019141144A1 WO 2019141144 A1 WO2019141144 A1 WO 2019141144A1 CN 2019071578 W CN2019071578 W CN 2019071578W WO 2019141144 A1 WO2019141144 A1 WO 2019141144A1
Authority
WO
WIPO (PCT)
Prior art keywords
work order
order data
words
word
data set
Prior art date
Application number
PCT/CN2019/071578
Other languages
English (en)
French (fr)
Inventor
谭龙华
饶思维
田光见
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2019141144A1 publication Critical patent/WO2019141144A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F40/00—Handling natural language data
    • G06F40/20—Natural language analysis
    • G06F40/237—Lexical tools

Definitions

  • the present application relates to the field of computers, and in particular, to a method and apparatus for determining a network failure.
  • the network is an important part of modern industry and life.
  • the network can be defined as multiple devices or modules that can transmit information to each other.
  • multiple industrial robots located in different geographical locations communicate through electromagnetic waves, and the multiple industrial robots constitute A communication network; for example, a central processing unit (CPU), a memory module, and a hard disk located inside the same computer communicate through the main board, and the CPU, the memory module, and the hard disk also constitute a communication system.
  • CPU central processing unit
  • memory module a memory module
  • a hard disk located inside the same computer communicate through the main board
  • the CPU, the memory module, and the hard disk also constitute a communication system.
  • Network devices usually record a variety of data.
  • the fault may cause a variety of data to be abnormal, so that engineers can determine the cause of the fault and the location of the fault based on the relationship between the various data. Troubleshoot.
  • the data recorded by the network device includes the key performance indicator (KPI) of the network device, the alarm information, and the log.
  • KPI key performance indicator
  • the engineer can view the traffic indicator (belonging to the KPI) and the log. If the indicator is abrupt and the log has a corresponding CPU reset record, the engineer can determine that the current fault is caused by a CPU reset.
  • the above example is only an illustrative example.
  • the structure of the network is very complicated, and the amount of data recorded by the network device is also very large. It is very difficult to rely on the engineer to find the data with the associated relationship from the massive data.
  • the prior art uses frequent mining techniques to determine data with associated relationships.
  • the frequent mining technology determines the association relationship between different data by counting the number of times different data co-occur in the same transaction. However, some data with actual associated relationships appear together. The number of times is low, and frequent mining techniques cannot discover the association of such data.
  • multiple data that occur in the same transaction with a higher number of times do not necessarily have an association relationship. Therefore, how to accurately determine the data with the associated relationship from the massive data is an urgent problem to be solved.
  • the present application provides a method and apparatus for determining a network failure, which can improve the accuracy of determining data having an association relationship from data recorded by the network.
  • the first aspect provides a method for determining a network fault, including: acquiring a to-be-processed work order data set, where the to-be-processed work order data set corresponds to at least one network state, and the to-be-processed work order data set includes multiple work order data,
  • the plurality of work order data of the to-be-processed work order data set includes at least two different types of data; and the plurality of work order data of the work order data set to be processed according to a preset coding rule is formatted and encoded to generate a plurality of to-be-processed words,
  • the plurality of to-be-processed words belong to a pre-obtained dictionary, the dictionary includes a plurality of words and a plurality of word vectors corresponding to the plurality of words; determining a target word from the plurality of to-be-processed words according to a preset determination rule, and determining a predetermined rule For determining a word indicating an abnormal network state,
  • the word vector association mining model is a method for analyzing the relationship between data. If the two data are data with association relationship, even if the frequency of the two data coexisting is not high, the word vector association mining model is also The relationship between the two data can be determined. However, the input quantity processed by the word vector association mining model is a word vector.
  • the word vector is a kind of data that satisfies a specific rule. Different word vectors have a mathematical relationship, while the work order data is isolated. Data, there is no mathematical relationship between different types of work order data, and the word vector association mining model cannot directly process such isolated data.
  • the word vector with the associated relationship is determined by the word vector association mining model, and the work order data with the associated relationship can be determined by the correspondence between the word vector and the work order data.
  • the work order data with the closest relationship with the alarm information A is determined by the flow data index A and the log A from the large amount of work order data, and the flow index A and the log A are displayed, thereby facilitating the engineer. Quickly determine the cause of the fault and the location of the fault in the abnormal network state, and eliminate the network fault in time.
  • the method further includes: acquiring a historical work order data set, where the historical work order data set corresponds to at least one network status, the historical work order data The set includes a plurality of work order data, wherein the work order data of the historical work order data set includes at least two different types of data; and the work order data of the historical work order data set is formatted and encoded according to a preset encoding rule.
  • a plurality of word vectors and a plurality of words corresponding to the historical work order data set are obtained as a dictionary.
  • the dictionary Before processing the work order data to be processed, the dictionary can be obtained according to the work order data in the historical work order data set, so that when the work order data to be processed is processed, the word vector corresponding to the work order data to be processed can be found from the dictionary. So that M candidate words can be quickly determined.
  • the method further includes: corresponding to each work order data.
  • the time corresponding to the work order data having the associated relationship is relatively close.
  • the work order data is divided according to the time period, so that the relationship between the words in the sentence is more tight, which is beneficial to improving the word vector association relationship mining model. s efficiency.
  • dividing the plurality of work order data of the historical work order data set into the at least two work order data sets according to the time corresponding to each work order data including: according to each work order data corresponding time and the first time
  • the length threshold divides the plurality of work order data of the historical work order data set into at least two sub-work order data sets, and the length of the time period corresponding to any one of the at least two sub-work order data sets is greater than or equal to the first time length threshold.
  • the time corresponding to each work order data refers to the generation time of each work order data.
  • the above embodiment divides the work order data set according to time, so that each obtained work order data set has a time attribute, which can be based on the empirical value. Or the correlation result of the work order data is set to the first time length threshold, and the time period for dividing the work order data set is too short, and the work order data with the association relationship is reduced to be divided into different sub-work order data sets. Probability is beneficial to improve the efficiency of the word vector association mining model and the accuracy of the mining results.
  • the first sub-work order data set of the at least two sub-work order data sets includes first work order data for indicating an abnormal network working status, the time corresponding to the first work order data, and the first sub-work order data.
  • the distance of the left boundary of the time period corresponding to the set is greater than or equal to the second time length threshold, and the distance corresponding to the right boundary of the time segment corresponding to the first work order data set is greater than or equal to the first time Three time length thresholds.
  • Work order data for example, first work order data
  • first work order data for indicating an abnormal network status
  • the work order data is divided into the probability of being the same sub-work order data set, and the second time length threshold and the third time length threshold may be set according to experience, or may be set according to the statistical result of the relationship data of the work order data.
  • the alarm information is used to indicate the abnormal network working state.
  • the generation time of the work order data with the close relationship with the alarm information is close to the generation time of the alarm information, and the generation time of the alarm information can be used as the reference point. Selecting a period of time improves the probability that the work order data associated with the alarm information is divided into the same sub-work order data set, which is beneficial to improve the accuracy of the mining result of the word vector association mining model.
  • the method further includes: according to each work order The network device corresponding to the data divides the plurality of work order data of the historical work order data set into at least two sub-work order data sets, and the at least two sub-work order data sets correspond to at least two network devices one by one; according to the preset
  • the encoding rule formats and encodes the plurality of work order data of the historical work order data set to generate a plurality of words corresponding to the historical work order data set, and comprises: formatting and encoding the at least two sub-work order data sets according to the preset encoding rule.
  • At least two sentences, at least two sub-work order data sets are in one-to-one correspondence with at least two sentences, wherein the at least two sentences include a plurality of words corresponding to the historical work order data set.
  • the work order data belonging to the same network device has a closer relationship.
  • the work order data set is divided according to the network device to which the work order data belongs, so that the words in the statement are made.
  • the relationship between the two is more closely related, which is beneficial to improve the efficiency of the word vector association mining model.
  • the formatting and encoding the plurality of work order data of the work order data set to be processed according to the preset encoding rule to generate the plurality of to-be-processed words includes: determining at least two numerical intervals and identification information corresponding to the at least two numerical intervals Where the identification information corresponding to the different numerical interval is different; determining the to-be-processed according to the correspondence between the values of the plurality of work order data of the work order data set to be processed and the at least two numerical intervals and the identification information corresponding to the at least two numerical intervals Identification information corresponding to multiple work order data of the work order data set; formatting and encoding multiple work order data of the work order data set to be processed according to the identification information corresponding to the plurality of work order data of the work order data set to be processed a plurality of words to be processed, wherein any one of the plurality of words to be processed includes at least one piece of identification information.
  • the work order data corresponding to the same data interval in the plurality of work order data of the work order data set to be processed may correspond to one identification information, or may correspond to multiple identification information, wherein the plurality of identification information and the work order data set to be processed
  • the work order data corresponding to the same data interval among the plurality of work order data is in one-to-one correspondence.
  • the combination of different identification information corresponds to different network states, and therefore, words generated using the above encoding method can directly reflect different network states.
  • the first word of the plurality of to-be-processed words includes at least one of data type information of the work order data corresponding to the word, abnormal network work type information, and work order data identifier, the first word is more Any one of the words to be processed;
  • the second word of the plurality of words included in the dictionary includes data type information of the work order data corresponding to the second word, abnormal network work information, and work order data identifier At least one, the second word is any one of a plurality of words included in the dictionary;
  • the third word of the plurality of words corresponding to the historical work order data set includes data type information of the work order data corresponding to the third word At least one of abnormal network work information and work order data identifier, the third word being any one of a plurality of words corresponding to the historical work order data set.
  • a second aspect provides a device for determining a network fault, where the device can implement the functions corresponding to the steps in the method involved in the foregoing first aspect, and the function can be implemented by using hardware or by executing corresponding software through hardware.
  • the hardware or software includes one or more units or modules corresponding to the functions described above.
  • the apparatus includes a processor and a transceiver configured to support the apparatus to perform the respective functions of the methods involved in the first aspect above.
  • the transceiver is used to support communication between the device and other network elements.
  • the apparatus can also include a memory for coupling with the processor that retains the program instructions and data necessary for the apparatus.
  • a computer readable storage medium the computer program code storing computer program code, when executed by a processing unit or a processor, causing a device that determines a network failure to perform the first aspect Said method.
  • a chip in which instructions are stored that, when run on a device that determines a network failure, cause the chip to perform the method of the first aspect above.
  • a computer program product comprising: computer program code, when the computer program code is determined to be a communication unit or transceiver of the network faulty device, and the processing unit or processor is operative to cause The network failure device performs the method of the first aspect described above.
  • FIG. 1 is a schematic diagram of a method for training words based on a Huffman tree provided by the present application
  • FIG. 2 is a schematic diagram of an apparatus for determining a network fault provided by the present application
  • FIG. 3 is a schematic diagram of a method for determining a network fault provided by the present application.
  • FIG. 4 is a schematic diagram of a method for processing continuous work order data provided by the present application.
  • FIG. 5 is a schematic diagram of a method for determining candidate words provided by the present application.
  • FIG. 6 is a schematic diagram of a method for generating a corpus provided by the present application.
  • FIG. 7 is a schematic diagram of a method for dividing a work order data set provided by the present application.
  • FIG. 8 is a schematic diagram of another method for processing continuous work order data provided by the present application.
  • FIG. 9 is a schematic diagram of a divided work order data set provided by the present application.
  • FIG. 10 is a schematic diagram of another apparatus for determining a network fault provided by the present application.
  • FIG. 11 is a schematic diagram of still another apparatus for determining a network fault provided by the present application.
  • the work order data is data recorded by the network device to reflect the running status of the network, for example, KPI, alarm information, and log, and mathematical data of different types of work order data compared with data obtained by encoding data according to a specific mathematical model.
  • the computer can store and identify two different work order data, but it is difficult to distinguish whether there is correlation between two different work order data, that is, there is also a vocabulary gap between work order data. . Therefore, the effect of directly calculating the association relationship of different types of work order data according to the mathematical statistical model (for example, frequent mining technology) is generally not ideal, and it is necessary to find an association capable of calculating different types of work order data according to the characteristics of the work order data.
  • the method of relationship is generally not ideal, and it is necessary to find an association capable of calculating different types of work order data according to the characteristics of the work order data. The method of relationship.
  • work order data Another characteristic of work order data is that the meanings represented by different work order data are related. For example, when the alarm information appears, it is usually accompanied by the change of KPI and the log of abnormal phenomena, different work order data. This association between them is essentially a contextual relationship, so a way to calculate the contextual relationship between data can be found to measure the correlation between work order data.
  • the word vector association mining model is a method for measuring the correlation between data with context.
  • the model cannot directly process data with vocabulary gap characteristics. Therefore, the work order data needs to be processed to eliminate the work.
  • the lexical gap feature of single data is a method for measuring the correlation between data with context.
  • Word Embedding is a method that can transform data with lexical gap characteristics into data with semantic associations.
  • the principle of this method is to use the context between words in a sentence to vocabulary (ie, The data is transformed into a word vector, and the generated word vectors have a mathematical correlation, so that the word vector association mining model can be used to measure the relationship between the word vectors, thereby determining the relationship between the work order data.
