WO2019184557A1 - 定位根因告警的方法、装置和计算机可读存储介质 - Google Patents

定位根因告警的方法、装置和计算机可读存储介质 Download PDF

Info

Publication number
WO2019184557A1
WO2019184557A1 PCT/CN2019/071583 CN2019071583W WO2019184557A1 WO 2019184557 A1 WO2019184557 A1 WO 2019184557A1 CN 2019071583 W CN2019071583 W CN 2019071583W WO 2019184557 A1 WO2019184557 A1 WO 2019184557A1
Authority
WO
WIPO (PCT)
Prior art keywords
alarm
root cause
rule
cause rule
determining
Prior art date
Application number
PCT/CN2019/071583
Other languages
English (en)
French (fr)
Inventor
张可力
赫彩凤
马凯伦
刘义俊
彭馨玮
厉亚辉
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2019184557A1 publication Critical patent/WO2019184557A1/zh
Priority to US17/035,054 priority Critical patent/US20210014103A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0677—Localisation of faults
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • H04L41/064—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis involving time analysis

Definitions

  • the present application relates to the field of telecommunications network failure alarms and, more particularly, to a method, apparatus and computer readable storage medium for locating root cause alarms.
  • the traditional solution is to analyze the alarm data of the telecommunication network according to its own experience, summarize the causal relationship and priority between different alarms, and construct the root cause decision network according to the causal relationship and priority between different alarms.
  • the root cause alarm in the alarm flow is then located according to the root cause decision network.
  • the traditional scheme cannot accurately construct the root cause decision network by relying on human experience or knowledge. Therefore, the traditional scheme cannot accurately perform root cause alarm positioning.
  • the present application provides a method, apparatus, and computer readable storage medium for locating root cause alarms to improve the accuracy of root cause alarm positioning.
  • the first aspect provides a method for locating a root cause alarm in a telecommunication network, the method comprising: acquiring an alarm association rule of a telecommunication network; decomposing the alarm association rule to obtain a candidate root cause rule; and performing historical alarm data according to the telecommunication network Determining timing information of the candidate root cause rule; determining a valid root cause rule from the candidate root cause rule according to the time series information of the candidate root cause rule; extracting the associated alarm combination from the alarm flow of the telecommunication network; determining the association according to the effective root cause rule Root cause alarm in the alarm combination.
  • the candidate root cause rule includes a first alarm and a second alarm, where the timing information of the candidate root cause is used to indicate a probability that the first alarm occurs in time before the second alarm occurs.
  • the historical alarm data may include alarm data of many telecommunication devices in the telecommunication network, and the historical alarm data may include the type of the alarm, the time when the alarm occurred, the device where the alarm occurs, and the like.
  • the alarm association rule is decomposed to obtain the candidate root cause rule, including: decomposing the alarm association rule to obtain multiple alarms; and combining the multiple alarms to obtain the candidate root cause rule.
  • a candidate root cause rule composed of two alarms can be obtained, which facilitates analysis of the causal relationship between any two alarms in the alarm association rule.
  • each candidate root cause rule includes two alarms.
  • each candidate root cause rule includes a first alarm and a second alarm, and the first alarm The alarm may be in front of the candidate root cause rule (also referred to as a pre-order alarm or a pre-order alarm), and the second alarm may be an alarm located after the candidate root cause rule (also referred to as a post-order alarm).
  • the effective root cause rule can be selected from the candidate root cause rule (that is, the candidate root can be selected according to the time series information) Because the effective root cause rule is selected in the rule, a more accurate root cause alarm location can be performed according to the effective root cause rule.
  • the obtaining the alarm association rule of the telecommunication network includes: determining an alarm association rule of the telecommunication network according to historical alarm data of the telecommunication network.
  • the alarm association rule of the telecommunication network may be determined or generated by performing frequent item mining on historical alarm data of the telecommunication network.
  • the above valid root cause rule may be a root cause rule that the time series information satisfies the preset requirement.
  • the timing information is a timing coefficient value
  • the timing coefficient value is used to indicate a probability that the first alarm in the candidate root cause rule precedes the second alarm.
  • the greater the timing coefficient value is, the greater the probability that the first alarm in the candidate root cause rule precedes the second alarm in time.
  • timing information is a timing coefficient value
  • determining, according to the timing information of the candidate root cause rule, the valid root cause rule from the candidate root cause rule including: selecting the candidate root cause rule
  • the root cause rule of the timing coefficient value within the preset range is determined as a valid root cause rule.
  • the root cause rule that is, the effective root cause rule
  • the root cause rule whose validity meets the requirements can be selected from the candidate root cause rules, so that the root cause alarm can be subsequently determined according to the more effective root cause rules.
  • determining, as the valid root cause rule, the root cause rule that the time series coefficient value in the candidate root cause rule is within a preset range including: setting a timing coefficient value in the candidate root cause rule to be greater than or equal to a first time series coefficient threshold.
  • the root cause rule is determined to be a valid root cause rule.
  • the value of the timing coefficient value is [0, 1], and when the timing coefficient value is 0, the first alarm in the candidate root cause rule must not occur before the second alarm, when the timing coefficient value A value of 1 indicates that the first alarm in the candidate root cause rule must occur before the second alarm.
  • the value of the first timing coefficient threshold may be 0.5, that is, when the timing coefficient value of the candidate root cause rule is greater than or equal to 0.5, the candidate root cause rule is a valid root cause rule.
  • determining the timing information of the candidate root cause rule according to the historical alarm data of the telecommunication network including: determining, according to the historical alarm data, that the first alarm occurs before or after the second alarm within a preset time interval. The number of times; the timing information of the candidate root cause rule is determined according to the number of times the first alarm occurs before or after the second alarm in the preset time interval.
  • the number of occurrences of the first alarm and the second alarm in a certain time interval in the past, and the sequence of occurrences can be determined, and it can be determined that the first alarm occurs before the second alarm or the second alarm occurs.
  • the probability in turn, can determine timing information.
  • the determining, according to the historical alarm data, the number of times that the first alarm occurs before or after the second alarm in the preset time interval including: determining, according to the historical alarm data, that the first alarm and the second alarm are respectively at a preset time Timestamp when the interval occurs; determining the number of times the first alarm occurs before or after the second alarm according to the timestamp when the first alarm and the second alarm occur respectively within a preset time interval .
  • determining a root cause in the associated alarm combination according to the effective root cause rule includes: determining, from the valid root cause rule, a target root cause rule corresponding to the associated alarm combination, where the target root cause The alarms in the rule are all in the associated alarm combination; the root cause alarm in the associated alarm combination is determined according to the target root cause rule.
  • the target root cause rule corresponding to the associated alarm combination is determined from the effective root cause rule, the root cause rule of any two alarms in the associated root alarm combination is selected in the effective root cause rule, and the association is obtained.
  • the target root cause rule corresponding to the alarm combination is obtained.
  • the root cause rule closely related to the associated alarm combination in the effective root cause rule can be directly selected, and thus the target root cause rule can be further Targeted to locate root cause alarms in associated alarm combinations.
  • the root cause alarm in the associated alarm combination is determined according to the target root cause rule, including: constructing a root cause decision network based on the target root cause rule; determining a root cause in the associated alarm combination according to the root cause decision network Alarm.
  • the above-mentioned root cause decision network is an alarm decision network composed of various alarms in the target root cause rule.
  • determining a root cause alarm in the associated alarm combination according to the target root cause rule including: determining weight information of the target root cause rule according to the historical alarm data, where the weight information of the target root cause rule is used to indicate The causal relationship strength between the alarms in the target root cause rule; determining the impact factor of each alarm in the associated alarm combination according to the target root cause rule and the weight information of the target root cause rule; determining the associated alarm combination according to the size of the impact factor Root cause alarm.
  • the impact factor of each alarm is used to indicate the degree of influence of each alarm on other alarms in the associated alarm combination.
  • the degree of influence of each alarm in the associated alarm combination on other alarms can be determined, and the root cause alarm in the associated alarm combination can be accurately determined according to the impact length of each alarm on other alarms. .