  • Commonly used word embedding includes continuous bag of words (CBOW) models and skip-gram models. Both the CBOW model and the jump model are based on the Huffman tree. Below is a brief description of the principle of generating a word vector using the CBOW model as an example.
  • Figure 1 shows a schematic diagram of a method of training words based on a Huffman tree.
  • context(w) refers to the context of the word w, for example, in the statement containing the word w, the first c words of the word w and the last c words;
  • ⁇ i represents the i-th middle of the Huffman tree The parameters of the node.
  • the probability of the occurrence of the word w is:
  • the training goal of the CBOW model is to maximize the above posterior probability.
  • the CBOW model adjusts the parameters of the intermediate node and the word vector during the training process, so that when a certain word context is given, the probability of occurrence of the word is maximized.
  • the mathematics is expressed as:
  • ⁇ is the intermediate node parameter of the Hafman tree
  • D is the set of all words in the corpus.
  • FIG. 2 shows a schematic diagram of an apparatus for determining a network failure provided by the present application.
  • the apparatus 200 includes a word vector training module 210 and an association relationship mining module 220.
  • the word vector module 210 includes a symbolization module 211, a corpus generation module 212, and a word embedding module 213.
  • the symbolization module 211 is configured to receive work order data, and convert various types of work order data into words in a uniform format for subsequent processing by the module.
  • the corpus module 212 is configured to divide the data after the symbolization according to a predetermined rule. For example, the words corresponding to the work order data in the same time period may be divided into a set, and the words in the one set have strong association. Sex, then organize the words in the collection into a single statement in a certain order.
  • a work order can usually generate a document containing multiple statements, and a document corresponding to multiple work orders forms a corpus.
  • the word embedding module 213 is configured to perform word vector training on the corpus to generate a word vector. For example, according to the method shown in FIG. 1, the word vector and the parameters of the intermediate node are continuously adjusted during the training process, so that a certain word context is given. At this time, the probability of occurrence of the word is maximized, and at this time, the word vector of the word is trained. After the word vectors in the entire corpus are trained, a dictionary is generated, and the dictionary includes all the words in the corpus and the word vectors corresponding to the all words.
  • the association relationship mining module 220 is configured to analyze (also referred to as “mining”) the association relationship between the words in the word set to be processed and the target word, wherein the word set is processed by the symbolization module 211 for the work order data to be processed. After generating the set, the target word belongs to the word set, and the dictionary generated by the word embedding module 213 includes all the words in the word set, so that the word vector module can be used to train and mine the relationship between the target word and other words in the word set. And according to the correspondence between the word and the work order data, some work order data closely related to the target work order data is displayed, and is used for the engineer to determine the network fault.
  • FIG. 2 is a description of the apparatus 200 for determining a network fault from a functional point of view.
  • Each module in FIG. 2 may have a more detailed division manner in some specific products, or each module in FIG. 2 is in another Some products are implemented in an integrated manner, which is not limited in this application. Additionally, device 200 may also include other modules.
  • the various modules shown in FIG. 2 may be software modules that implement corresponding functions when executed by the processor.
  • the modules shown in FIG. 2 can also be implemented in the form of hardware, such as a processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), and a field programmable gate.
  • DSP digital signal processor
  • ASIC application-specific integrated circuit
  • FPGA field programmable gate array
  • FPGA field programmable gate array
  • FIG. 3 shows a schematic diagram of a method for determining a network failure provided by the present application.
  • the method 300 includes:
  • S310 Acquire a work order data set to be processed, where the to-be-processed work order data set corresponds to at least one network status, and the to-be-processed work order data set includes multiple work order data, where the plurality of work order data of the to-be-processed work order data set includes At least two different types of data.
  • S320 Formatting and encoding a plurality of work order data of a work order data set according to a preset encoding rule to generate a plurality of to-be-processed words, the plurality of to-be-processed words belong to a pre-obtained dictionary, and the dictionary includes a plurality of words and Multiple word vectors corresponding to multiple words.
  • S330 Determine a target word from a plurality of to-be-processed words according to a preset determination rule, where the preset determination rule is used to determine a word indicating an abnormal network state, and the target word is used to indicate at least one abnormal network state.
  • S340 Determine, according to the dictionary, a plurality of word vectors corresponding to the plurality of words to be processed.
  • S350 Determine, according to the word vector association mining model and the plurality of word vector sets corresponding to the plurality of to-be-processed words, the relationship between the word in the first word set and the target word, where the first word set is a target of the plurality of to-be-processed words.
  • M is a preset positive integer
  • the work order data corresponding to the M candidate words and the work order data corresponding to the target word are used to determine the target word indication.
  • the fault of the abnormal network state, the close relationship between the candidate word of the M candidate words and the target word is greater than the close relationship between the relationship between any one of the second word set and the target word, and the second word set is the second A collection of words other than M candidate words in a set of words.
  • the method 300 can be performed, for example, by the device 200, wherein the to-be-processed work order data in S310 is, for example, at least one KPI and at least one alarm information, and the number of work order data of each type is not limited in the present application.
  • Each work order data in the work order data to be processed in S310 may be continuous data or discrete data, and the work order data to be processed may be generated by the device 200 or received from other devices, for example, The transceiver or communication interface receives the work order data to be processed.
  • the work order data indicating the abnormal network status may be obtained from the continuous work order data according to a preset rule, and the abnormal network is indicated.
  • the status of the work order data is used as the input quantity of the formatted code in S320 to generate a plurality of words to be processed, so that the continuous work order data can be discretized, the work order data irrelevant to the network fault can be reduced, and the word vector association relationship mining model can be improved. effectiveness.
  • the function of the continuous work order data and the time may be a smooth curve, a non-smooth curve, or a multi-segment curve, which is not limited in this application.
  • the smooth curve when the network fault occurs, the smooth curve usually changes suddenly, that is, the work order data of the smooth curve sudden position reflects the network fault, in order to reduce the network fault.
  • Unrelated work order data improves the efficiency of the word vector association mining model. Only the mutation data can be selected as the work order data for generating words and the word vector training.
  • the KPI and time function image is a smooth curve.
  • the point on the curve can be judged according to whether the absolute value of the derivative value of the curve exceeds the derivative threshold. Whether it is a mutation point, selecting the work order data of the two mutation points as the work order data used to generate the corpus can reduce the work order data irrelevant to the network failure, and improve the efficiency of the word vector association mining model.
  • S320 may be executed by the symbolization module 211 shown in FIG. 2, and the work order data may be formatted and encoded according to "data type_data identifier_exception type” (also referred to as “symbolization"), or may be followed by " The data type_data identifier_anomaly encodes the work order data or encodes the work order data according to other rules. You can encode one work order data to generate one word, or you can encode multiple work order data to generate one word.
  • the result of encoding according to "data type_data identifier_exception type” is the word “kpi_TS01_1", where kpi indicates that the data type corresponding to the word is KPI, and TS01 indicates the data identifier, which may be a KPI
  • the time series, 1 indicates the type of anomaly of the KPI, for example, a sudden increase or a sudden drop.
  • the result of encoding according to "data type_data identifier_abnormal phenomenon" is the word “kpi_TS01_baa", where kpi indicates that the data type corresponding to the word is KPI, and TS01 indicates
  • the data identifier may take a time sequence of three KPIs as a data identifier, and baa is information for indicating an abnormal phenomenon obtained by symbolizing the values of the three KPIs.
  • the plurality of to-be-processed words generated in S320 belong to a previously obtained dictionary, and the dictionary includes a plurality of words and a plurality of word vectors corresponding to the plurality of words, so that a plurality of words corresponding to the plurality of words to be processed can be acquired according to the dictionary vector.
  • the dictionary may be generated by the word vector training module 210, or may be received through a communication interface or a transceiver. The present application does not limit how the device 200 obtains a dictionary.
  • the preset determination rule is, for example, determining a word corresponding to the sudden change point on the smooth curve as the target word, or determining the word corresponding to the alarm information as the target word, or corresponding to the work order data input by the engineer.
  • the word is determined as the target word.
  • the target word may be a word or a plurality of words. Further, the target word may be a word for indicating an abnormal network state, or may be a word for indicating a plurality of abnormal network states.
  • S350 can be directly executed by the relationship mining module 220. If some words in the to-be-processed word set do not belong to the dictionary, it is necessary to train the part of the word to generate a word vector, and add the generated word vector and the part of the word to the dictionary, and then execute S350.
  • the association relationship mining model in S350 determines the closeness of the association relationship between word vectors by calculating the cosine distance between word vectors. The smaller the cosine distance, the closer the relationship between word vectors is.
  • the device 200 determines the association relationship between the words in the first word set and the target word, and then selects the M words closest to the target word from the first word set as the candidate words, the M
  • the work order data corresponding to the candidate words and the work order data corresponding to the target word are used to determine the fault of the abnormal network working state, and the work order data corresponding to the M candidate words and the work order data corresponding to the target word may be displayed for Engineers use.
  • the second word set is a zero set, and the relationship between the work order data in the zero set and the target word is the most alienated relationship, for example, to be processed.
  • the words are word A and word B, wherein word A is the target word, then the first word set is a set of word B, and the second word set is a zero set, because the work order data in the zero set is associated with the target word
  • device 200 determines that word B is a candidate word.
  • the work order data with the closest relationship with the work order data indicating the abnormal network working state can be determined from the large amount of work order data, and the work order data with the closest relationship is displayed, for example, when the network
  • the frequency at which A and alarm information A coexist is small.
  • the method 300 can also determine that the work order data with the closest relationship with the alarm information A is the traffic index A and the log A, thereby facilitating the engineer to quickly determine the cause and location of the network fault. , timely troubleshoot network problems.
  • the method 300 further includes:
  • S301 Acquire a historical work order data set, where the historical work order data set corresponds to at least one network status, where the historical work order data set includes a plurality of work order data, and the work order data set of the historical work order data set includes at least two different Type of data.
  • S304 Obtain a dictionary according to the plurality of word vectors corresponding to the historical work order data set and the plurality of words corresponding to the historical work order data set.
  • the at least one network state may be, for example, an operating state of the network device when performing a computing task, or may be an operating state of the network device when performing the storage task, or may be another working state.
  • the plurality of work order data included in the historical work order data set is a plurality of work order data recorded by the network device when in the at least one network state, and the historical work order data set is the existing work order data used to generate the dictionary, in S301.
  • the historical work order data set may be all the work order data sets required to generate the dictionary, the device 200 executes the S301-S304 to generate the dictionary once; the historical work order data set page in S301 may be the partial work order data set required to generate the dictionary.
  • the device 200 executes the S301-S304 multiple times to generate a dictionary.
  • the encoding rule in S302 is the same as the encoding rule in S320, and can be executed by the symbolization module 211.
  • S303 and S304 may be executed by the word embedding module 213 shown in FIG. 2, and the word vector training model in S330 may be, for example, the CBOW model shown in FIG. 1, and the word vector training model is used to train the word generating word vector, each word is unique.
  • a dictionary is generated, which contains a plurality of words and a word vector corresponding to each word.
  • the method 300 further includes:
  • the plurality of work order data of the historical work order data set is divided into at least two sub-work order data sets according to the time corresponding to each work order data, and the at least two sub-work order data sets are combined with at least two time periods. correspond.
  • S302 includes:
  • the time corresponding to the work order data having the associated relationship is relatively close.
  • the work order data set is divided according to the time period, so that the relationship between the words in the sentence is more tight, which is beneficial to improve the word vector association relationship mining.
  • the efficiency of the model. S305 can be executed by the corpus generation module 212, and the flow of generating the corpus is as shown in FIG. 6.
  • FIG. 7 is a schematic diagram of a method for performing a time slicing operation on work order data provided by the present application.
  • the current work order data includes a KPI, an alarm information, and a log
  • the three work order data constitute a work order data set, and time slice the work order data set according to a preset time period to obtain multiple sub-items.
  • the work order data set for example, the first sub-work order data set includes two sets of KPIs, alarm information A, alarm information B, and log A, and the words obtained by symbolizing the work order data constitute a statement.
  • S305 includes:
  • S3051 Divide, according to the time corresponding to each work order data and the first time length threshold, the work order data of the historical work order data set into at least two sub-work order data sets, and any of the at least two sub-work order data sets.
  • a corresponding time period length is greater than or equal to the first time length threshold.
  • the time corresponding to each work order data refers to the time at which each work order data is generated. If the time period for time slice selection of the work order data set is too long, there are more words with more distant associations in the sentence, which will result in lower efficiency of the word vector association mining model; if event slice is performed on the work order data set If the selected time period is too short, the two closely related words may be divided into different sentences, which will cause the word vector generated by the training word to be not the preferred word vector, and mining the mining model using the word vector association relationship. The association of target words has a negative impact.
  • the first time length threshold may be set according to the empirical value or the association relationship statistics of the work order data, so that the time period for dividing the work order data set is too short, and the work order data with the association relationship is reduced.
  • the probability of being divided into different sub-worksheet data sets is beneficial to improve the efficiency of the word vector association mining model and the accuracy of the mining results.
  • the first sub-work order data set of the at least two sub-work order data sets includes first work order data for indicating an abnormal network working status, the time corresponding to the first work order data, and the first sub-work order data.
  • the distance of the left boundary of the time period corresponding to the set is greater than or equal to the second time length threshold, and the distance corresponding to the right boundary of the time segment corresponding to the first work order data set is greater than or equal to the first time Three time length thresholds.
  • Work order data for example, first work order data
  • the probability that the work order data of the relationship is divided into the same sub-work order data set, the second time length threshold and the third time length threshold may be set according to experience, or may be set according to the statistical result of the relationship data of the work order data.
  • the alarm information is used to indicate the abnormal network working state.
  • the generation time of the work order data with the close relationship with the alarm information is close to the generation time of the alarm information, and the generation time of the alarm information can be used as the reference point. Selecting a period of time improves the probability that the work order data associated with the alarm information is divided into the same sub-work order data set, which is beneficial to improve the accuracy of the mining result of the word vector association mining model.
  • the second time length threshold and the third time length threshold may or may not be equal.
  • the second time length threshold and the third time length threshold are both 3 minutes.
  • a sudden change point in the KPI a sharp protrusion on a smooth curve
  • the work order data set is divided into 5 minutes for each time, and a sub-work order data set with a length of 10 minutes is obtained, thereby reducing other work order data related to the mutation point.
  • the above two 5 minutes are the length of time between the left and right boundaries of the time point.
  • the method 300 further includes:
  • the network device corresponding to each work order data divides the plurality of work order data of the historical work order data set into at least two sub-work order data sets, and the at least two sub-work order data sets and the at least two network devices are one by one. correspond.
  • S302 includes: formatting and encoding at least two sub-job data sets according to a preset encoding rule to generate at least two sentences, where at least two sub-work order data sets are in one-to-one correspondence with at least two sentences, wherein At least two sentences include multiple words of the historical work order data set.
  • the work order data belonging to the same network device has a closer relationship.
  • the work order data set is divided according to the network device to which the work order data belongs, so that the words in the statement are made.
  • the relationship between the two is more closely related, which is beneficial to improve the efficiency of the word vector association mining model.
  • S320 includes:
  • S321. Determine identification information corresponding to the at least two value intervals and the at least two value intervals, where the identifier information corresponding to the different value intervals is different.
  • S322. Determine, according to the correspondence between the values of the plurality of work order data of the work order data set to be processed and the at least two numerical intervals and the identification information corresponding to the at least two numerical intervals, the plurality of work order data corresponding to the work order data set to be processed. Identification information.
  • S333 Formatting and encoding a plurality of work order data of the work order data set to be processed according to the identification information corresponding to the plurality of work order data of the work order data set to be processed, and generating a plurality of to-be-processed words, wherein the plurality of to-be-processed words Processing any of the words includes at least one identification information.
  • the work order data corresponding to the same data interval in the work order data of the work order data set may correspond to one identification information, or may correspond to multiple identification information, wherein the plurality of identification information and the work order data set to be processed are multiple
  • the work order data corresponding to the same data interval in the work order data corresponds one-to-one.
  • the combination of different identification information corresponds to different network working states. Therefore, words generated by using the above encoding method can directly reflect different network working states.
  • C in the left diagram represents a curve that represents continuous work order data as a function of time, where the horizontal axis is the time axis and the vertical axis is the work order data axis, dividing the curve into multiple Curve segment (ie, discretization), C represents the image of the approximate value of each curve segment after the discretization operation of the curve (horizontal line segment), for example, the ordinate value of each curve segment can be averaged, and the vertical axis of the coordinate system
  • Three numerical intervals (such as the right image) are set, the work order data falling into the lower numerical interval is assigned a, the work order data falling into the intermediate numerical interval is assigned b, and the work order data falling into the upper numerical interval is assigned c, the above a, b and c are different identification information, and the result is aabbcc.
  • the continuous work order data is KPI
  • the final generated word is kpi_TS01_aabbcc
  • the word obtained by the coding method can directly reflect the network.
  • the working state
  • the discretization method shown in Fig. 8 is symbolic aggregate approximation (SAX), that is, the distribution probability of the curve segment in the three numerical intervals is subject to the distribution curve on the right side of Fig. 8, and other discretization methods can be used. For example, a uniform discretization method.
  • SAX symbolic aggregate approximation
  • the input work order data includes KPI, alarm information and log, the horizontal axis represents the time axis, and the vertical axis represents the axis corresponding to each work order data.
  • the KPI is a bivariate data named TS01 and TS02.
  • the continuous time series symbolization module in the symbolization module 211 performs an abnormality detection on the KPI, and finds that there is a sudden abnormal point in the TS01, and a sudden drop abnormal point exists in the TS02.
  • the agreed burst type symbol is "1", and the sign is "#”, and then symbolized to generate the following two words: kpi_ts01_1, kpi_ts02_2.
  • the discrete data symbolization module in the symbolization module 211 symbolizes the alarm information and the log, and generates words such as alarm_a, alarm_b, alarm_c, alarm_d, and alarm_e.
  • the log is symbolized to generate log_a, log_b, log_c, log_e, Log_f these words.
  • the corpus module 212 performs time slicing on the work order data according to the set time interval to form work order data corresponding to multiple time windows. Then, according to the KPI, the alarm information, and the order of the logs, the words appearing in the same window are sequentially connected to form a single statement.
  • the statement composed of the first time window is: kpi_ts01_1, alarm_a log_a; the statements of the second window are: kpi_ts02_2, alarm_b, alarm_c, log_c; the third time window has no KPI related words, forming the sentence alarm_d, log_e; And so on, forming multiple statements:
  • the work order data shown in Figure 9 corresponds to five statements, which together form an article.
  • the word embedding module 213 performs word vector training on the corpus generated by the corpus module 212 using the CBOW model as shown in FIG.
  • the words corresponding to the work order data shown in FIG. 9 are used as a corpus, and the words in the corpus are trained by setting parameters such as the length of the word vector to obtain a word vector, and the partial word vectors are as follows:
  • Kpi_ts01_1 [0.17468844 -3.15235829 -1.70313048 -0.08540603 -2.66887307]
  • Kpi_ts02_2 [2.92323542 -1.19825315 -0.14672463 -1.04043281 2.63267684]
  • the word vector association relationship mining module 220 performs an operation of mining the association relationship between the word vectors.
  • the set of words to be processed generated according to the work order data to be processed is the same as the word in the corpus.
  • One way to measure the relationship is to calculate the distance between the word vectors using the cosine distance.
  • the target word is kpi_ts02_2, and is closest to kpi_ts02_2.
  • the 2 words are: (alarm_b, 0.6114) and (alarm_c, 0.6096).
  • the first element of the above binary group represents a word
  • the second element represents the cosine distance of the word kpi_ts02_2
  • the cosine distance is based on Get, where d represents two vectors with Cosine distance, Represents the inner product of the two vectors, Represents the product of the moduli of the two vectors.
  • x) represents the probability of occurrence of the word w in the context x, for example, in the case where the target word kpi_ts01_1 appears
  • the probability of occurrence of other words, the top five words with the highest probability are: (alarm_a, 0.50897503), (log_a, 0.48480666), (kpi_ts02_2, 0.0035087806), (kpi_ts01_1, 0.001931924), (alarm_e, 0.00074308913), each of which The first element of the two-tuple represents the word, and the second element represents the probability of the word appearing.
  • the cosine distance measures the degree of similarity in the structure of the statement. The larger the cosine distance, the more similar the background.
  • the posterior probability directly measures the probability that other words appear when the background is x. If the engineer's current work order data is abnormal A, the engineer is recommended to the engineer with the highest probability of occurrence of the abnormal A in the current work order data. Single data.
  • the method of generating a corpus is the same as that of S901 to S903, and details are not described herein again.
  • the word embedding module 213 After the corpus is generated, the word embedding module 213 performs a word vector training on the corpus generated by the corpus module 212 using the jump model. Contrary to the CBOW model training method, the purpose of the jump model training is to adjust the word vector and other parameters when the target word is given, so that the probability of the context of the target word appears to be the greatest.
  • the words corresponding to the work order data shown in FIG. 9 are used as a corpus, and the words in the corpus are trained by setting parameters such as the length of the word vector to obtain a word vector, and the partial word vectors are as follows:
  • Kpi_ts01_1 [0.63125104 -4.25858593 0.35638022 -1.92799687]
  • Kpi_ts02_2 [2.10638261 -1.43733919 -2.21027827 0.25722837]
  • the word vector association mining module 220 performs an operation of mining the association relationship on the target word.
  • the two words closest to the word kpi_ts02_2 are: (alarm_b, 0.9925) and (log_c, 0.8371), the first element of the tuple represents the word, and the second element represents the cosine distance from kpi_ts02_2. Comparing the mining results of the above two word vector training models, we can find that the different word vector training models have different effects on the cosine distance, but the sorting results of the words with the target words are the same, indicating the network determined by the present application. The method of failure is credible.
  • the probability of occurrence of other words in the case of the occurrence of the target word kpi_ts01_1 is calculated.
  • the first five words with the highest probability are: (alarm_a, 0.57739365), ( Log_a, 0.40243161), (kpi_ts01_1, 0.0087259663), (kpi_ts02_2, 0.0058389762), (alarm_b, 0.0045104912), where the first element of each tuple represents a word and the second element represents the probability of occurrence. From the numerical relationship, it can be concluded that when kpi_ts01_1 occurs, the word alarm_a may be the largest, followed by log_a, and the result of the association mining is the same as that of the dictionary trained by the CBOW model.
  • the device for determining a network failure includes a corresponding hardware structure and/or software module for performing each function in order to implement the above functions.
  • the present application can be implemented in a combination of hardware or hardware and computer software in combination with the elements and algorithm steps of the various examples described in the embodiments disclosed herein. Whether a function is implemented in hardware or computer software to drive hardware depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods to implement the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present application.
  • the application may perform the division of the functional unit on the device for determining the network failure according to the above method example.
  • each functional unit may be divided according to each function in the manner shown in FIG. 2, or two or more functions may be integrated in the In a processing unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit. It should be noted that the division of the unit in the present application is schematic, and is only a logical function division, and the actual implementation may have another division manner.
  • FIG. 10 shows a possible structural diagram of the apparatus for determining a network failure involved in the above embodiment.
  • the apparatus 1000 for determining a network failure includes a processing unit 1002 and an acquisition unit 1003.
  • the processing unit 1002 is configured to control manage the actions of the device 1000 that determines the network failure, for example, the processing unit 1002 is configured to support the determining of the network failure by the apparatus 1000 to perform the various steps of FIG. 3 and/or other techniques for the techniques described herein. process.
  • the obtaining unit 1003 is configured to support the device 1000 for determining a network failure to acquire information to be processed, for example, acquiring at least two work order data from the network device.
  • the apparatus 1000 for determining a network failure may further include a storage unit 1001 for storing program codes and data of the apparatus 1000 that determines a network failure.
  • the obtaining unit 1003 acquires to-be-processed work order data, where the to-be-processed is used to indicate a network working state, and the at least two work order data includes at least two different types of data;
  • the processing unit 1002 performs format coding on the to-be-processed work order data acquired by the obtaining unit 1003 according to the encoding rule to generate a to-be-processed word set, where the words in the to-be-processed word set have the same format, and the to-be-processed word set includes at least two a word, the set of words to be processed belongs to a pre-obtained dictionary, the dictionary includes a plurality of words and a plurality of word vectors corresponding to the plurality of words; determining a target from the set of to-be-processed words according to a preset determination rule a word, the preset determining rule is configured to determine a word indicating an abnormal network state, the target word is used to indicate at least one abnormal network working state; and determining, according to the dictionary, a word vector set corresponding to the to-be-processed word set, The set of word vectors corresponding to the set of processed words includes a target word vector corresponding to the target word;
  • the processing unit 1002 may be a processor or a controller, such as a CPU, a general purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), and a field programmable gate array. (field programmable gate array, FPGA) or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the acquisition unit 1003 can be a transceiver or a communication interface.
  • the storage unit 1001 may be a memory.
  • the apparatus for determining a network failure involved in the present application may be the apparatus shown in FIG.
  • the apparatus 1100 includes a processor 1102, a transceiver 1103, and a memory 1001.
  • the transceiver 1103, the processor 1102, and the memory 1101 can communicate with each other through an internal connection path to transfer control and/or data signals.
  • the apparatus 1000 for determining a network fault and the apparatus 1100 for determining a network fault provided by the present application process the work order data and use the word vector association relationship mining model to mine the relationship between the work order data, if the two work order data have The data of the association relationship, even if the frequency of the two work order data coexisting is not high, the word vector association mining model can determine the association relationship between the two work order data, and the device provided by the present application is compared with the frequent mining technology. It can improve the accuracy of mining the relationship of work order data.
  • the device embodiment and the method embodiment are completely corresponding, and the corresponding steps are performed by the corresponding module.
  • the obtaining unit performs the obtaining step in the method embodiment, and the steps other than the obtaining step may be performed by the processing unit or the processor.
  • the processing unit or the processor For the function of the specific unit, reference may be made to the corresponding method embodiment, and details are not described.
  • the size of the sequence number of each process does not mean the order of execution sequence, and the order of execution of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the present application.
  • the steps of a method or algorithm described in connection with the present disclosure may be implemented in a hardware or may be implemented by a processor executing software instructions.
  • the software instructions may be composed of corresponding software modules, which may be stored in a random access memory (RAM), a flash memory, a read only memory (ROM), an erasable programmable read only memory ( Erasable programmable ROM (EPROM), electrically erasable programmable read only memory (EEPROM), registers, hard disk, removable hard disk, compact disk read only (CD-ROM) or any other form of storage medium known in the art.
  • An exemplary storage medium is coupled to the processor to enable the processor to read information from, and write information to, the storage medium.
  • the storage medium can also be an integral part of the processor.
  • the processor and the storage medium can be located in an ASIC. Additionally, the ASIC can be located in a device that determines network failure.
  • the processor and the storage medium may also exist as discrete components in a device that determines network failure.
  • the computer program product includes one or more computer instructions.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in or transmitted by a computer readable storage medium.
  • the computer instructions may be from a website site, computer, server or data center via a wired (eg, coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.) Another website site, computer, server, or data center for transmission.
  • the computer readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital versatile disc (DVD), or a semiconductor medium (eg, a solid state disk (SSD)). Wait.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • Artificial Intelligence (AREA)
  • Audiology, Speech & Language Pathology (AREA)
  • Computational Linguistics (AREA)
  • General Health & Medical Sciences (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