  • determining the weight information of the target root cause rule according to the historical alarm data including: determining the weight information of the target root cause rule directly according to the historical alarm data after obtaining the target root cause rule.
  • determining the weight information of the target root cause rule according to the historical alarm data including: determining the weight information of the candidate root cause rule or the effective root cause rule according to the historical alarm data before obtaining the target root cause rule;
  • the weight information of the target root cause rule is obtained from the weight information in the rule or the valid root cause rule.
  • determining a root cause alarm in the associated alarm combination according to the size of the impact factor including: determining K alarms in the associated alarm combination as a root cause alarm, where K is an integer greater than or equal to The influence of the K alarms is greater than or equal to the influence factor of any one of the associated alarm combinations except for the K alarms.
  • the weight information of the target root cause rule is determined according to the historical alarm data, including: determining the weight information of the target root cause rule according to the historical alarm data, the third alarm and the fourth alarm are respectively within a preset time interval. a frequency occurring within a plurality of time windows; generating a frequency sequence in which the third alarm occurs according to a frequency occurring in the plurality of time windows in the preset time interval according to the third alarm; respectively, according to the fourth alarm at a preset time interval The frequency occurring within the plurality of time windows within the plurality of time windows generates a frequency sequence in which the fourth alarm occurs; and determines the weight information of the target root cause rule according to the similarity between the frequency sequence in which the third alarm occurs and the frequency sequence in which the fourth alarm occurs.
  • a method for locating root cause alarms in a telecommunications network includes: acquiring an alarm association rule of a telecommunication network; decomposing the alarm association rule to obtain a candidate root cause rule; determining time series information of the candidate root cause rule according to the historical alarm data of the telecommunication network; and determining a candidate root cause rule according to the historical alarm data;
  • the weight information of the candidate root cause rule is used to indicate the intensity of the causal relationship between the first alarm and the second alarm;
  • the effective root cause is determined from the candidate root cause rule according to the timing information and the weight information of the candidate root cause rule Rule; extract the associated alarm combination from the alarm flow of the telecommunication network; determine the root cause alarm in the associated alarm combination according to the effective root cause rule.
  • the candidate root cause rule includes a first alarm and a second alarm, and the timing information of the candidate root cause is used to indicate a probability that the first alarm occurs in time before the second alarm occurs.
  • the number of candidate root cause rules may be multiple, that is, after the candidate root cause rules are decomposed, multiple candidate root cause rules may be obtained.
  • each candidate root cause rule includes two alarms.
  • each candidate root cause rule includes a first alarm and a second alarm
  • the first alarm may be an alarm located in front of the candidate root cause rule ( It may also be referred to as a pre-order alarm or a pre-alarm alarm.
  • the second alarm may be an alarm (also referred to as a post-sequence alarm) located after the candidate root cause rule.
  • the foregoing method for decomposing the alarm association rule to obtain the candidate root cause rule includes: decomposing the alarm association rule to obtain multiple alarms; and combining the multiple alarms to obtain the candidate root cause rule.
  • a candidate root cause rule composed of two alarms can be obtained, which facilitates analysis of the causal relationship between any two alarms in the alarm association rule.
  • the candidate root cause rule can be more accurately determined. Filter out valid root cause rules, and then perform more accurate root cause alarm positioning based on effective root cause rules.
  • the obtaining the alarm association rule of the telecommunication network includes: determining an alarm association rule of the telecommunication network according to historical alarm data of the telecommunication network.
  • the alarm association rule of the telecommunication network may be determined or generated by performing frequent item mining on historical alarm data of the telecommunication network.
  • the valid root cause rule is that the time series information and the weight information satisfy the root cause rule of the preset requirement.
  • the timing information is a timing coefficient value
  • the weight information is a weight coefficient value
  • the effective root cause rule is determined from the candidate root cause rule according to the timing information of the candidate root cause rule and the weight information, including: The root cause coefficient value in the candidate root cause rule is within the first preset range, and the root cause rule whose weight coefficient value is within the second preset range is determined as the effective root cause rule.
  • the value of the timing coefficient value is [0, 1], and when the timing coefficient value is 0, the first alarm in the candidate root cause rule must not occur before the second alarm, when the timing coefficient value A value of 1 indicates that the second alarm in the candidate root cause rule must occur before the first alarm.
  • the value of the weight coefficient is in the range of [0, 1], and when the weight coefficient is 0, the first alarm in the candidate root cause rule does not cause the second alarm to occur.
  • a value of 1 indicates that the first alarm in the candidate root cause rule must cause the second alarm to occur.
  • the root cause rule in the candidate root cause rule is within a first preset range, and the root cause rule in the second preset range is determined as a valid root cause rule, including: A root cause rule in which the timing coefficient value in the candidate root cause rule is greater than or equal to the first time coefficient threshold and the weight coefficient value is greater than or equal to the first weight coefficient threshold is determined as a valid root cause rule.
  • the first timing coefficient threshold is 0.5
  • the first weight coefficient threshold is 0.
  • determining the timing information of the candidate root cause rule according to the historical alarm data of the telecommunication network including: determining, according to the historical alarm data, that the first alarm occurs before or after the second alarm within a preset time interval. The number of times; the timing information of the candidate root cause rule is determined according to the number of times the first alarm occurs before or after the second alarm in the preset time interval.
  • the number of occurrences of the first alarm and the second alarm in a certain time interval in the past, and the sequence of occurrences can be determined, and it can be determined that the first alarm occurs before the second alarm or the second alarm occurs.
  • the probability in turn, can determine timing information.
  • the determining, according to the historical alarm data, the number of times that the first alarm occurs before or after the second alarm in the preset time interval including: determining, according to the historical alarm data, that the first alarm and the second alarm are respectively at a preset time Timestamp when the interval occurs; determining the number of times the first alarm occurs before or after the second alarm according to the timestamp when the first alarm and the second alarm occur respectively within a preset time interval .
  • determining the weight information of the initial root cause rule according to the historical alarm data including: determining, according to the historical alarm data, that the first alarm and the second alarm occur in multiple time windows within a preset time interval
  • the frequency of the first alarm is generated according to the frequency that occurs in the multiple time windows in the preset time interval, and the second alarm is respectively in multiple time windows within the preset time interval.
  • the frequency of occurrence generates a frequency sequence in which the second alarm occurs; and determines the weight information of the initial root cause rule according to the degree of similarity between the frequency sequence in which the first alarm occurs and the frequency sequence in which the second alarm occurs.
  • determining a root cause alarm in the associated alarm combination according to the effective root cause rule including: determining, from the valid root cause rule, a target root cause rule corresponding to the associated alarm combination, where the target root The alarms in the rule are all in the associated alarm combination; the root cause alarm in the associated alarm combination is determined according to the target root cause rule.
  • the target root cause rule corresponding to the associated alarm combination is determined from the effective root cause rule, the root cause rule of any two alarms in the associated root alarm combination is selected in the effective root cause rule, and the association is obtained.
  • the target root cause rule corresponding to the alarm combination is obtained.
  • the root cause rule closely related to the associated alarm combination in the effective root cause rule can be directly selected, and thus the target root cause rule can be further Targeted to locate root cause alarms in associated alarm combinations.
  • determining the root cause alarm in the associated alarm combination according to the target root cause rule including: determining the impact of each alarm in the associated alarm combination according to the target root cause rule and the weight information of the target root cause rule The factor, wherein the impact factor of each alarm is used to indicate the degree of influence of each alarm on other alarms in the associated alarm combination; and the root cause alarm in the associated alarm combination is determined according to the size of the impact factor.
  • the degree of influence of each alarm in the associated alarm combination on other alarms can be determined, and the root cause alarm in the associated alarm combination can be accurately determined according to the impact length of each alarm on other alarms. .
  • determining a root cause alarm in the associated alarm combination according to the size of the impact factor including: determining K alarms in the associated alarm combination as a root cause alarm, where K is an integer greater than or equal to The influence of the K alarms is greater than or equal to the influence factor of any one of the associated alarm combinations except for the K alarms.