本申请提供了一种确定网络故障的方法，包括：获取待处理工单数据；根据预设编码规则对待处理工单数据进行格式化编码生成待处理单词，待处理单词属于预先得到的词典；从待处理单词中确定目标单词；根据词典确定待处理单词对应的词向量；根据词向量关联关系挖掘模型和待处理单词对应的词向量确定第一单词集合与目标单词的关联关系，第一单词集合为待处理单词集合中除目标单词之外的单词；根据关联关系从第一单词集合中确定M个候选单词，M个候选单词对应的工单数据与目标单词对应的工单数据用于确定异常网络状态的故障。该方法能够提高挖掘工单数据的关联关系的准确度，从而提高了确定网络故障的效率。

Description

确定网络故障的方法和装置 技术领域
本申请涉及计算机领域，尤其涉及一种确定网络故障的方法和装置。
背景技术
网络是现代工业和生活的重要组成部分，网络可以定义为能够相互传递信息的多个设备或模块，例如，位于不同地理位置的多个工业机器人通过电磁波进行通信，则该多个工业机器人构成了一个通信网络；又例如，位于同一台电脑内部的中央处理器(central processing unit，CPU)、内存条以及硬盘通过主板进行通信，则上述CPU、内存条以及硬盘也构成了一个通信系统。
网络设备通常会记录多种数据，当网络出现故障时，故障可能会导致多种数据出现异常，这样，工程师就能够根据多种数据之间的关联关系从网络中确定故障原因和故障位置，及时排除故障。例如，网络设备记录的数据包括网络设备关键性能指标(key performance indicator，KPI)、告警信息和日志，当CPU所在的设备显示告警信息时，工程师可以查看流量指标(属于KPI)和日志，若流量指标发生突变且日志存在相应的CPU复位记录，则工程师可以确定当前故障为CPU复位引起的。
上述示例仅是一个示意性的例子，实际上，网络的结构非常复杂，网络设备记录的数据量也非常庞大，依靠工程师从海量数据中找到具有关联关系的数据非常困难。现有技术采用频繁挖掘技术确定具有关联关系的数据，频繁挖掘技术通过统计不同数据在同一事务中共同出现的次数来确定不同数据之间的关联关系，然而，一些实际具有关联关系的数据共同出现的次数较低，频繁挖掘技术无法发现这类数据的关联关系。此外，在同一事务中出现的次数较高的多个数据不一定具有关联关系。因此，如何从海量的数据中准确确定具有关联关系的数据是当前亟需解决的问题。
发明内容
本申请提供了一种确定网络故障的方法和装置，能够提高从网络记录的数据中确定具有关联关系的数据的准确率。
第一方面，提供了一种确定网络故障的方法，包括：获取待处理工单数据集，该待处理工单数据集对应至少一个网络状态，待处理工单数据集包括多个工单数据，该待处理工单数据集的多个工单数据包括至少两种不同类型的数据；根据预设编码规则对待处理工单数据集的多个工单数据进行格式化编码生成多个待处理单词，该多个待处理单词属于预先得到的词典，该词典包括多个单词以及与多个单词对应的多个词向量；根据预设确定规则从多个待处理单词中确定目标单词，预设确定规则用于确定指示异常网络状态的单词，目标单词用于指示至少一个异常网络状态；根据词典确定多个待处理单词对应的多个词向量；根据词向量关联关系挖掘模型和多个待处理单词集合对应的多个词向量确定第一单词 集合中的单词与目标单词的关联关系，第一单词集合为多个待处理单词中除目标单词之外的单词组成的集合；根据关联关系从第一单词集合中确定M个候选单词，其中，M为预设的正整数，M个候选单词对应的工单数据与目标单词对应的工单数据用于确定目标单词指示的异常网络状态的故障，M个候选单词中任意一个候选单词与目标单词的关联关系的紧密度大于第二单词集合中任意一个单词与目标单词的关联关系的紧密度，第二单词集合为第一单词集合中除M个候选单词之外的单词组成的集合。
词向量关联关系挖掘模型是一种能够分析数据之间的关联关系的方法，若两个数据为具有关联关系的数据，即使该两个数据共同出现的频率不高，词向量关联关系挖掘模型也能够确定该两个数据的关联关系。然而，词向量关联关系挖掘模型处理的输入量为词向量，词向量是一种满足特定规则的数据，不同的词向量之间具有数学上的关联关系，而工单数据则是一种孤立的数据，不同类型的工单数据之间不具有数学上的关联关系，词向量关联关系挖掘模型无法直接处理这种孤立的数据，因此，需要按照本申请提供的方法将工单数据转换为单词(具有统一格式的数据)，再通过词向量训练模型训练单词才能得到能够被词向量关联关系挖掘模型处理的数据(即，词向量)，其中，待处理工单数据集的多个工单数据可以生成一个待处理单词，也可以生成多个待处理单词，该多个待处理单词与待处理工单数据集的多个工单数据一一对应。确定网络故障的设备将工单数据转换为词向量之后，通过词向量关联关系挖掘模型确定具有关联关系的词向量，通过词向量与工单数据的对应关系可以确定具有关联关系的工单数据，例如，可以通过本实施例从大量工单数据中确定与告警信息A的关联关系最紧密的工单数据是流量指标A和日志A，并将流量指标A和日志A显示出来，从而有利于工程师快速确定异常网络状态的故障原因和故障位置，及时排除网络故障。
可选地，在根据词典确定多个待处理单词对应的多个词向量之前，所述方法还包括：获取历史工单数据集，历史工单数据集对应至少一个网络状态，该历史工单数据集包括多个工单数据，该历史工单数据集的多个工单数据包括至少两种不同类型的数据；根据预设编码规则对历史工单数据集的多个工单数据进行格式化编码生成历史工单数据集对应的多个单词；根据词向量训练模型训练该历史工单数据集对应的多个单词生成历史工单数据集对应的多个词向量；根据历史工单数据集对应的多个词向量以及历史工单数据集对应的多个单词得到词典。
在处理待处理工单数据之前，可以先根据历史工单数据集中的工单数据获取词典，这样，在处理待处理工单数据时，可以从词典中查找到待处理工单数据对应的词向量，从而可以快速确定M个候选单词。
可选地，在根据预设编码规则对历史工单数据集的多个工单数据进行格式化编码生成历史工单数据集对应的多个单词之前，还包括：根据每个工单数据对应的时刻将历史工单数据集的多个工单数据划分为至少两个子工单数据集合，所述至少两个子工单数据集合与至少两个时间段一一对应；根据预设编码规则对历史工单数据集的多个工单数据进行格式化编码生成历史工单数据集对应的多个单词，包括：根据预设编码规则对至少两个子工单数据集合进行格式化编码生成至少两个句子，至少两个子工单数据集合与至少两个句子一一对应，其中，该至少两个句子包括历史工单数据集对应的多个单词。
通常情况下，具有关联关系的工单数据对应的时刻较为接近，本实施例根据时间段划 分工单数据，使得语句中的单词之间的关联关系更加紧密，有利于提高词向量关联关系挖掘模型的效率。
可选地，根据每个工单数据对应的时刻将历史工单数据集的多个工单数据划分为至少两个子工单数据集合，包括：根据每个工单数据对应的时刻以及第一时间长度阈值将历史工单数据集的多个工单数据划分为至少两个子工单数据集合，该至少两个子工单数据集合中的任意一个对应的时间段长度大于或等于第一时间长度阈值。
每个工单数据对应的时刻指的是每个工单数据的生成时刻，上述实施例根据时间划分工单数据集合，使得得到的每一个子工单数据集合均具有时间属性，可以根据经验值或者工单数据的关联关系统计结果设置第一时间长度阈值，避免划分工单数据集合的时间段过短，减小了具有关联关系的工单数据被划分到不同的子工单数据集合中的概率，有利于提高词向量关联关系挖掘模型的效率和的挖掘结果的准确度。
可选地，至少两个子工单数据集合中的第一子工单数据集合包括用于指示异常网络工作状态的第一工单数据，第一工单数据对应的时刻与第一子工单数据集合对应的时间段的左边界的距离大于或等于第二时间长度阈值，并且，第一工单数据对应的时刻与第一子工单数据集合对应的时间段的右边界的距离大于或等于第三时间长度阈值。
用于指示异常网络状态的工单数据(例如，第一工单数据)通常是重要数据，通过设定第二时间长度阈值和第三时间长度阈值，能够提高与第一工单数据具有关联关系的工单数据被划分到同一个子工单数据集合中的概率，第二时间长度阈值和第三时间长度阈值可以根据经验设定，也可以根据工单数据的关联关系统计结果设定。例如，告警信息用于指示异常网络工作状态，通常情况下，与告警信息的关联关系较紧密的工单数据的生成时刻与告警信息的生成时刻较为接近，可以以告警信息的生成时刻为参考点选取一段时间，从而提高了与告警信息具有关联关系的工单数据被划分到同一个子工单数据集合中的概率，有利于提高词向量关联关系挖掘模型的挖掘结果的准确度。
可选地，在根据预设编码规则对历史工单数据集的多个工单数据进行格式化编码生成历史工单数据集对应的多个单词之前，所述方法还包括：根据每个工单数据对应的网络设备将历史工单数据集的多个工单数据划分为至少两个子工单数据集合，该至少两个子工单数据集合与至少两个网络设备一一对应；根据所述预设编码规则对历史工单数据集的多个工单数据进行格式化编码生成历史工单数据集对应的多个单词，包括：根据预设编码规则对至少两个子工单数据集合进行格式化编码生成至少两个句子，至少两个子工单数据集合与至少两个句子一一对应，其中，该至少两个句子包括所述历史工单数据集对应的多个单词。
相比于属于不同网络设备的工单数据，属于同一个网络设备的工单数据具有更加紧密的关联关系，本实施例根据工单数据所属的网络设备划分工单数据集合，使得语句中的单词之间的关联关系更加紧密，有利于提高词向量关联关系挖掘模型的效率。
可选地，根据预设编码规则对待处理工单数据集的多个工单数据进行格式化编码生成多个待处理单词，包括：确定至少两个数值区间以及至少两个数值区间对应的标识信息，其中，不同的数值区间对应的标识信息不同；根据待处理工单数据集的多个工单数据的数值与至少两个数值区间的对应关系以及至少两个数值区间对应的标识信息确定待处理工单数据集的多个工单数据对应的标识信息；根据待处理工单数据集的多个工单数据对应的 标识信息对待处理工单数据集的多个工单数据进行格式化编码，生成多个待处理单词，其中，所述多个待处理单词中的任意一个包括至少一个标识信息。
待处理工单数据集的多个工单数据中对应相同数据区间的工单数据可以对应一个标识信息，也可以对应多个标识信息，其中，该多个标识信息与待处理工单数据集的多个工单数据中对应相同数据区间的工单数据一一对应。不同标识信息的组合对应不同的网络状态，因此，使用上述编码方式生成的单词能够直接反映出不同的网络状态。
可选地，多个待处理单词中的第一单词包括与所述单词对应的工单数据的数据类型信息、异常网络工作类型信息和工单数据标识符中的至少一个，第一单词为多个待处理单词中的任意一个单词；词典包括的多个单词中的第二单词包括与所述第二单词对应的工单数据的数据类型信息、异常网络工作信息和工单数据标识符中的至少一个，第二单词为词典包括的多个单词中的任意一个单词；历史工单数据集对应的多个单词中的第三单词包括与所述第三单词对应的工单数据的数据类型信息、异常网络工作信息和工单数据标识符中的至少一个，第三单词为历史工单数据集对应的多个单词中的任意一个单词。
第二方面，提供了一种确定网络故障的装置，该装置可以实现上述第一方面所涉及的方法中各个步骤所对应的功能，所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的单元或模块。
在一种可能的设计中，该装置包括处理器和收发器，该处理器被配置为支持该装置执行上述第一方面所涉及的方法中相应的功能。该收发器用于支持该装置与其它网元之间的通信。该装置还可以包括存储器，该存储器用于与处理器耦合，其保存该装置必要的程序指令和数据。
第三方面，提供了一种计算机可读存储介质，该计算机可读存储介质中存储了计算机程序代码，该计算机程序代码被处理单元或处理器执行时，使得确定网络故障的装置执行第一方面所述的方法。
第四方面，提供了一种芯片，其中存储有指令，当其在确定网络故障的装置上运行时，使得该芯片执行上述第一方面的方法。
第五方面，提供了一种计算机程序产品，该计算机程序产品包括：计算机程序代码，当该计算机程序代码被确定网络故障装置的通信单元或收发器、以及处理单元或处理器运行时，使得确定网络故障装置执行上述第一方面的方法。
附图说明
图1是本申请提供的基于哈弗曼树训练单词的方法的示意图；
图2是本申请提供的一种确定网络故障的装置的示意图；
图3是本申请提供的一种确定网络故障的方法的示意图；
图4是本申请提供的一种处理连续型工单数据的方法的示意图；
图5是本申请提供的一种确定候选单词的方法的示意图；
图6是本申请提供的一种生成语料库的方法的示意图；
图7是本申请提供的一种划分工单数据集合的方法的示意图；
图8是本申请提供的另一种处理连续型工单数据的方法的示意图；
图9是本申请提供的一种划分工单数据集合的示意图；
图10是本申请提供的另一种确定网络故障的装置的示意图；
图11是本申请提供的再一种确定网络故障的装置的示意图。
具体实施方式
为了便于理解本申请，首先对本申请提供的技术方案中可能涉及的技术特征进行描述。
工单数据是网络设备记录的反映网络运行状态的数据，例如，KPI、告警信息和日志，与图像数据等按照特定数学模型编码得到数据相比，不同类型的工单数据之间在数学上的关联性较差，计算机能够存储和识别两个不同的工单数据，但是很难分辨两个不同的工单数据之间是否具有关联性，也就是说，工单数据之间也存在词汇鸿沟现象。因此，直接按照数学统计模型(例如，频繁挖掘技术)计算不同类型的工单数据的关联关系的效果通常不理想，需要根据工单数据的特征寻找一种能够计算不同类型的工单数据的关联关系的方法。
工单数据的另一个特性是，不同的工单数据所表示的含义是具有关联性的，例如，当告警信息出现时，通常伴随着KPI的变化以及记录异常现象的日志，不同的工单数据之间的这种关联性本质上是一种上下文关系，因此，可以寻找一种能够计算数据之间的上下文关系的方法来衡量工单数据之间的关联性。
词向量关联关系挖掘模型是一种能够衡量具有上下文关系的数据之间的关联性的方法，然而，该模型不能直接处理具有词汇鸿沟特性的数据，因此，需要将工单数据进行处理以消除工单数据的词汇鸿沟特性。
词嵌入(Word Embedding)是一种能够将具有词汇鸿沟特性的数据转变为具有语义关联关系的数据的方法，该方法的原理是利用位于一个句子中的词汇之间的上下文关系将词汇(即，数据)转化为词向量，生成的词向量之间具有数学上的关联性，从而能够利用词向量关联关系挖掘模型衡量词向量之间的关联关系，进而确定工单数据之间的关联关系。常用的词嵌入包括连续袋(continuous bag of words，CBOW)模型和跳跃(skip-gram)模型。无论是CBOW模型还是跳跃模型，都是以哈弗曼(Huffman)树作为基础的，下面，以CBOW模型为例对生成词向量的原理进行简要说明。
图1示出了基于哈弗曼树训练单词的方法的示意图。
图1中上半部分的v(context(i))表示单词w的上下文的第i个词的向量，图1的下半部分是根据语料库中单词出现次数生成的哈弗曼树，每个叶子节点代表语料库中的一个词，每个非叶节点内置一个权重向量，该向量的维度和词向量的维度相同。从根节点遍历到单词w时，会得到一条由0，1组成的路径序列[0,1,…]，其中0表示左子树，1右子树。每次经过一个中间节点时，进行了一次二分类，分类器使用逻辑回归分类器，所以对于参数为θ i的中间节点，分类的概率为：
Figure PCTCN2019071578-appb-000001
公式(1)中，context(w)是指单词w的上下文，例如可以是包含单词w的语句中，单词w的前c个单词以及后c个单词；θ i表示哈弗曼树第i个中间节点的参数。
设由根节点遍历到单词w的路径包含了l个中间节点，这些节点上的参数组成参数向 量[θ 1,θ 2,...,θ l]。
给定单词w的上下文向量，单词w出现的概率为：
Figure PCTCN2019071578-appb-000002
CBOW模型的训练目标即最大化上述后验概率，CBOW模型在训练过程中会调整中间节点的参数，以及词向量，使得给定某个单词上下文时，使得该单词出现的概率最大。数学表示为：
Figure PCTCN2019071578-appb-000003
公式(3)中θ为哈弗曼树中间节点参数，D是语料库中的所有单词的集合。训练结束后，生成的词典(包括单词和词向量)被用于寻找待处理的单词集合中与目标单词最相关的单词。
下面，将详细描述本申请如何利用上述方法挖掘工单数据之间的关联关系。
图2示出了本申请提供的一种确定网络故障的装置的示意图。
如图2所示，该装置200包括词向量训练模块210和关联关系挖掘模块220，其中，词向量模块210包括符号化模块211、语料库生成模块212以及词嵌入模块213。
符号化模块211用于接收工单数据，将各种类型的工单数据转变为统一格式的单词，以便于后续模块进行处理。
语料库模块212用于对符号化之后的数据按照预定的规则进行划分处理，例如，可以将同一时间段内的工单数据对应的单词划分为一个集合，该一个集合内的单词具有较强的关联性，随后按照一定顺序将该集合中的单词组织成一个语句。一个工单通常可以生成包含多条语句的文档，多个工单对应的文档即形成了语料库。
词嵌入模块213用于对语料库进行词向量训练，以生成词向量，例如，可以按照图1所示的方法，在训练过程中不断调整词向量以及中间节点的参数，使得给定某个单词上下文时，使得该单词出现的概率最大，此时，该单词的词向量训练完毕。整个语料库中的词向量均训练完毕后，生成词典，词典包括语料库中全部单词以及该全部单词对应的词向量。
关联关系挖掘模块220用于分析(也可称为“挖掘”)待处理的单词集合中的单词与目标单词的关联关系，其中，该单词集合为待处理的工单数据经过符号化模块211处理后生成集合，目标单词属于该单词集合，词嵌入模块213生成的词典包括该单词集合中所有的单词，从而可以利用词向量模块训练挖掘出目标单词与该单词集合中其它单词之间的关联关系，并根据单词与工单数据的对应关系显示与目标工单数据关联关系比较密切的一些工单数据，用于工程师确定网络故障。
需要说明的是，图2是从功能角度对确定网络故障的装置200进行描述，图2中各个模块在一些具体产品中可能还会有更加详细的划分方式，或者，图2中各个模块在另一些产品中以集成方式实现，本申请对此不做限定。此外，装置200还可以包括其它模块。
图2所示的各个模块可以是软件模块，该软件模块被处理器执行时实现相应的功能。图2所示的各个模块还可以以硬件的形式实现，比如实现为处理器，数字信号处理器(digital signal processor，DSP)，专用集成电路(application-specific integrated circuit，ASIC)，现场可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合，本申请对此不做限定。
基于上述确定网络故障的装置200，下面将详细介绍利用词向量对工单数据进行处理的相关技术细节。
图3示出了本申请提供的确定网络故障的方法的示意图。该方法300包括：
S310，获取待处理工单数据集，该待处理工单数据集对应至少一个网络状态，待处理工单数据集包括多个工单数据，该待处理工单数据集的多个工单数据包括至少两种不同类型的数据。
S320，根据预设编码规则对待处理工单数据集的多个工单数据进行格式化编码生成多个待处理单词，该多个待处理单词属于预先得到的词典，该词典包括多个单词以及与多个单词对应的多个词向量。
S330，根据预设确定规则从多个待处理单词中确定目标单词，预设确定规则用于确定指示异常网络状态的单词，目标单词用于指示至少一个异常网络状态。
S340，根据词典确定多个待处理单词对应的多个词向量。
S350，根据词向量关联关系挖掘模型和多个待处理单词对应的多个词向量集合确定第一单词集合中的单词与目标单词的关联关系，第一单词集合为多个待处理单词中除目标单词之外的单词组成的集合。
S360，根据关联关系从第一单词集合中确定M个候选单词，其中，M为预设的正整数，M个候选单词对应的工单数据与目标单词对应的工单数据用于确定目标单词指示的异常网络状态的故障，M个候选单词中任意一个候选单词与目标单词的关联关系的紧密度大于第二单词集合中任意一个单词与目标单词的关联关系的紧密度，第二单词集合为第一单词集合中除M个候选单词之外的单词组成的集合。
方法300例如可以由装置200执行，其中，S310中的待处理工单数据例如是至少一个KPI和至少一个告警信息，本申请对每一种类型的工单数据的数量不做限定。S310中的待处理工单数据中每一种工单数据可以是连续型数据或离散型数据，上述待处理工单数据可以是装置200生成的，也可以是从其它设备接收的，例如，通过收发器或者通信接口接收待处理工单数据。
当S310中的待处理工单数据集中的工单数据为连续型数据时，可以根据预设规则从所述连续型工单数据中获取指示异常网络状态的工单数据，并将该指示异常网络状态的工单数据作为S320中格式化编码的输入量生成多个待处理单词，从而可以将连续型工单数据离散化，减少与网络故障无关的工单数据，提高词向量关联关系挖掘模型的效率。
连续型工单数据与时间的函数可以是平滑曲线，也可以是非平滑曲线，还可以是多段曲线，本申请对此不做限定。以连续型工单数据与时间的函数图像为平滑曲线为例，当网络故障发生时，平滑曲线通常会发生突变，即，平滑曲线突变位置的工单数据反映了网络故障，为了减少与网络故障无关的工单数据，提高词向量关联关系挖掘模型的效率，可以仅选取突变数据作为生成单词的工单数据并进行词向量训练。
如图4所示，KPI与时间的函数图像为平滑曲线，在第一个时间段的平滑曲线上存在两个突变点，可以根据曲线的导数值的绝对值是否超过导数阈值判断曲线上的点是否为突变点，选择该两个突变点的工单数据作为生成语料库使用的工单数据，可以减少与网络故障无关的工单数据，提高词向量关联关系挖掘模型的效率。
S320可以由图2所示的符号化模块211执行，可以按照“数据类型_数据标识符_异 常种类”对工单数据进行格式化编码(也可称为“符号化”)，也可以按照“数据类型_数据标识符_异常现象”对工单数据进行格式化编码，或者是按照其它规则对工单数据进行编码。可以将一个工单数据编码生成一个单词，也可以将多个工单数据编码生成一个单词。
例如，对于一个KPI，按照“数据类型_数据标识符_异常种类”进行编码的结果为单词“kpi_TS01_1”，其中，kpi表示该单词对应的数据类型为KPI，TS01表示数据标识符，可以是KPI的时间序列，1表示该KPI的异常类型，例如，突增或突降。
又例如，对于属于同一个KPI的三段数据，按照“数据类型_数据标识符_异常现象”进行编码的结果为单词“kpi_TS01_baa”，其中，kpi表示该单词对应的数据类型为KPI，TS01表示数据标识符，可以取三个KPI的时间序列作为数据标识符，baa为对该三个KPI的值进行符号化后得到的用于表示异常现象的信息。
S320中生成的多个待处理单词属于预先得到的词典，该词典包括多个单词以及与该多个单词对应的多个词向量，从而可以根据该词典获取多个待处理单词对应的多个词向量。该词典可以是词向量训练模块210生成的，也可以是通过通信接口或者收发器接收到，本申请对装置200如何获取词典不做限定。
S330中，预设确定规则例如是将平滑曲线上的突变点对应的单词确定为目标单词，也可以是将告警信息对应的单词确定为目标单词，还可以是将工程师输入的工单数据对应的单词确定为目标单词。
上述目标单词可以是一个单词，也可以是多个单词，此外，目标单词可以是用于指示一个异常网络状态的单词，也可以是用于指示多个异常网络状态的单词。
若待处理单词集合中全部单词都属于词典，则可以通过关联关系挖掘模块220直接执行S350。若待处理单词集合中部分单词不属于词典，则需要对这部分单词训练生成词向量，并将生成的词向量和这部分单词加入词典，随后再执行S350。
S350中的关联关系挖掘模型例如是通过计算词向量之间的余弦距离确定词向量之间的关联关系的紧密度，余弦距离越小，表示词向量之间的关联关系越紧密。
S350执行完毕后，装置200确定了第一单词集合中的单词与目标单词的关联关系，随后可以从第一单词集合中选择与目标单词的关联关系最接近的M个单词作为候选单词，该M个候选单词对应的工单数据以及目标单词对应的工单数据用于确定异常网络工作状态的故障，可以将该M个候选单词对应的工单数据以及目标单词对应的工单数据显示出来，供工程师使用。
需要说明的是，若多个待处理单词仅包含两个单词，则第二单词集合为零集合，零集合中的工单数据与目标单词的关联关系为最疏远的的关系，例如，待处理单词为单词A和单词B，其中，单词A为目标单词，则第一单词集合为单词B组成的集合，第二单词集合为零集合，由于零集合中的工单数据与目标单词的关联关系为最疏远的的关系，因此，装置200确定单词B为候选单词。
挖掘目标单词的关联关系的流程如图5所示。
通过上述方法，可以从大量工单数据中确定与指示异常网络工作状态的工单数据的关联关系最紧密的工单数据，并将该关联关系最紧密的工单数据显示出来，例如，当网络设备出现告警信息A时，可以通过上述方法确定与告警信息A的关联关系最紧密的工单数据是流量指标A和日志A，并将流量指标A和日志A显示出来，即使流量指标A与日志 A与告警信息A共同出现的频率很小，方法300也能够确定与告警信息A的关联关系最紧密的工单数据是流量指标A和日志A，从而有利于工程师快速确定网络故障的原因和位置，及时排除网络故障。
可选地，在S340之前，方法300还包括：
S301，获取历史工单数据集，历史工单数据集对应至少一个网络状态，该历史工单数据集包括多个工单数据，该历史工单数据集的多个工单数据包括至少两种不同类型的数据。
S302，根据预设编码规则对历史工单数据集的多个工单数据进行格式化编码生成历史工单数据集对应的多个单词。
S303，根据词向量训练模型训练该历史工单数据集对应的多个单词生成历史工单数据集对应的多个词向量。
S304，根据历史工单数据集对应的多个词向量以及历史工单数据集对应的多个单词得到词典。
S301中，至少一个网络状态例如可以是网络设备在执行计算任务时的工作状态，也可以是网络设备在执行存储任务时的工作状态，还可以是其它的工作状态。历史工单数据集包括的多个工单数据为网络设备在处于至少一个网络状态时记录的多个工单数据，历史工单数据集为用于生成词典的现有的工单数据，S301中的历史工单数据集可以是生成词典所需的全部工单数据集，装置200执行一次S301-S304生成词典；S301中的历史工单数据集页可以是生成词典所需的部分工单数据集，装置200执行多次S301-S304生成词典。
S302中的编码规则与S320中的编码规则相同，可以由符号化模块211执行。
S303和S304可以由图2所示的词嵌入模块213执行，S330中的词向量训练模型例如可以是图1所示的CBOW模型，使用词向量训练模型训练单词生成词向量，每个单词都唯一对应一个词向量，待全部单词训练完成后，生成词典，该词典包含多个单词以及每个单词对应的词向量。
可选地，在S302之前，方法300还包括：
S305，根据每个工单数据对应的时刻将历史工单数据集的多个工单数据划分为至少两个子工单数据集合，所述至少两个子工单数据集合与至少两个时间段一一对应。
在该情况下，S302包括：
S306，根据预设编码规则对至少两个子工单数据集合进行格式化编码生成至少两个句子，至少两个子工单数据集合与至少两个句子一一对应，其中，该至少两个句子包括历史工单数据集对应的多个单词。
通常情况下，具有关联关系的工单数据对应的时刻较为接近，本实施例根据时间段划分工单数据集合，使得语句中的单词之间的关联关系更加紧密，有利于提高词向量关联关系挖掘模型的效率。S305可以由语料库生成模块212执行，上述生成语料库的流程如图6所示。
图7示出了本申请提供的一种对工单数据执行时间切片操作的方法的示意图。
如图7所示，当前工单数据包括KPI、告警信息和日志，该三种工单数据组成了工单数据集合，按照预设的时间段对该工单数据集合进行时间切片，得到多个子工单数据集合，例如，第一个子工单数据集合包括两组KPI、告警信息A、告警信息B和日志A，对这些 工单数据进行符号化之后得到的单词即组成了一条语句。
可选地，S305包括：
S3051，根据每个工单数据对应的时刻以及第一时间长度阈值将历史工单数据集的多个工单数据划分为至少两个子工单数据集合，该至少两个子工单数据集合中的任意一个对应的时间段长度大于或等于第一时间长度阈值。
每个工单数据对应的时刻指的是生成每个工单数据的时刻。若对工单数据集合进行时间切片选用的时间段过长，则语句中关联关系较疏远的单词较多，这将导致词向量关联关系挖掘模型的效率降低；若对工单数据集合进行事件切片选用的时间段过短，则两个关联关系较紧密的单词可能会被划分到不同的语句中，这将导致训练单词生成的词向量不是优选的词向量，对使用词向量关联关系挖掘模型挖掘目标单词的关联关系产生负面影响。
根据本实施例提供的方法，可以根据经验值或者工单数据的关联关系统计结果设置第一时间长度阈值，避免划分工单数据集合的时间段过短，减小了具有关联关系的工单数据被划分到不同的子工单数据集合中的概率，有利于提高词向量关联关系挖掘模型的效率和挖掘结果的准确度。
可选地，至少两个子工单数据集合中的第一子工单数据集合包括用于指示异常网络工作状态的第一工单数据，第一工单数据对应的时刻与第一子工单数据集合对应的时间段的左边界的距离大于或等于第二时间长度阈值，并且，第一工单数据对应的时刻与第一子工单数据集合对应的时间段的右边界的距离大于或等于第三时间长度阈值。
用于指示异常网络工作状态的工单数据(例如，第一工单数据)通常是重要数据，通过设定第二时间长度阈值和第三时间长度阈值，能够提高与第一工单数据具有关联关系的工单数据被划分到同一个子工单数据集合中的概率，第二时间长度阈值和第三时间长度阈值可以根据经验设定，也可以根据工单数据的关联关系统计结果设定。例如，告警信息用于指示异常网络工作状态，通常情况下，与告警信息的关联关系较紧密的工单数据的生成时刻与告警信息的生成时刻较为接近，可以以告警信息的生成时刻为参考点选取一段时间，从而提高了与告警信息具有关联关系的工单数据被划分到同一个子工单数据集合中的概率，有利于提高词向量关联关系挖掘模型的挖掘结果的准确度。
上述第二时间长度阈值与第三时间长度阈值可以相等，也可以不相等。
再举一个例子，令第二时间长度阈值和第三时间长度阈值均为3分钟，以图7为例，KPI中的突变点(平滑曲线上的尖锐凸起)用于指示异常网络工作状态，以该突变点为中心，左右各取5分钟的时间段长度划分工单数据集合，得到一个时间长度为10分钟的子工单数据集合，从而减小了与该突变点相关的其它工单数据被划分至不同的子工单数据集合中的概率。上述两个5分钟即突变点距离时间段的左边界和右边界的时间长度。
可选地，在S302之前，方法300还包括：
S307，根据每个工单数据对应的网络设备将历史工单数据集的多个工单数据划分为至少两个子工单数据集合，该至少两个子工单数据集合与至少两个网络设备一一对应。
在该情况下，S302包括：根据预设编码规则对至少两个子工单数据集合进行格式化编码生成至少两个句子，至少两个子工单数据集合与至少两个句子一一对应，其中，该至少两个句子包括历史工单数据集的多个单词。
相比于属于不同网络设备的工单数据，属于同一个网络设备的工单数据具有更加紧密 的关联关系，本实施例根据工单数据所属的网络设备划分工单数据集合，使得语句中的单词之间的关联关系更加紧密，有利于提高词向量关联关系挖掘模型的效率。
可选地，S320包括：
S321，确定至少两个数值区间以及至少两个数值区间对应的标识信息，其中，不同的数值区间对应的标识信息不同。
S322，根据待处理工单数据集的多个工单数据的数值与至少两个数值区间的对应关系以及至少两个数值区间对应的标识信息确定待处理工单数据集的多个工单数据对应的标识信息。
S333，根据待处理工单数据集的多个工单数据对应的标识信息对待处理工单数据集的多个工单数据进行格式化编码，生成多个待处理单词，其中，所述多个待处理单词中的任意一个包括至少一个标识信息。
处理工单数据集的多个工单数据中对应相同数据区间的工单数据可以对应一个标识信息，也可以对应多个标识信息，其中，该多个标识信息与待处理工单数据集的多个工单数据中对应相同数据区间的工单数据一一对应。不同标识信息的组合对应不同的网络工作状态，因此，使用上述编码方式生成的单词能够直接反映出不同的网络工作状态。
如图8所示，左侧图中C表示曲线，该曲线表示连续型工单数据与时间的函数关系，其中，横轴为时间轴，纵轴为工单数据轴，将曲线划分为多个曲线段(即，离散化)，C表示对曲线进行离散化操作后每个曲线段的近似值的图像(横线段)，例如可以对每个曲线段的纵坐标值取均值，坐标系的纵轴设置了三个数值区间(如右侧图)，落入下方数值区间的工单数据赋值为a，落入中间数值区间的工单数据赋值为b，落入上方数值区间的工单数据赋值为c，上述a、b和c即不同的标识信息，得到结果为aabbcc，若该连续型工单数据为KPI，则最终生成的单词为kpi_TS01_aabbcc，这种编码方式获得的单词可以直接反映出网络的工作状态，此外，这种方法能够将多个工单数据编码为一个单词。