  • a method for locating root cause alarms in a telecommunications network includes: acquiring alarm association rule information; decomposing the alarm association rule to generate a candidate root cause rule; acquiring historical alarm data; determining timing information of the candidate root cause rule according to the historical alarm data; and selecting from the candidate root cause rule according to the time series information Selecting a valid root cause rule obtains valid root cause rule information corresponding to the valid root cause rule.
  • the alarm association rule information is used to indicate an alarm association rule, and the alarm association rule can be obtained according to the alarm association rule information.
  • the effective root cause rule can be selected from the candidate root cause rule (that is, the candidate root can be selected according to the time series information) Because the effective root cause rule is selected in the rule, and the effective root cause rule information is generated, it is convenient to perform more accurate root cause alarm positioning according to the valid root cause rule information.
  • the foregoing method further includes: storing valid root cause rule information.
  • the effective root cause rule information can be conveniently extracted and the root cause alarm is located.
  • the method further includes: extracting an associated alarm combination from the alarm flow of the telecommunication network; determining, in the associated alarm combination, according to the effective root cause rule indicated by the effective root cause rule information Root cause alarm.
  • the root cause alarm location can be obtained through the pre-acquired effective root cause rule information, which can improve the efficiency of root cause alarm location.
  • a method for locating root cause alarms in a telecommunications network includes: acquiring alarm association rule information; decomposing the alarm association rule to generate a candidate root cause rule; determining timing information of the candidate root cause rule according to the historical alarm data; determining weight information of the candidate root cause rule according to the historical alarm data; The time series information and the weight information select a valid root cause rule from the candidate root cause rules, and obtain valid root cause rule information corresponding to the valid root cause rule.
  • the candidate root cause rule can be more accurately determined.
  • the effective root cause rule is filtered out, and the effective root cause rule information is generated, so that the more accurate root cause alarm positioning can be performed according to the valid root cause rule information.
  • the foregoing method further includes: storing valid root cause rule information.
  • the effective root cause rule information can be conveniently extracted and the root cause alarm is located.
  • the method further includes: extracting an associated alarm combination from the alarm flow of the telecommunication network; determining, in the associated alarm combination, according to the effective root cause rule indicated by the effective root cause rule information Root cause alarm.
  • the root cause alarm location can be obtained through the pre-acquired effective root cause rule information, which can improve the efficiency of root cause alarm location.
  • an apparatus for locating a root cause alarm comprising means for performing the method of the first aspect, the second aspect, the third aspect or the fourth aspect.
  • a sixth aspect provides a device for locating a root cause alarm, the device for locating a root cause alarm comprising a memory and a processor, wherein the memory is configured to store a program, and the processor is configured to execute the program stored in the memory, when the program is executed
  • the processor is operative to perform the method of the first aspect, the second aspect, the third aspect, or the fourth aspect described above.
  • the above memory includes a non-volatile storage medium for storing a program.
  • the processor is a central processing unit, and the central processing unit is connected to the non-volatile storage medium for executing a program stored in a non-volatile storage medium.
  • a seventh aspect a computer readable medium storing program code for execution by a device, the program code comprising the first aspect, the second aspect, the third aspect, or the fourth aspect described above The method described.
  • a computer program product comprising instructions for causing a computer to perform the method of the first aspect, the second aspect, the third aspect, or the fourth aspect described above when the computer program product is run on a computer.
  • a server comprising the apparatus for locating a root cause alarm in the fifth aspect or the sixth aspect.
  • FIG. 1 is a schematic flowchart of a method for locating a root cause alarm in a telecommunication network according to an embodiment of the present application
  • FIG. 2 is a schematic diagram of the occurrence of alarm A and alarm B in a part of a time window
  • Figure 3 is a schematic diagram of a root cause decision network
  • FIG. 4 is a schematic diagram of the number of occurrences of the alarm A and the alarm B in a part of the time window;
  • FIG. 5 is a schematic flowchart of a method for locating a root cause alarm in a telecommunication network according to an embodiment of the present application
  • Figure 6 is a schematic diagram of a root cause decision network
  • FIG. 7 is a schematic flowchart of a method for locating a root cause alarm in a telecommunication network according to an embodiment of the present application
  • FIG. 8 is a schematic flowchart of a method for locating a root cause alarm in a telecommunication network according to an embodiment of the present application
  • FIG. 9 is a schematic flowchart of a method for locating a root cause alarm in a telecommunication network according to an embodiment of the present application.
  • 10 is a schematic diagram of occurrences of alarm A and alarm B in a partial time window
  • 11 is a schematic diagram of the number of occurrences of the alarm A and the alarm B in a part of the time window;
  • FIG. 12 is a schematic flowchart of a method for locating a root cause alarm in a telecommunication network according to an embodiment of the present application.
  • Figure 13 is a schematic diagram of a root cause decision network
  • Figure 14 is a schematic flow chart for determining the root cause alarm in the associated alarm combination A 1 A 2 A 3 A 4 A 5 A 6 ;
  • 15 is a schematic block diagram of an apparatus for locating a root cause alarm in a telecommunication network according to an embodiment of the present application
  • 16 is a schematic block diagram of an apparatus for locating a root cause alarm in a telecommunication network according to an embodiment of the present application
  • 17 is a schematic block diagram of an apparatus for locating a root cause alarm in a telecommunication network according to an embodiment of the present application
  • FIG. 18 is a schematic block diagram of a root cause alarm locating device according to an embodiment of the present application.
  • FIG. 19 is a schematic diagram of root cause alarm positioning performed by a root cause alarm positioning apparatus according to an embodiment of the present application.
  • FIG. 20 is a schematic diagram of an application scenario of an embodiment of the present application.
  • the method for locating the root cause alarm in the telecommunication network in the embodiment of the present application can be applied to the telecommunication network for performing root cause alarm positioning on the telecommunication network device.
  • the method for locating the root cause alarm in the telecommunication network in the embodiment of the present application may be performed by a server or a server cluster in the telecommunication network, and the server in the telecommunication network may be a general-purpose computer with a mainstream operating system (for example, windows, unix, etc.) installed. system.
  • the above telecommunication network may be a communication system that constitutes communication between a plurality of users, and is an important infrastructure for humans to realize long-distance communication.
  • the telecommunication network uses cables, wireless, optical fibers or other electromagnetic systems to transmit, transmit and receive logos, characters, images, Sound or other signal.
  • a telecommunication network can be generally divided into multiple domains. For example, considering only a transmission network and a wireless network, the telecommunication network can be hierarchically divided into an access transport network (ATN) domain and a microwave (from the top to the bottom). A microwave, MW) domain and a radio access network (RAN) domain, wherein the ATN domain may also be referred to as a digital communication domain. Therefore, if divided by domain, the telecommunication network device includes an ATN domain device, a MW domain device, a RAN domain device, and other domain devices.
  • ATN access transport network
  • MW microwave
  • RAN radio access network
  • FIG. 1 is a schematic flowchart of a method for locating a root cause alarm in a telecommunication network according to an embodiment of the present application.
  • the method shown in FIG. 1 includes steps 101 to 106, wherein the occurrence of step 104 and step 105 is not strictly sequential in time, and step 105 may occur before step 104 or after step 104, or Steps 104 and 105 can occur simultaneously. Steps 101 to 106 are described in detail below.
  • the above alarm association rules can be preset or acquired in real time.
  • the alarm association rule may be preset in the server (for example, the alarm association rule is saved in the memory in advance), and when the alarm association rule needs to be acquired, the alarm association rule may be directly The alarm association rule is retrieved from the server.
  • the alarm association rule of the telecommunication network can also be obtained according to historical alarm data of the telecommunication network. Specifically, the historical alarm data of the telecommunication network may be acquired first, and then the frequent item mining of the historical alarm data is performed to generate an alarm association rule of the telecommunication network.
  • the alarm association rule may be decomposed to obtain multiple alarms, and then multiple alarms may be combined in pairs to obtain candidate root cause rules.
  • a candidate root cause rule composed of two alarms can be obtained, which facilitates analysis of the causal relationship between any two alarms in the alarm association rule.
  • the alarm association rule ABC is decomposed to obtain alarm A, alarm B, and alarm C. These alarms can be combined in pairs to obtain candidate root cause rules ⁇ A->B, A->C, B->A, B. ->C, C->A, C->B ⁇ .