图8所示的离散化方法为符号聚合近似(symbolic aggregate approximation，SAX)，即，使得曲线段在三个数值区间内的分布概率服从图8右侧的分布曲线，还可以采用其它离散化方法，例如，均匀离散化方法。
下面，再提供一个基于装置200和方法300的确定网络故障的方法的示例。
S901，输入的工单数据，如图9所示，包含KPI，告警信息和日志，横轴表示时间轴，纵轴为各个工单数据对应的轴。其中KPI是一个双变量的数据，名称为TS01和TS02。
S902，符号化模块211中的连续时间序列符号化模块对KPI进行异常检测，发现TS01中存在突增异常点，TS02中存在突降异常点。约定突增类型符号为“1”，突降为符号“2”，然后对其符号化，生成下述两个单词：kpi_ts01_1，kpi_ts02_2。符号化模块211中的离散数据符号化模块对告警信息和日志进行符号化，生成alarm_a，alarm_b，alarm_c，alarm_d，alarm_e这些单词，同理，对日志进行符号化生成log_a，log_b，log_c，log_e，log_f这些单词。
S903，语料库模块212按照设定的时间间隔对工单数据进行时间切片，形成对应多个时间窗的工单数据。然后，按照KPI、告警信息、日志的顺序，将同一窗口内出现的单词顺序连接组成一个语句。例如，第一个时间窗口组成的语句是：kpi_ts01_1，alarm_a log_a；第二个窗口的语句是：kpi_ts02_2，alarm_b，alarm_c，log_c；第三个时间窗没有KPI相 关的单词，形成句子alarm_d，log_e；依次类推，形成多条语句:
alarm_e，log_b；
alarm_d，log_f。
图9所示的工单数据对应5条语句，该5条语句共同组成了一篇文章。
S904，词嵌入模块213使用如图1所示的CBOW模型对语料库模块212生成的语料库进行词向量训练。以图9所示的工单数据所对应的单词为语料库，设定词向量长度等参数后对语料库中的单词进行训练，得到词向量，部分词向量如下：
kpi_ts01_1:[0.17468844 -3.15235829 -1.70313048 -0.08540603 -2.66887307]
kpi_ts02_2:[2.92323542 -1.19825315 -0.14672463 -1.04043281 2.63267684]
alarm_a:[1.88184381 -0.73932534 0.42771474 -0.04084557 -3.8284812]
alarm_b:[1.63213897 -1.63577068 -2.92685103 0.45830116 1.15785682]
alarm_c:[0.65490711 -1.53254235 -1.86269796 -2.88768387 1.29278743]
alarm_d:[2.87885618 -1.52118778 2.19117451 0.01026359 -0.25202838]
log_e:[3.22305751 0.54613221 -0.86096072 0.86174524 -0.67765802]
alarm_e:[2.36494136 0.7596367 0.56835741 -3.16016173 -0.54243064]
log_b:[1.15876281 0.45133153 -3.03829813 -1.50259316 -1.90585148]
log_c:[0.84713143 -3.7954514 -0.39955622 -0.2065627 1.29133725]
log_f:[3.2334075 0.5428791 -0.84866911 0.87074149 -0.68929535]
S905，词向量关联关系挖掘模块220执行挖掘词向量之间的关联关系的操作。假设根据待处理的工单数据生成的待处理单词集合与语料库中的单词相同，一种关联关系的衡量方法是利用余弦距离计算词向量之间的距离，例如，目标单词为kpi_ts02_2，和kpi_ts02_2最近的2个单词是：(alarm_b,0.6114)和(alarm_c,0.6096)。上述二元组的第一个元素表示单词，第二个元素表示和词kpi_ts02_2的余弦距离，余弦距离根据
Figure PCTCN2019071578-appb-000004
得到，其中，d表示两个向量
Figure PCTCN2019071578-appb-000005
和
Figure PCTCN2019071578-appb-000006
的余弦距离，
Figure PCTCN2019071578-appb-000007
表示该两个向量的内积，
Figure PCTCN2019071578-appb-000008
表示该两个向量的模的乘积。另一种关联关系的衡量方法是后验概率，即P(w|x)，P(w|x)表示在上下文环境x中单词w出现的概率，例如，计算在目标单词kpi_ts01_1出现的情况下，其它单词出现的概率，概率最高的前5个单词分别是：(alarm_a,0.50897503),(log_a,0.48480666),(kpi_ts02_2,0.0035087806),(kpi_ts01_1,0.001931924),(alarm_e,0.00074308913)，其中每个二元组的第一个元素表示单词，第二个元素表示该单词出现的概率。从数值关系可得出结论，当kpi_ts01_1出现情况下，单词alarm_a出现可能性最大，alarm_a或者log_a出现的概率要远大于其它词。此结果符合语料库数据知识，kpi_ts01_1仅和alarm_a和log_a共同出现过，该结果甚至描述出alarm_a和kpi_ts01_1更接近的现象。
在上述示例中，衡量单词之间的关联关系的紧密程度存在两个度量方法，一个是余弦距离，一个是后验概率。余弦距离衡量了语句结构中的相似程度，余弦距离越大，背景越相似。后验概率直接衡量了当背景为x时，其它单词出现的概率，如果工程师当前关注的工单数据为异常A，则向工程师推荐当前工单数据中伴随异常A出现的概率最高的M个工单数据。
下面再举一个使用跳跃模型训练单词的示例，进一步说明根据本申请提供的确定网络故障的方法对工单数据之间的关联关系挖掘的结果的可靠性。
在本示例中，生成语料库的方法与S901至S903相同，在此不再赘述。
生成语料库后，词嵌入模块213使用跳跃模型对语料库模块212生成的语料库进行词向量训练。与CBOW模型训练的方法相反，跳跃模型训练的目的是：当给定目标单词时，调整词向量以及其它参数，使得目标单词的上下文出现的概率最大。
以图9所示的工单数据所对应的单词为语料库，设定词向量长度等参数后对语料库中的单词进行训练，得到词向量，部分词向量如下：
kpi_ts01_1:[0.63125104 -4.25858593 0.35638022 -1.92799687]
kpi_ts02_2:[2.10638261 -1.43733919 -2.21027827 0.25722837]
alarm_a:[1.54770124 -2.92161226 2.53744531 -1.14832222]
alarm_b:[1.63473284 -1.46626246 -1.980528 0.01986574]
alarm_c:[1.50775409 -1.35248256 -2.98207068 -1.89021122]
alarm_d:[3.24929452 -0.48743623 2.56781888 -0.07174389]
log_e:[3.72427011 0.21996154 -0.33541518 1.02381301]
alarm_e:[2.38036585 0.80636454 1.34128952 -3.64503884]
log_b:[2.94829321 1.41359913 -1.49926472 -2.19659758]
log_c:[1.31400299 -3.54252386 -2.10488534 -0.57945603]
log_f:[3.68348789 0.20657098 -0.32329062 1.00856996]
词向量关联关系挖掘模块220对目标单词执行挖掘关联关系的操作。和单词kpi_ts02_2最近的两个词是：(alarm_b,0.9925)和(log_c,0.8371)，二元组的第一个元素表示单词，第二个元素表示和kpi_ts02_2的余弦距离。比较上述两种词向量训练模型的挖掘结果，可以发现不同的词向量训练模型对余弦距离的影响不同，但与目标单词具有关联关系的单词的排序结果是相同的，说明本申请提供的确定网络故障的方法是可信的。若采用后验概率衡量不同单词的关联关系的紧密度，计算在目标单词kpi_ts01_1出现的情况下，其它单词出现的概率，取概率最高的前5个单词，分别是：(alarm_a,0.57739365),(log_a,0.40243161),(kpi_ts01_1,0.0087259663),(kpi_ts02_2,0.0058389762),(alarm_b,0.0045104912)，其中每个二元组的第一个元素表示单词，第二个元素表示出现的概率。从数值关系可得出结论，当kpi_ts01_1出现情况下，单词alarm_a出现可能最大，其次为log_a，关联关系挖掘结果和使用CBOW模型训练得到的词典进行关联关系挖掘的结果相同。
上文详细介绍了本申请提供的确定网络故障的方法的示例。可以理解的是，确定网络故障的装置为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请可以根据上述方法示例对确定网络故障的装置进行功能单元的划分，例如，可以按照图2所示的方式对应各个功能划分各个功能单元，也可以将两个或两个以上的功能 集成在一个处理单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。需要说明的是，本申请中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
在采用集成的单元的情况下，图10示出了上述实施例中所涉及的确定网络故障的装置的一种可能的结构示意图。确定网络故障的装置1000包括：处理单元1002和获取单元1003。处理单元1002用于对确定网络故障的装置1000的动作进行控制管理，例如，处理单元1002用于支持确定网络故障的装置1000执行图3的各个步骤和/或用于本文所描述的技术的其它过程。获取单元1003用于支持确定网络故障的装置1000获取待处理的信息，例如从网络设备获取至少两个工单数据。确定网络故障的装置1000还可以包括存储单元1001，用于存储确定网络故障的装置1000的程序代码和数据。
例如，获取单元1003获取待处理工单数据，所述待处理用于指示网络工作状态，所述至少两个工单数据包括至少两种不同类型的数据；
处理单元1002根据编码规则对获取单元1003获取的待处理工单数据进行格式化编码生成待处理单词集合，所述待处理单词集合中的单词的格式相同，所述待处理单词集合包括至少两个单词，所述待处理单词集合属于预先得到的词典，所述词典包括多个单词以及与所述多个单词对应的多个词向量；根据预设确定规则从所述待处理单词集合中确定目标单词，所述预设确定规则用于确定指示异常网络状态的单词，所述目标单词用于指示至少一个异常网络工作状态；根据所述词典确定所述待处理单词集合对应的词向量集合，所述待处理单词集合对应的词向量集合包括所述目标单词对应的目标词向量；根据词向量关联关系挖掘模型和所述待处理单词集合对应的词向量集合确定第一单词集合与所述目标单词的关联关系，所述第一单词集合为所述待处理单词集合中除所述目标单词之外的单词；根据所述关联关系从所述第一单词集合中确定M个候选单词，其中，M为预设的正整数，所述M个候选单词对应的工单数据与所述目标单词对应的工单数据用于确定所述异常网络工作状态的故障，所述M个候选单词中任意一个候选单词与所述目标单词的关联关系的紧密度大于第二单词集合中任意一个单词与所述目标单词的关联关系的紧密度，所述第二单词集合为所述第一单词集合中除所述M个候选单词之外的单词。
处理单元1002可以是处理器或控制器，例如可以是CPU，通用处理器，数字信号处理器(digital signal processor，DSP)，专用集成电路(application-specific integrated circuit，ASIC)，现场可编程门阵列(field programmable gate array，FPGA)或者其它可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。获取单元1003可以是收发器或通信接口。存储单元1001可以是存储器。
当处理单元1002为处理器，获取单元1003为收发器，存储单元1001为存储器时，本申请所涉及的确定网络故障的装置可以为图11所示的装置。
参阅图11所示，该装置1100包括：处理器1102、收发器1103、存储器1001。其中，收发器1103、处理器1102以及存储器1101可以通过内部连接通路相互通信，传递控制和/或数据信号。
本领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的装置和单 元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
本申请提供的确定网络故障的装置1000和确定网络故障的装置1100，对工单数据进行处理后使用词向量关联关系挖掘模型挖掘工单数据之间的关联关系，若两个工单数据为具有关联关系的数据，即使该两个工单数据共同出现的频率不高，词向量关联关系挖掘模型也能够确定该两个工单数据的关联关系，相比于频繁挖掘技术，本申请提供的装置能够提高工单数据的关联关系挖掘的准确度。
装置实施例和方法实施例中完全对应，由相应的模块执行相应的步骤，例如获取单元执行方法实施例中的获取步骤，除获取步骤以外的其它步骤可以由处理单元或处理器执行。具体单元的功能可以参考相应的方法实施例，不再详述。
在本申请各个实施例中，各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请的实施过程构成任何限定。
另外，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
结合本申请公开内容所描述的方法或者算法的步骤可以硬件的方式来实现，也可以是由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于随机存取存储器(random access memory，RAM)、闪存、只读存储器(read only memory，ROM)、可擦除可编程只读存储器(erasable programmable ROM，EPROM)、电可擦可编程只读存储器(electrically EPROM，EEPROM)、寄存器、硬盘、移动硬盘、只读光盘(CD-ROM)或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外，该ASIC可以位于确定网络故障的装置中。当然，处理器和存储介质也可以作为分立组件存在于确定网络故障的装置中。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者通过所述计算机可读存储介质进行传输。所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，数字通用光盘(digital versatile disc，DVD)、或者半导体介质(例如固态硬盘(solid state disk，SSD))等。
以上所述的具体实施方式，对本申请的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本申请的具体实施方式而已，并不用于限定本申请的保护范围，凡在本申请的技术方案的基础之上，所做的任何修改、等同替换、改进等，均 应包括在本申请的保护范围之内。