  • the number of candidate root cause rules may be multiple, and each candidate root cause rule includes two alarms.
  • the candidate root cause rule includes a first alarm and a second alarm, and the timing information of the candidate root cause rule is used to indicate a probability that the first alarm occurs before the second alarm occurs in time.
  • the timing information of the candidate root cause rule A->B is used to indicate the probability that the alarm A occurs before the alarm B in time.
  • the historical alarm data may be alarm data collected from various devices in the telecommunication network for a period of time, and the historical alarm data may include a device in which the alarm occurs, a time when the alarm occurs, and a type of the alarm.
  • determining the timing information of the candidate root cause rule according to the historical alarm data of the telecommunication network including: determining, according to the historical alarm data, the number of times the first alarm occurs before or after the second alarm in the preset time interval; The timing information of the candidate root cause rule is determined by the number of times the alarm occurs before or after the second alarm in a preset time interval.
  • the number of occurrences of the first alarm and the second alarm in a certain time interval in the past, and the sequence of occurrences can be determined, and it can be determined that the first alarm occurs before the second alarm or the second alarm occurs.
  • the probability in turn, can determine timing information.
  • the first alarm and the second alarm may be determined according to the historical alarm data. Setting a timestamp when the time interval occurs, and then determining the first alarm according to the timestamp when the first alarm occurs within the preset time interval and the timestamp when the second alarm occurs within the preset time interval The number of times before or after the second alarm occurred within a preset time interval.
  • the preset time interval may be divided into multiple time windows, and then the alarm A is determined before the alarm in each time window. The number of occurrences of B, and finally the number of times the first alarm occurs before or after the second alarm in the preset time interval.
  • the preset time interval may be a relatively long time, and each time window may be a short time.
  • the time interval may be 3 months, and the time window may be the preset time interval.
  • the 5 minute time period is divided.
  • the preset time interval may be first divided into multiple time windows, and then the alarm A and the alarm B are determined according to the historical alarm data respectively in each time window. The timestamp generated within the time zone is obtained by the alarm A and the alarm B in each time window. Finally, the integrated alarm A and the alarm B occur in each time window to obtain the alarm A before the preset time interval. The number of times the alarm B occurs, and the timing information of the candidate root cause rule A->B is obtained.
  • FIG. 2 shows the occurrence of alarm A and alarm B in a part of the time window (window 0 to window 2). Specifically, in window 0 to window 2, the occurrences of alarm A and alarm B are as follows:
  • A0 to A6 record the timestamps when alarm A occurs in different time windows
  • B0 to B5 record the timestamps when alarm B occurs in different time windows.
  • the number of times that the alarm A occurs before the alarm B in the time window 0 can be obtained.
  • the alarm A can be obtained in other time windows.
  • the number of times that the alarm B occurs is obtained by summing the number of times the alarm A occurs before the alarm B in each time window, and the number of times the alarm A occurs before the alarm B in the preset time interval.
  • the timing information of the candidate root cause rule A->B can be obtained.
  • the above valid root cause rule may be a root cause rule that the time series information satisfies the preset requirement. Therefore, the root cause rule that the time series information satisfies the preset requirement can be selected from the candidate root cause rules as the effective root cause rule.
  • the timing information may be specifically represented by a timing coefficient value, and the magnitude of the timing coefficient value may indicate the validity of the candidate root cause rule. For example, when the timing coefficient value of the candidate root cause rule is larger, the probability that the first alarm of the candidate root cause rule precedes the second alarm is greater, and the validity of the candidate root cause rule is higher; The smaller the timing coefficient value of the root cause rule, the smaller the probability that the first alarm of the candidate root cause rule occurs before the second alarm in time, and the validity of the candidate root cause rule is lower.
  • the value of the timing coefficient value ranges from [0, 1].
  • the timing coefficient value is 0, the first alarm in the candidate root cause rule must not occur before the second alarm.
  • the probability of occurrence of the second alarm is 0).
  • the value of the timing coefficient is 1, the first alarm in the candidate root cause rule must be prior to the second alarm (the probability that the first alarm occurs before the second alarm is 1) ).
  • the effective root cause rule may be filtered from the candidate root cause rule according to the timing coefficient value.
  • determining a valid root cause rule from the candidate root cause rule includes: determining a root cause rule in the candidate root cause rule that the time series coefficient value is within a preset range as a valid root cause rule.
  • the root cause rule that is, the effective root cause rule
  • the root cause rule whose validity satisfies the requirement can be selected from the candidate root cause rule, which facilitates subsequent follow-up based on these more effective root cause rules. Perform root cause alarm positioning.
  • a root cause rule in which the time series coefficient value in the candidate root cause rule is greater than or equal to the first time series coefficient threshold may be determined as a valid root cause rule.
  • the value of the first timing coefficient threshold may be 0.5. Therefore, when the timing coefficient value of a candidate root cause rule is greater than or equal to 0.5, the candidate root cause rule is selected as the effective root cause rule.
  • the alarm compression technology can be used to combine the alarms associated with the service alarms in the alarm flow to obtain the alarms. Associate alarm combinations.
  • the root cause alarm in the associated alarm combination may be determined according to a causal relationship between different alarms in the effective root cause rule.
  • the associated alarm combination is ABC
  • the effective root cause rule is ⁇ A->B, A->C, B->D, C->E, D->F ⁇ . Then, according to the effective root cause rule, the alarm is known. The occurrence of A will cause the occurrence of alarm B and alarm C. Therefore, it can be determined that alarm A is the root cause alarm in the associated alarm combination ABC.
  • the effective root cause rule can be selected from the candidate root cause rule (that is, the candidate root can be selected according to the time series information) Because the effective root cause rule is selected in the rule, a more accurate root cause alarm location can be performed according to the effective root cause rule.
  • Root cause alarm in the associated alarm combination when the root cause alarm in the associated alarm combination is determined according to the effective root cause rule, the root cause alarm related to the associated alarm combination may also be selected from the effective root cause rule, and then determined according to the root cause alarm. Root cause alarm in the associated alarm combination.
  • the foregoing determining, according to the effective root cause rule, the root cause in the associated alarm combination including: determining, from the valid root cause rule, a target root cause rule corresponding to the associated alarm combination; The rule determines the root cause alarm in the associated alarm combination.
  • the associated alarm combination is ABC
  • the effective root cause rule is ⁇ A->B, A->C, B->D, C->E, D->F ⁇ , where the root cause rule A->B Both the alarm A and the alarm B are in the associated alarm combination ABC.
  • the alarm A and the alarm C in the root cause rule A->C are both in the associated alarm combination ABC. Therefore, the root cause rule A-> B and the root cause rule A->C are selected from the effective root cause rule to obtain the target root cause rule ⁇ A->B, A->C ⁇ .
  • the root cause rule closely related to the associated alarm combination in the effective root cause rule can be directly selected, and thus the target root cause rule can be further Targeted to locate root cause alarms in associated alarm combinations.
  • the root cause decision network may be constructed according to the target root cause rule, and then the associated alarm combination is located according to the root cause decision network. Root cause alarm.
  • a simple root cause decision network can be constructed according to the target root cause rule.
  • the root cause decision network is as shown in FIG. 3. As shown, the root cause decision network shown in FIG. 3 can easily determine that the alarm A is the root cause alarm of the associated alarm combination ABC.
  • the weight information of the target root cause rule may be acquired first, and then the weight of the target root cause rule and the target root cause rule according to the target root cause rule. Information to determine the root cause alarm in the associated alarm combination.
  • the method shown in FIG. 1 further includes: determining weight information of the target root cause rule according to the historical alarm data, where the weight information of the target root cause rule is used to indicate the target root cause rule The intensity of the causal relationship between the alarms.
  • the weight information of the target root cause rule is directly determined according to the historical alarm data; and the second method determines the candidate root cause according to the historical alarm data before the target root cause rule is obtained.
  • the weight information of the rule or the effective root cause rule so that after the target root cause rule is obtained, the weight information of the target root cause rule can be directly obtained from the weight information in the candidate root cause rule or the effective root cause rule.
  • the weight information of the target root cause rule can be determined after determining the target root cause rule from the effective root cause rule, or before determining the target root cause rule from the effective root cause rule.
  • the weight information of the target root cause rule can be determined by the following process.
  • the weight information of the target root cause rule is determined according to the similarity between the frequency sequence in which the third alarm occurs and the frequency sequence in which the fourth alarm occurs.
  • the weight coefficient of the target root cause rule may also be determined as described above.
  • the frequency of the alarm occurring in multiple time windows within the preset time interval may specifically refer to the number of times the alarm occurs within each of the plurality of time windows within the preset time interval.
  • the preset time interval may be first divided into multiple time windows, and then the alarm A and the alarm B are respectively determined according to the historical alarm data in each time window. The number of occurrences in the event, and finally the number of times that the alarm A and the alarm B occur within each time window can obtain the frequency sequence in which the alarm A and the alarm B occur.
  • FIG. 4 shows the number of times that the alarm A and the alarm B occur in a part of the time window (window 0 to window 2). Specifically, in the window 0 to the window 2, the alarm A occurs 2 times, 3 times, and 2 times, respectively. In window 0 to window 2, alarm A occurred once, twice, and three times, respectively.
  • the frequency sequence in which alarm A occurs is 2 3 2
  • the frequency sequence in which alarm B occurs is 1 2 3 .
  • the weight information of the target root cause rule A->B can be determined according to the similarity between the frequency sequence 2 3 2 and the frequency sequence 1 2 3 .
  • the root cause alarm in the associated alarm combination can be directly determined according to the target root cause rule and the weight information of the target root cause rule.
  • determining, according to the target root cause rule, the root cause alarm in the associated alarm combination including: determining, according to the target root cause rule and the weight information of the target root cause rule, each alarm in the associated alarm combination. Impact factor; determine the root cause alarm in the associated alarm combination based on the size of the impact factor.
  • the impact factor of each of the foregoing alarms is used to indicate the degree of influence of each alarm on other alarms in the associated alarm combination.
  • the degree of influence of one alarm on other alarms may be the probability that other alarms may occur when the alarm occurs. For example, the impact of alarm A on alarm B is very large. Therefore, the occurrence of alarm A is likely to cause alarm B to occur.
  • the impact factor of the alarm A is used to indicate the degree of influence of the alarm A on the alarm B and the alarm C in the associated alarm ABC. If the impact factor of the alarm A is greater than the impact factor of the alarm B and the impact of the alarm C Factor, then, in Alarm A, Alarm B, and Alarm C, Alarm A has the greatest impact on other alarms in the associated alarm combination ABC, and Alarm A can be determined as the root cause alarm in the associated alarm combination ABC.
  • the alarm with the largest impact factor can be determined as the root cause alarm in the associated alarm combination, and the alarms with the largest impact factor can be determined as the associated alarm combination. Root cause alarm.
  • determining a root cause alarm in the associated alarm combination according to the size of the impact factor including: determining K alarms in the associated alarm combination as a root cause alarm, where K is greater than or equal to 1 An integer, and the influence of the K alarms is greater than or equal to the influence factor of any one of the associated alarm combinations except for the K alarms.
  • the above-mentioned method of selecting the root cause alarm can also be understood as selecting the alarm with the largest K influence factor from the associated alarm as the root cause alarm.
  • K the alarm with the largest impact factor in the associated alarm combination is determined as the root cause alarm in the associated alarm combination; when K is greater than 1, the alarms with the largest impact factor in the associated alarm combination are determined as the associated alarm combination. Root cause alarm.
  • a valid root cause rule may be selected from the candidate root cause rule according to the time series information and the weight information of the candidate root cause rule.
  • the embodiment of the present application proposes another method for locating the root cause alarm in the telecommunication network. This method is described in detail below with reference to FIG. 5.
  • FIG. 5 is a schematic flowchart of a method for locating a root cause alarm in a telecommunication network according to an embodiment of the present application.
  • the method shown in FIG. 5 includes steps 201 to 206, wherein the occurrence of step 204 and step 205 is not strictly sequential in time, and step 205 may occur before step 204 or after step 204, or Step 204 and step 205 may occur simultaneously, and step 201 to step 206 are respectively described in detail below.
  • steps 201 to 203 in the method shown in FIG. 5 are substantially the same as the contents of steps 101 to 103 in the method shown in FIG. 1 (the timing of determining the candidate root cause rule in step 203)
  • the information is the same as the content of the timing information of the candidate root cause rule determined in step 103), and the definitions and explanations of steps 101 to 103 above are equally applicable to 201 to 203.
  • the contents of steps 205 and 206 are substantially the same as the contents of steps 105 and 106, respectively, and the definitions and explanations of steps 105 and 106 above apply equally to 205 and step 206. Therefore, for the sake of brevity, in describing the respective steps of the method shown in FIG. 5, the repeated description will be appropriately omitted.
  • the alarm association rule may be preset in the server.
  • the alarm association rule is preset in the memory of the server, and when step 201 is performed, it may be directly from the server's memory. Obtain the alarm association rule directly.
  • the foregoing alarm association rule may also be obtained by the server in real time.
  • the server may acquire the alarm association rule of the telecommunication network according to historical alarm data of the telecommunication network.
  • the alarm association rule is obtained based on the historical alarm data
  • the historical alarm data of the telecommunication network may be acquired first, and then the frequent item mining of the historical alarm data is performed to generate an alarm association rule of the telecommunication network.
  • the alarm association rule may be decomposed first, and then the alarms obtained by decomposing the alarm association rule may be combined in pairs to obtain a candidate root cause rule.
  • a candidate root cause rule composed of two alarms can be obtained, which facilitates analysis of the causal relationship between any two alarms in the alarm association rule.
  • the alarm association rule ABCD is decomposed to obtain alarm A, alarm B, alarm C, and alarm D, and then the four rules are combined to obtain candidate rules ⁇ A->B, A->C, A- >D, B->A, B->C, B->D, C->A, C->B, C->D, D->A, D->B, D->C ⁇ .
  • the number of candidate root cause rules may be multiple (12 candidate root cause rules may be obtained according to the alarm association rule ABCD), and each candidate root cause rule includes two alarms.
  • the candidate root cause rule includes a first alarm and a second alarm, and the timing information of the candidate root cause rule is used to indicate a probability that the first alarm occurs before the second alarm occurs in time.
  • A is the first alarm
  • B is the second alarm
  • A is the second alarm
  • B is the first alarm.
  • the timing information of the candidate root cause rule A->B is determined. The above is to determine the probability that alarm A (or alarm B) will occur in time before alarm B (or alarm A).
  • the historical alarm data can be analyzed to obtain the probability that the first alarm occurs before the second alarm in time, thereby determining the timing information of the candidate root cause rule.
  • the number of times the first alarm occurs before or after the second alarm in the preset time interval may be determined according to the historical alarm data, and then the first alarm is preceded or followed by the second time according to the first alarm. The number of times the alarm occurs to determine the timing information of the candidate root cause rule.
  • the timing coefficient value of the candidate rule alarm may be determined to be 0.7, and the timing coefficient value greater than 0.5 indicates that the first alarm occurs before the second alarm occurs more than the second alarm precedes the second alarm. The number of times an alarm occurred.
  • the number of occurrences and the sequence of occurrence of the first alarm and the second alarm in a certain interval in the past can be known, and the probability that the first alarm occurs before the second alarm or the second alarm can be determined.
  • timing information can be determined.
  • determining, according to the historical alarm data, the number of times that the first alarm occurs before or after the second alarm in the preset time interval specifically: determining, according to the historical alarm data, that the first alarm and the second alarm are respectively at a preset time The timestamp when the interval occurs, and then the first alarm is determined according to the timestamp when the first alarm occurs within the preset time interval and the timestamp when the second alarm occurs within the preset time interval. Set the number of times before or after the second alarm occurs within the time interval.
  • the weight information of the candidate root cause rule can be determined by the following process.
  • the weight information of the candidate root cause rule is determined according to the degree of similarity between the frequency sequence in which the first alarm occurs and the frequency sequence in which the second alarm occurs.