Claims (18)

  1. 一种确定网络故障的方法，其特征在于，包括：
    获取待处理工单数据集，所述待处理工单数据集对应至少一个网络状态，所述待处理工单数据集包括多个工单数据，所述待处理工单数据集的多个工单数据包括至少两种不同类型的数据；
    根据预设编码规则对所述待处理工单数据集的多个工单数据进行格式化编码生成多个待处理单词，所述多个待处理单词属于预先得到的词典，所述词典包括多个单词以及与所述多个单词对应的多个词向量；
    根据预设确定规则从所述多个待处理单词中确定目标单词，所述预设确定规则用于确定指示异常网络状态的单词，所述目标单词用于指示至少一个异常网络状态；
    根据所述词典确定所述多个待处理单词对应的多个词向量；
    根据词向量关联关系挖掘模型和所述多个待处理单词对应的多个词向量确定第一单词集合中的单词与所述目标单词的关联关系，所述第一单词集合为所述多个待处理单词中除所述目标单词之外的单词组成的集合；
    根据所述关联关系从所述第一单词集合中确定M个候选单词，其中，M为预设的正整数，所述M个候选单词对应的工单数据与所述目标单词对应的工单数据用于确定所述目标单词指示的异常网络状态的故障，所述M个候选单词中任意一个候选单词与所述目标单词的关联关系的紧密度大于第二单词集合中任意一个单词与所述目标单词的关联关系的紧密度，所述第二单词集合为所述第一单词集合中除所述M个候选单词之外的单词组成的集合。
  2. 根据权利要求1所述的方法，其特征在于，在所述根据所述词典确定所述多个待处理单词对应的多个词向量之前，所述方法还包括：
    获取历史工单数据集，所述历史工单数据集对应至少一个网络状态，所述历史工单数据集包括多个工单数据，所述历史工单数据集的多个工单数据包括至少两种不同类型的数据；
    根据所述预设编码规则对所述历史工单数据集的多个工单数据进行格式化编码生成所述历史工单数据集对应的多个单词；
    根据词向量训练模型训练所述历史工单数据集对应的多个单词生成所述历史工单数据集对应的多个词向量；
    根据所述历史工单数据集对应的多个词向量以及所述历史工单数据集对应的多个单词得到所述词典。
  3. 根据权利要求2所述的方法，其特征在于，在所述根据所述预设编码规则对所述历史工单数据集的多个工单数据进行格式化编码生成所述历史工单数据集对应的多个单词之前，还包括：
    根据每个工单数据对应的时刻将所述历史工单数据集的多个工单数据划分为至少两个子工单数据集合，所述至少两个子工单数据集合与至少两个时间段一一对应；
    所述根据所述预设编码规则对所述历史工单数据集的多个工单数据进行格式化编码 生成所述历史工单数据集对应的多个单词，包括：
    根据所述预设编码规则对所述至少两个子工单数据集合进行格式化编码生成至少两个句子，所述至少两个子工单数据集合与所述至少两个句子一一对应，其中，所述至少两个句子包括所述历史工单数据集对应的多个单词。
  4. 根据权利要求3所述的方法，其特征在于，所述根据每个工单数据对应的时刻将所述历史工单数据集的多个工单数据划分为至少两个子工单数据集合，包括：
    根据每个工单数据对应的时刻以及第一时间长度阈值将所述历史工单数据集的多个工单数据划分为所述至少两个子工单数据集合，所述至少两个子工单数据集合中的任意一个对应的时间段长度大于或等于所述第一时间长度阈值。
  5. 根据权利要求3或4所述的方法，其特征在于，所述至少两个子工单数据集合中的第一子工单数据集合包括用于指示异常网络工作状态的第一工单数据，所述第一工单数据对应的时刻与所述第一子工单数据集合对应的时间段的左边界的距离大于或等于第二时间长度阈值，并且，所述第一工单数据对应的时刻与所述第一子工单数据集合对应的时间段的右边界的距离大于或等于第三时间长度阈值。
  6. 根据权利要求2所述的方法，其特征在于，在所述根据所述预设编码规则对所述历史工单数据集的多个工单数据进行格式化编码生成所述历史工单数据集对应的多个单词之前，还包括：
    根据每个工单数据对应的网络设备将所述历史工单数据集的多个工单数据划分为至少两个子工单数据集合，所述至少两个子工单数据集合与至少两个网络设备一一对应；
    所述根据所述预设编码规则对所述历史工单数据集的多个工单数据进行格式化编码生成所述历史工单数据集对应的多个单词，包括：
    根据所述预设编码规则对至少两个子工单数据集合进行格式化编码生成至少两个句子，所述至少两个子工单数据集合与所述至少两个句子一一对应，其中，所述至少两个句子包括所述历史工单数据集对应的多个单词。
  7. 根据权利要求1至6中任一项所述的方法，其特征在于，所述根据预设编码规则对所述待处理工单数据集的多个工单数据进行格式化编码生成多个待处理单词，包括：
    确定至少两个数值区间以及所述至少两个数值区间对应的标识信息，其中，不同的数值区间对应的标识信息不同；
    根据所述待处理工单数据集的多个工单数据的数值与所述至少两个数值区间的对应关系以及所述至少两个数值区间对应的标识信息确定所述待处理工单数据集的多个工单数据对应的标识信息；
    根据所述待处理工单数据集的多个工单数据对应的标识信息对所述待处理工单数据集的多个工单数据进行格式化编码，生成所述多个待处理单词，其中，所述多个待处理单词中的任意一个包括至少一个标识信息。
  8. 根据权利要求1至6中任一项所述的方法，其特征在于，所述多个待处理单词中的第一单词包括与所述第一单词对应的工单数据的数据类型信息、异常网络工作信息和工单数据标识符中的至少一个，所述第一单词为所述多个待处理单词中的任意一个；所述词典包括的多个单词中的第二单词包括与所述第二单词对应的工单数据的数据类型信息、异常网络工作信息和工单数据标识符中的至少一个，所述第二单词为所述词典包括的多个单 词中的任意一个。
  9. 一种确定网络故障的装置，其特征在于，包括获取单元和处理单元，所述处理单元用于：
    通过所述获取单元获取待处理工单数据集，所述待处理工单数据集对应至少一个网络状态，所述待处理工单数据集包括多个工单数据，所述多个工单数据包括至少两种不同类型的数据；
    根据预设编码规则对所述待处理工单数据集的多个工单数据进行格式化编码生成多个待处理单词，所述多个待处理单词属于预先得到的词典，所述词典包括多个单词以及与所述多个单词对应的多个词向量；
    根据预设确定规则从所述多个待处理单词中确定目标单词，所述预设确定规则用于确定指示异常网络状态的单词，所述目标单词用于指示至少一个异常网络状态；
    根据所述词典确定所述多个待处理单词对应的多个词向量；
    根据词向量关联关系挖掘模型和所述多个待处理单词对应的多个词向量确定第一单词集合中的单词与所述目标单词的关联关系，所述第一单词集合为所述多个待处理单词中除所述目标单词之外的单词组成的集合；
    根据所述关联关系从所述第一单词集合中确定M个候选单词，其中，M为预设的正整数，所述M个候选单词对应的工单数据与所述目标单词对应的工单数据用于确定所述目标单词指示的异常网络状态的故障，所述M个候选单词中任意一个候选单词与所述目标单词的关联关系的紧密度大于第二单词集合中任意一个单词与所述目标单词的关联关系的紧密度，所述第二单词集合为所述第一单词集合中除所述M个候选单词之外的单词组成的集合。
  10. 根据权利要求9所述的装置，其特征在于，在所述根据所述词典确定所述多个待处理单词对应的多个词向量之前，所述处理单元还用于：
    获取历史工单数据集，所述历史工单数据集对应至少一个网络状态，所述历史工单数据集包括多个工单数据，所述历史工单数据集的多个工单数据包括至少两种不同类型的数据；
    根据所述预设编码规则对所述历史工单数据集的多个工单数据进行格式化编码生成所述历史工单数据集对应的多个单词；
    根据词向量训练模型训练所述历史工单数据集对应的多个单词生成所述历史工单数据集对应的多个词向量；
    根据所述历史工单数据集对应的多个词向量以及所述历史工单数据集对应的多单词得到所述词典。
  11. 根据权利要求10所述的装置，其特征在于，在所述根据所述预设编码规则对所述历史工单数据集的多个工单数据进行格式化编码生成所述历史工单数据集对应的多个单词之前，所述处理单元还用于：
    根据每个工单数据对应的时刻将所述历史工单数据集的多个工单数据划分为至少两个子工单数据集合，所述至少两个子工单数据集合与至少两个时间段一一对应；
    所处理单元具体用于：
    根据所述预设编码规则对所述至少两个子工单数据集合进行格式化编码生成至少两 个句子，所述至少两个子工单数据集合与所述至少两个句子一一对应，其中，所述至少两个句子包括所述历史工单数据集对应的多个单词。
  12. 根据权利要求10或11所述的装置，其特征在于，所述处理单元具体用于：
    根据每个工单数据对应的时刻以及第一时间长度阈值将所述历史工单数据集的多个工单数据划分为所述至少两个子工单数据集合，所述至少两个子工单数据集合中的任意一个对应的时间段长度大于或等于所述第一时间长度阈值。
  13. 根据权利要求10至12中任一项所述的装置，其特征在于，所述至少两个子工单数据集合中的第一子工单数据集合包括用于指示异常网络工作状态的第一工单数据，所述第一工单数据对应的时刻与所述第一子工单数据集合对应的时间段的左边界的距离大于或等于第二时间长度阈值，并且，所述第一工单数据对应的时刻与所述第一子工单数据集合对应的时间段的右边界的距离大于或等于第三时间长度阈值。
  14. 根据权利要求9所述的装置，其特征在于，在所述根据所述预设编码规则对所述历史工单数据集的多个工单数据进行格式化编码生成所述历史工单数据集对应的多个单词之前，所述处理单元还用于：
    根据每个工单数据对应的网络设备将所述历史工单数据集的多个工单数据划分为至少两个子工单数据集合，所述至少两个子工单数据集合与至少两个网络设备一一对应；
    所述处理单元具体用于：
    根据所述预设编码规则对至少两个子工单数据集合进行格式化编码生成至少两个句子，所述至少两个子工单数据集合与所述至少两个句子一一对应，其中，所述至少两个句子包括所述历史工单数据集对应的多个单词。
  15. 根据权利要求9至14中任一项所述的装置，其特征在于，所述处理单元具体用于：
    确定至少两个数值区间以及所述至少两个数值区间对应的标识信息，其中，不同的数值区间对应的标识信息不同；
    根据所述待处理工单数据集的多个工单数据的数值与所述至少两个数值区间的对应关系以及所述至少两个数值区间对应的标识信息确定所述待处理工单数据集的多个工单数据对应的标识信息；
    根据所述待处理工单数据集的多个工单数据对应的标识信息对所述待处理工单数据集的多个工单数据进行格式化编码，生成所述多个待处理单词，其中，所述多个待处理单词中的任意一个包括至少一个标识信息。
  16. 根据权利要求9至14中任一项所述的装置，其特征在于，所述多个待处理单词中的第一单词包括与所述单词对应的工单数据的数据类型信息、异常网络工作信息和工单数据标识符中的至少一个，所述第一单词为所述多个待处理单词中的任意一个；所述词典包括的多个单词中的第二单词包括与所述第二单词对应的工单数据的数据类型信息、异常网络工作信息和工单数据标识符中的至少一个，所述第二单词为所述词典包括的多个单词中的任意一个。
  17. 一种确定网络故障的设备，其特征在于，包括：
    存储器，用于存储指令，
    处理器，与所述存储器耦合，用于调用所述存储器存储的指令执行权利要求1至权利 要求8中任一项所述的方法的步骤。
  18. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储了计算机程序代码，当所述计算机程序代码被处理单元或处理器执行时，确定网络故障的装置或设备执行权利要求1至权利要求8中任一项所述的方法的步骤。
PCT/CN2019/071578 2018-01-17 2019-01-14 确定网络故障的方法和装置 WO2019141144A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810042238.9A CN109905269B (zh) 2018-01-17 2018-01-17 确定网络故障的方法和装置
CN201810042238.9 2018-01-17