  • the causal relationship between the first alarm and the second alarm is stronger; when the frequency sequence of the first alarm occurs and the second alarm The smaller the degree of similarity of the generated frequency sequence, the weaker the causal relationship between the first alarm and the second alarm.
  • the effective root cause rule is determined from the candidate root cause rule according to the timing information and the weight information of the candidate root cause rule, and specifically includes: selecting the candidate root The root cause rule in the rule is determined to be a valid root cause rule within the first preset range, and the weight coefficient value is within the second preset range.
  • the value of the timing coefficient value may be [0, 1].
  • the first alarm in the candidate root cause rule must not occur before the second alarm (the first alarm precedes the second alarm).
  • the probability of occurrence of the alarm is 0).
  • the second alarm in the candidate root cause rule must be prior to the first alarm (the probability that the first alarm occurs before the second alarm is 1).
  • the value of the weighting coefficient may be in the range of [0, 1]. When the value of the weighting coefficient is 0, the first alarm in the candidate root cause rule will not cause the second alarm to occur. The probability of occurrence is 0). When the timing coefficient value is 1, the first alarm in the candidate root cause rule must cause the second alarm to occur (the probability that the first alarm causes the second alarm to occur is 1).
  • the root cause rule in the candidate root cause rule is within a first preset range, and the root cause rule in the second preset range is determined as a valid root cause rule, including: a candidate root cause rule
  • the root cause coefficient value is greater than or equal to the first time series coefficient threshold, and the root cause rule whose weight coefficient value is greater than or equal to the first weight coefficient threshold is determined as the effective root cause rule.
  • the first timing coefficient threshold may be 0.5, and the first weight coefficient threshold may be 0.
  • step 205 the effective root cause rule is selected from the candidate root cause rules by comprehensively considering the time series information and the weight information, and in step 104, only the time series information is considered, and the effective root cause rule is selected from the candidate root cause rules.
  • step 205 a more effective root cause rule can be selected from the candidate root cause rules as the effective root cause rule based on the time series information and the weight information.
  • the root cause alarm in the associated alarm combination may be determined according to a causal relationship between different alarms in the effective root cause rule.
  • the root cause alarm in the association combination may be determined according to the causal relationship between different alarms in the effective root cause rule and the weight information of the effective root cause rule.
  • the candidate root cause rule can be more accurately determined. Filter out valid root cause rules, and then perform more accurate root cause alarm positioning based on effective root cause rules.
  • the target root cause alarm related to the associated alarm combination may be selected from the effective root cause rule, and then the associated root cause alarm is determined according to the target root cause alarm. Root cause alarm in the combination.
  • determining, according to the effective root cause rule, the root cause alarm in the associated alarm combination including: determining, from the valid root cause rule, a target root cause rule corresponding to the associated alarm combination, where the target root The alarms in the rule are all in the associated alarm combination; the root cause alarm in the associated alarm combination is determined according to the target root cause rule.
  • the associated alarm combination is ABCD
  • the effective root cause rule is ⁇ A->B, A->C, C->D, C->E, D->F ⁇ , where the root cause rule A->B Both alarm A and alarm B exist in the associated alarm combination ABCD.
  • the alarms in the root cause rules A->C, C->D also exist in the associated alarm combination ABCD. Therefore, the root cause rule A- >B, A->C and C->D are selected from the effective root cause rules to obtain the target root cause rule ⁇ A->B, A->C, C->D ⁇ .
  • the root cause rule closely related to the associated alarm combination in the effective root cause rule can be directly selected, and thus the target root cause rule can be further Targeted to locate root cause alarms in associated alarm combinations.
  • the root cause decision network may be constructed according to the target root cause rule, and then the associated alarm combination is located according to the root cause decision network. Root cause alarm.
  • a simple root cause decision network can be constructed according to the target root cause rule. As shown in FIG. 6, the decision network can easily determine that the alarm A is the root cause alarm in the associated alarm combination ABCD according to the root cause decision network shown in FIG. 6.
  • determining, according to the target root cause rule, the root cause alarm in the associated alarm combination including: determining, according to the target root cause rule and the weight information of the target root cause rule, each alarm in the associated alarm combination. Impact factor; determine the root cause alarm in the associated alarm combination based on the size of the impact factor.
  • the impact factor of each of the foregoing alarms is used to indicate the degree of influence of each alarm on other alarms in the associated alarm combination.
  • the impact factor of the alarm A is used to indicate the degree of influence of the alarm A on the alarm B, the alarm C, and the alarm C in the associated alarm ABCD. If the impact factor of the alarm A is greater than the influence factor of other alarms in the associated alarm combination ABCD, then it can be considered that among the alarm A, the alarm B, the alarm C, and the alarm D, the alarm A is associated with other alarms in the associated alarm combination ABCD. The impact is the largest, and the alarm A can be determined as the root cause alarm in the associated alarm combination ABCD.
  • the alarm with the largest impact factor can be determined as the root cause alarm in the associated alarm combination, and the alarms with the largest impact factor can be determined as the associated alarm combination. Root cause alarm.
  • determining a root cause alarm in the associated alarm combination according to the size of the impact factor including: determining K alarms in the associated alarm combination as a root cause alarm, where K is greater than or equal to 1 An integer, and the influence of the K alarms is greater than or equal to the influence factor of any one of the associated alarm combinations except for the K alarms.
  • the above-mentioned method of selecting the root cause alarm can also be understood as selecting the alarm with the largest K influence factor from the associated alarm as the root cause alarm.
  • K the alarm with the largest impact factor in the associated alarm combination is determined as the root cause alarm in the associated alarm combination; when K is greater than 1, the alarms with the largest impact factor in the associated alarm combination are determined as the associated alarm combination. Root cause alarm.
  • the effective root cause rule information may be generated, and the effective root is generated.
  • the rule information is stored for use in the root cause alarm, or the effective root cause rule information may be transmitted to the telecommunication network device, so that the telecommunication network device can perform root cause alarm positioning according to the effective root cause rule information,
  • FIG. 7 is a schematic flowchart of a method for locating a root cause alarm in a telecommunication network according to an embodiment of the present application. The method shown in Figure 7 includes:
  • the alarm association rule information may be information stored in a memory or a storage module of the server in advance.
  • the alarm association rule information may be directly obtained from the memory. .
  • the alarm association rule information is specifically used to indicate the alarm association rule. Therefore, after the alarm association rule information is obtained, the alarm association rule can be obtained.
  • step 302 The content in step 302 is substantially the same as the content of step 101 and step 202 above, and the definition, interpretation and extension of step 102 and step 202 above apply equally to step 302.
  • historical alarm data can be obtained from the memory or the storage module of the server.
  • step 304 and step 305 are respectively the same as the contents of step 103 and step 104 above, and the definition, explanation and extension of step 103 and step 104 above are equally applicable to steps 304 and 305.
  • the effective root cause when selecting a valid root cause rule from the candidate root cause rule, in addition to selecting according to the time series information, the effective root cause may be selected from the candidate root cause rule according to the time series information and the weight information of the candidate root cause rule. rule.
  • the method shown in FIG. 7 further includes: storing valid root cause rule information.
  • the valid root cause rule information may be stored in a memory or a storage module of the server.
  • the effective root cause rule information can be conveniently extracted and the root cause alarm is located.
  • the method shown in FIG. 7 further includes: extracting an associated alarm combination from the alarm flow of the telecommunication network; and determining a root cause alarm in the associated alarm combination according to the effective root cause rule indicated by the effective root cause rule information.
  • the root cause alarm location can be obtained through the pre-acquired effective root cause rule information, which can improve the efficiency of root cause alarm location.
  • FIG. 8 is a schematic flowchart of a method for locating a root cause alarm in a telecommunication network according to an embodiment of the present application.
  • the method shown in Figure 8 includes:
  • the alarm association rule information may be information stored in a memory or a storage module of the server in advance.
  • the alarm association rule information may be directly obtained from the memory. .
  • the alarm association rule information is specifically used to indicate the alarm association rule. Therefore, after the alarm association rule information is obtained, the alarm association rule can be obtained.
  • step 203 The definition, interpretation and extension of step 203 above also apply to steps 403 and 404.
  • step 205 The definition, interpretation and extension of step 205 above also apply to step 405.
  • the candidate root cause rule can be more accurately determined.
  • the effective root cause rule is filtered out, and the effective root cause rule information is generated, so that the more accurate root cause alarm positioning can be performed according to the valid root cause rule information.
  • the method shown in FIG. 8 further includes: storing valid root cause rule information.
  • the valid root cause rule information may be stored in a memory or a storage module of the server.
  • the effective root cause rule information can be conveniently extracted and the root cause alarm is located.
  • the method shown in FIG. 8 further includes: extracting an association alarm combination from an alarm flow of the telecommunication network; determining the association according to a valid root cause rule indicated by the effective root cause rule information Root cause alarm in the alarm combination.
  • the root cause alarm location can be obtained through the pre-acquired effective root cause rule information, which can improve the efficiency of root cause alarm location.
  • the whole process of the method for locating the root cause alarm in the telecommunication network in the embodiment of the present application can be roughly divided into two stages.
  • the first stage determining a set of valid alarm root cause rules;
  • the second stage determining a root cause alarm in the associated alarm combination based on the set of valid alarm root cause rules.
  • the set of valid alarm root cause rules here is equivalent to the valid root cause rule selected from the candidate root cause rules above.
  • the first stage and the second stage of the above positioning alarms are respectively described below with reference to FIGS. 9 to 14.
  • the specific step of determining the valid root cause rule includes steps 501 to 508, and the specific process in step 501 to step 508 can be performed by the server or the server cluster, and the steps 501 to 508 are respectively described in detail below. .
  • the historical alarm data may be alarm data collected from various devices in the telecommunication network for a period of time, and the historical alarm data may include a device in which the alarm occurs, a time when the alarm occurs, and a type of the alarm.
  • historical alarm data can be collected directly by the server or server cluster.
  • the historical alarm data may also be collected by a dedicated alarm collection platform.
  • the alarm data may be collected by the unified alarm collection cloud platform, and the server or server cluster obtains historical alarm data from the unified alarm collection cloud platform.
  • the foregoing alarm association rule may be generated by frequently mining historical alarm data.
  • the historical alarm data may be obtained through frequent mining, or the preset alarm association rule may be directly obtained.
  • the preset alarm association rule may be that the historical alarm data is frequently mined. Obtained and preset in the server or server cluster (specifically, the alarm association rule may be pre-stored in the server).
  • the alarms included in the alarm association rule generally have a certain relationship or causal relationship with each other. That is to say, the occurrence of one alarm in the alarm association rule may cause another alarm to occur.
  • the commonly used method is to decompose the associated root cause rules and combine the obtained alarms in pairs to obtain candidate root cause rules. It should be understood that the number of candidate root cause rules herein may be multiple, wherein each candidate root cause rule contains two alarms.
  • the association root cause ABC includes alarm A, alarm B, and alarm C.
  • the alarm association rule ABC indicates that the alarm A, the alarm B, and the alarm C have a certain relationship, and the associated root cause rule ABC can be decomposed to obtain six candidates.
  • the six candidate root cause rules are A->B, A->C, B->A, B->C, C->A, C->B.
  • the original time series of the candidate root cause rule is a time series formed by the time when the alarm in the candidate root cause rule occurs within a time interval
  • the candidate root cause rule frequency time series refers to the alarm in the candidate root cause rule.
  • all the alarms A occurring in the telecommunication network in a period of time are arranged in the order of timestamps from small to large, and an alarm A sequence is obtained, and then according to a certain period of time (for example, 5 minutes) dividing the alarm A sequence, obtaining a plurality of time windows (only five windows are schematically shown in FIG. 6), and only one alarm A occurring on the same device in the same time window is retained, thereby obtaining
  • the original time series of alarm A can obtain the original time series of alarm B in the same way.
  • the original time series of the alarm A and the original time series of the alarm B constitute the original time series of the candidate root cause rule A->B.
  • the original time series according to the candidate root cause rule alarm indicates the time stamp of each alarm in the candidate root cause rule when it occurs within a certain period of time, and therefore, the candidate described above can be obtained on the basis of the original time series.
  • the timing information of the root cause rule is the time stamp of each alarm in the candidate root cause rule when it occurs within a certain period of time, and therefore, the candidate described above can be obtained on the basis of the original time series.
  • the frequency time series of candidate root cause rules can be constructed on the basis of the original time series of candidate root cause rules.
  • the candidate root cause rule A->B is still used as an example.
  • the number of alarms that occur in each window of the original time series of alarm A and alarm B can be counted, and then the number of occurrences of alarm A and alarm B in each window is filled in the window.
  • the frequency time series of candidate root cause rules A->B is obtained.
  • window 1 of the original time series of candidate root cause rules A->B contains alarms A2, A3, and A4 (A2, A3, and A4 can be considered as alarms A occurring on different devices)
  • candidate root cause rule A- Window 1 of the original time series of >B contains alarms B1 and B2 (B1 and B2 can be considered as alarms B occurring on different devices), that is, alarm A occurs 3 times in window 1, and alarm B is in the window. 2 occurs within 1 time.
  • the number of occurrences of alarm A and alarm B in window 1 is respectively filled in the position corresponding to alarm A and alarm B in window 1.
  • a frequency time series of candidate root cause rules A->B as shown in FIG. 7 can be obtained.
  • the frequency time series of the alarm A in the candidate root cause rule A->B is 2 3 2 1
  • the frequency sequence of the alarm B in the candidate root cause rule A->B is 1 2 3 0 1 .
  • frequency time series herein has the same meaning as the frequency sequence above, and both indicate the frequency or number of times that the alarm in the candidate root cause rule occurs within a plurality of windows within a time interval.
  • timing coefficients in step 505 are a specific manifestation of the timing information described above.
  • the timing factor of the candidate root cause rule is used to reflect the probability that one of the candidate root cause rules precedes the occurrence of another alarm, and is used to verify the validity of the causal relationship represented by the candidate root cause rule.
  • the timing factor of the candidate root cause rule A->B reflects the probability that the alarm A occurs before the alarm B in time, and is used to indicate the validity of the causal relationship represented by the candidate root cause rule A->B.
  • the timing coefficient of the candidate root cause rule A->B can reflect the validity of the causal relationship represented by the candidate A->B.
  • the original time series of the candidate root cause rule can reflect the time when different alarms in the candidate root cause rule occur, and the time series coefficient of the candidate root cause rule reflects the probability that one of the candidate root cause rules precedes another alarm. According to the time when different alarms in the candidate root cause rule occur, the probability that one of the candidate root cause rules precedes another alarm can be calculated. That is to say, the timing coefficients of the candidate root cause rules can be calculated according to the original time series of the candidate root cause rules.
  • the timing coefficients of the candidate root cause rules A->B are calculated in conjunction with FIG. 10. Specifically, the timing coefficients of the candidate root cause rules A->B can be calculated according to formula (1).
  • T(A, B) represents the timing factor of the candidate root cause rule A->B, with Indicates that the original time series of alarm A and alarm B are expected in time of window i
  • S represents the number of time windows
  • function I(x) is the indication function.
  • prior_t(x,y) is a prior function, which represents the prior knowledge of the alarm x ⁇ y.
  • the value of the timing coefficients of T(A, B) can indicate that the candidate root cause rules A->B have different validity when they are in different ranges.
  • timing coefficients of T(A, B) are expressed in different ranges of values, and the present application does not limit this.
  • the root cause rule of the candidate root cause rule whose timing coefficient value is greater than a certain threshold may be selected as the effective root cause rule.
  • a root cause rule in a candidate root cause rule whose timing coefficient value is greater than or equal to 0.5 may be selected as a valid root cause rule.
  • the candidate root cause rules include A->B, A->C, B->A, B->C, C->A, and C->B.
  • the timing coefficient values of each candidate rule are divided into A-> B (0.6), A->C (0.7), B->A (0.4), B->C (0.5), C->A (0.3), and C->B (0.4).
  • the root cause rules A->B, A->C, and B->C with timing coefficient values greater than or equal to 0.5 can be selected from the candidate root cause rules as effective root cause rules.
  • the weighting coefficient of the candidate root cause rule is used to indicate the strength of the causal relationship represented by the candidate root cause rule.