Publications (1)

Publication Number Publication Date
WO2019141144A1 true WO2019141144A1 (zh) 2019-07-25

Family

ID=66943229

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/071578 WO2019141144A1 (zh) 2018-01-17 2019-01-14 确定网络故障的方法和装置

Country Status (2)

Country Link
CN (1) CN109905269B (zh)
WO (1) WO2019141144A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111582343A (zh) * 2020-04-29 2020-08-25 青岛聚好联科技有限公司 一种设备故障预测的方法及装置
CN112667805A (zh) * 2019-09-30 2021-04-16 北京沃东天骏信息技术有限公司 一种工单类别确定方法、装置、设备及介质
CN114143163A (zh) * 2020-08-14 2022-03-04 中国移动通信集团浙江有限公司 基于图注意力网络的切片误告警识别方法及装置
CN114500230A (zh) * 2022-01-14 2022-05-13 云南电网有限责任公司玉溪供电局 一种基于时间轴的光传输故障录播方法及系统
CN117057786A (zh) * 2023-10-11 2023-11-14 中电科大数据研究院有限公司 一种数据中心智能化运维管理方法、系统及存储介质

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112445893A (zh) * 2019-09-05 2021-03-05 北京国双科技有限公司 一种信息搜索方法、装置、设备及存储介质
CN110704616B (zh) * 2019-09-09 2023-05-12 中盈优创资讯科技有限公司 设备告警工单识别方法及装置
CN111260150A (zh) * 2020-02-10 2020-06-09 国网辽宁省电力有限公司信息通信分公司 一种通信设备运行风险预警方法及通信管理系统
CN111800289B (zh) * 2020-05-19 2021-12-10 华为技术有限公司 通信网络故障分析方法和装置
CN111930463A (zh) * 2020-09-23 2020-11-13 杭州橙鹰数据技术有限公司 展示方法及装置
CN114430363B (zh) * 2020-10-29 2023-03-28 中国移动通信有限公司研究院 故障原因定位方法、装置、设备及存储介质
CN113657627B (zh) * 2021-08-17 2024-01-12 国网江苏省电力有限公司信息通信分公司 电力通信网中缺陷单生成方法和系统
CN114297255B (zh) * 2021-12-17 2024-04-19 中电信数智科技有限公司 一种基于日志分析的网络品质工单故障预警方法

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101742540A (zh) * 2010-02-05 2010-06-16 华为技术有限公司 在线自诊断的方法及装置
CN101846992A (zh) * 2010-05-07 2010-09-29 上海理工大学 基于数控机床故障案例的故障树构造方法
CN103310389A (zh) * 2013-05-31 2013-09-18 南方电网科学研究院有限责任公司 基于故障模式与故障树建立的架空输电线路故障检修方法
CN104376033A (zh) * 2014-08-01 2015-02-25 中国人民解放军装甲兵工程学院 一种基于故障树和数据库技术的故障诊断方法
CN106294038A (zh) * 2015-05-25 2017-01-04 阿里巴巴集团控股有限公司 一种故障谱的生成、基于故障谱的检测方法和装置
CN107196804A (zh) * 2017-06-01 2017-09-22 国网山东省电力公司信息通信公司 电力系统终端通信接入网告警集中监控系统及方法

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160125028A1 (en) * 2014-11-05 2016-05-05 Yahoo! Inc. Systems and methods for query rewriting
CN107171819B (zh) * 2016-03-07 2020-02-14 北京华为数字技术有限公司 一种网络故障诊断方法及装置
US10296430B2 (en) * 2016-04-06 2019-05-21 Nec Corporation Mobile phone with system failure prediction using long short-term memory neural networks
CN106327323A (zh) * 2016-08-19 2017-01-11 清华大学 银行频繁项模式挖掘方法及挖掘系统
CN106446076B (zh) * 2016-09-07 2019-10-18 南京理工大学 基于层次聚类的日志审计方法
CN106529804B (zh) * 2016-11-09 2023-08-18 国网江苏省电力公司南京供电公司 基于文本挖掘技术的客户投诉预警监测分析方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101742540A (zh) * 2010-02-05 2010-06-16 华为技术有限公司 在线自诊断的方法及装置
CN101846992A (zh) * 2010-05-07 2010-09-29 上海理工大学 基于数控机床故障案例的故障树构造方法
CN103310389A (zh) * 2013-05-31 2013-09-18 南方电网科学研究院有限责任公司 基于故障模式与故障树建立的架空输电线路故障检修方法
CN104376033A (zh) * 2014-08-01 2015-02-25 中国人民解放军装甲兵工程学院 一种基于故障树和数据库技术的故障诊断方法
CN106294038A (zh) * 2015-05-25 2017-01-04 阿里巴巴集团控股有限公司 一种故障谱的生成、基于故障谱的检测方法和装置
CN107196804A (zh) * 2017-06-01 2017-09-22 国网山东省电力公司信息通信公司 电力系统终端通信接入网告警集中监控系统及方法

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112667805A (zh) * 2019-09-30 2021-04-16 北京沃东天骏信息技术有限公司 一种工单类别确定方法、装置、设备及介质
CN112667805B (zh) * 2019-09-30 2024-04-09 北京沃东天骏信息技术有限公司 一种工单类别确定方法、装置、设备及介质
CN111582343A (zh) * 2020-04-29 2020-08-25 青岛聚好联科技有限公司 一种设备故障预测的方法及装置
CN111582343B (zh) * 2020-04-29 2023-09-26 青岛聚好联科技有限公司 一种设备故障预测的方法及装置
CN114143163A (zh) * 2020-08-14 2022-03-04 中国移动通信集团浙江有限公司 基于图注意力网络的切片误告警识别方法及装置
CN114143163B (zh) * 2020-08-14 2023-11-14 中国移动通信集团浙江有限公司 基于图注意力网络的切片误告警识别方法及装置
CN114500230A (zh) * 2022-01-14 2022-05-13 云南电网有限责任公司玉溪供电局 一种基于时间轴的光传输故障录播方法及系统
CN114500230B (zh) * 2022-01-14 2024-01-26 云南电网有限责任公司玉溪供电局 一种基于时间轴的光传输故障录播方法及系统
CN117057786A (zh) * 2023-10-11 2023-11-14 中电科大数据研究院有限公司 一种数据中心智能化运维管理方法、系统及存储介质
CN117057786B (zh) * 2023-10-11 2024-01-02 中电科大数据研究院有限公司 一种数据中心智能化运维管理方法、系统及存储介质

Also Published As

Publication number Publication date
CN109905269A (zh) 2019-06-18
CN109905269B (zh) 2020-11-17

Similar Documents

Publication Publication Date Title
WO2019141144A1 (zh) 确定网络故障的方法和装置
US20230073695A1 (en) Systems and methods for synthetic database query generation
US11132248B2 (en) Automated information technology system failure recommendation and mitigation
TWI718643B (zh) 異常群體識別方法及裝置
US9753801B2 (en) Detection method and information processing device
US10216558B1 (en) Predicting drive failures
US9589045B2 (en) Distributed clustering with outlier detection
CN103513983B (zh) 用于预测性警报阈值确定工具的方法和系统
WO2021068831A1 (zh) 一种业务告警方法、设备及存储介质
CN111612041B (zh) 异常用户识别方法及装置、存储介质、电子设备
US9460236B2 (en) Adaptive variable selection for data clustering
WO2020134032A1 (zh) 用于检测业务系统异常的方法及其装置
EP3364262B1 (en) Sensor data anomaly detection
KR101948634B1 (ko) 스마트 컴퓨팅을 위한 시스템 자원의 장애 예측 방법
WO2022217713A1 (zh) 症候群监测预警方法、装置、计算机设备及存储介质
CN110442516B (zh) 信息处理方法、设备及计算机可读存储介质
CN107003992B (zh) 用于神经语言行为识别系统的感知联想记忆
WO2020232898A1 (zh) 文本分类方法、装置、电子设备及计算机非易失性可读存储介质
JP2008027072A (ja) データベース分析プログラム、データベース分析装置、データベース分析方法
KR102079359B1 (ko) 개선된 sax 기법 및 rtc 기법을 이용한 공정 모니터링 장치 및 방법
CN115412947A (zh) 一种基于数字孪生与ai算法的故障仿真方法和系统
US11615361B2 (en) Machine learning model for predicting litigation risk in correspondence and identifying severity levels
CN111190792A (zh) 一种日志存储的方法、装置、电子设备及可读存储介质
CN111291824A (zh) 时间序列的处理方法、装置、电子设备和计算机可读介质
CN114997284A (zh) 水电站故障解列装置异常行为报警方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19740846

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19740846

Country of ref document: EP

Kind code of ref document: A1