  • the weighting coefficient of the candidate root cause rule A->B is used to indicate the causal relationship strength between the alarm A and the alarm B. The greater the weight coefficient of the candidate root cause rule A->B is between the alarm A and the alarm B. The higher the causal relationship.
  • the weight coefficient of the candidate root cause may be determined according to the similarity of the frequency time series of each alarm in the candidate root cause rule, and each alarm in the candidate root cause rule The higher the similarity of the frequency time series, the larger the weight coefficient of the candidate root cause rule.
  • the timing coefficients of the candidate root cause rule A->B are calculated in conjunction with FIG. 11, and specifically, the weight coefficients of the candidate root cause rule A->B can be calculated according to formula (2).
  • W(A, B) represents the weighting coefficient of the candidate root cause rule A->B
  • C Ai and C Bi respectively represent the frequency value (frequency value) of the frequency time series of the alarm A and the alarm B occurring in the window i
  • S is the number of time windows
  • prior_t(x, y) is the a priori function, which represents the prior time knowledge of the alarm x ⁇ y.
  • the value of prior_t(x, y) can be generated by human experience
  • the timing coefficients and weight coefficients of the effective root cause rule can be obtained, and the effective root cause rule in the form of a triplet can be obtained.
  • alarm A is the pre-order alarm
  • alarm B is the subsequent sequence alarm
  • the weight coefficient between alarm A and alarm B is W.
  • the effective root cause rules obtained after step 506 are A->B, A->C, and B->C, wherein the weight coefficients of A->B, A->C, and B->C are 0.8 respectively. , 0.4 and 0.6, then, the set of alarm root cause rules ⁇ (A->B,0.8), (A->C,0.4), (B->C,0.6) ⁇ can be obtained.
  • the specific determination of the effective root cause rule set includes steps 601 to 607, and steps 601 to 607 are respectively described in detail below.
  • the alarm flow can be obtained from the alarm collection cloud platform.
  • the alarm compression technology may be used to combine the alarms associated with the service alarms in the alarm flow to obtain an associated alarm combination.
  • the alarm root cause rule set in step 603 may be obtained from the above steps 501 to 507.
  • the root cause rule that the alarm exists in the associated alarm combination is selected.
  • the associated alarm combination A 1 A 2 A 3 A 4 A 5 A 6 is extracted from the alarm stream, then the following root cause rules can be selected from the root cause rule set:
  • d 1 to d 5 are the weight coefficients of these root cause rules, respectively.
  • the root cause decision network can be constructed according to the root cause rules selected above, and the root cause decision network constructed as shown in FIG. 13 is shown.
  • the impact factor here is used to indicate the impact range of the alarm, which reflects the probability (or weight) of an alarm as a root cause alarm, so as to facilitate subsequent recommendation based on the impact factor as a root cause alarm. Or judge.
  • the influence factor of each alarm can be calculated according to formula (3).
  • IF(A) is the influencing factor of alarm A
  • N out (A) is the set of all subsequent alarms in the decision-making network with A as the pre-order alarm.
  • ⁇ is the harmonic parameter, 0 ⁇ 1, can The alpha value set according to experience.
  • the influence factors of the alarms in the associated alarm combination A 1 A 2 A 3 A 4 A 5 A 6 can be obtained as the formula (4) to the formula ( 9):
  • step 605 the impact factors of each alarm can be obtained, and then each alarm in the associated alarm combination can be sorted according to the order of influence factors from large to small or from small to large.
  • K alarms with the largest impact factor can be selected as the root cause alarm from each alarm.
  • the value of K may be an integer greater than or equal to 1, and the value of K may be set according to actual needs.
  • the process of determining the root cause alarm shown in FIG. 14 mainly includes the following steps:
  • Effective root cause rule contains A 4 A 5 A 6 root of any two alarms A 1 A 2 A 3 by rule selected, A 1 A 2 A 3 A 4 A 5 A 6 obtained corresponding to the root cause of the rule details as follows:
  • d 1 to d 5 are the weight coefficients of these root cause rules, respectively.
  • the root cause rule network is constructed based on the root cause rules corresponding to the associated alarm combination A 1 A 2 A 3 A 4 A 5 A 6 , and each of the alarms is specifically generated according to the sequence of alarms in the root cause alarm when constructing the root cause decision network Set up a network and label the corresponding weights.
  • the impact factors of each alarm in the associated alarm combination A 1 A 2 A 3 A 4 A 5 A 6 are as follows:
  • a 1 is the alarm with the largest influence factor in the associated alarm combination A 1 A 2 A 3 A 4 A 5 A 6
  • a 4 and A 6 are associated alarm combinations A 1 A 2 A 3 A 4 A 5 A 6
  • the two alarms with the smallest impact factor can be selected as the root cause alarms from the associated alarm combination A 1 A 2 A 3 A 4 A 5 A 6 as needed.
  • the number of root cause alarms selected from the associated alarm combination may be determined according to requirements during the actual application process, and the number of root cause alarms may be one or multiple.
  • the method for locating the root cause alarm in the telecommunication network in the embodiment of the present application is described in detail above with reference to FIG. 1 to FIG. 14.
  • the device for locating the root cause alarm in the telecommunication network in the embodiment of the present application is described below with reference to FIG. 15 and FIG. detailed introduction.
  • the apparatus in FIG. 15 and FIG. 16 can perform various steps of the method for locating the root cause alarm in the telecommunication network in the embodiment of the present application, and the apparatus in FIG. 15 and FIG. 16 can be located in the telecommunication network in the embodiment of the present application.
  • the execution subject of the root cause alarm method For the sake of brevity, the following description will be appropriately omitted when referring to the apparatus shown in FIGS. 15 and 16.
  • FIG. 15 is a schematic block diagram of an apparatus for locating a root cause alarm in a telecommunication network according to an embodiment of the present application.
  • the apparatus 1500 shown in Figure 15 includes:
  • the obtaining module 1501 is configured to acquire an alarm association rule of the telecommunication network
  • the processing module 1502 is configured to: decompose the alarm association rule to obtain a candidate root cause rule; and determine timing information of the candidate root cause rule according to historical alarm data of the telecommunication network, where The candidate root cause rule includes a first alarm and a second alarm, and the timing information of the candidate root cause rule is used to indicate a probability that the first alarm occurs before the second alarm in time; according to the candidate root cause rule Timing information, determining a valid root cause rule from the candidate root cause rule; extracting an associated alert combination from the alert flow of the telecommunication network; determining a root cause in the associated alert combination according to the effective root cause rule Alarm.
  • the effective root cause rule can be selected from the candidate root cause rule (that is, the candidate root can be selected according to the time series information) Because the effective root cause rule is selected in the rule, a more accurate root cause alarm location can be performed according to the effective root cause rule.
  • the device 1500 may specifically be a device or a module in the server or server in the telecommunication network for performing root cause alarm location.
  • the acquisition module 1501 and the processing module 1502 in the device 1500 may specifically be a unit or module having a computing function in the server, for example, a central processing unit.
  • FIG. 16 is a schematic block diagram of an apparatus for locating a root cause alarm in a telecommunication network according to an embodiment of the present application.
  • the apparatus 1600 shown in Figure 16 includes:
  • the obtaining module 1601 is configured to acquire an alarm association rule of the telecommunication network
  • the processing module 1602 is configured to: decompose the alarm association rule to obtain a candidate root cause rule; and determine timing information of the candidate root cause rule according to historical alarm data of the telecommunication network, where
  • the candidate root cause rule includes a first alarm and a second alarm, and the timing information of the candidate root cause is used to indicate a probability that the first alarm occurs before the second alarm in time; according to the history
  • the alarm data determines weight information of the candidate root cause rule, and the weight information of the candidate root cause rule is used to indicate a causal relationship strength between the first alarm and the second alarm; according to the candidate root cause rule
  • the timing information and the weight information determine a valid root cause rule from the candidate root cause rule; extract an associated alarm combination from the alarm flow of the telecommunication network; and determine the associated alarm combination according to the effective root cause rule Root cause alarm.
  • the candidate root cause rule can be more accurately determined. Filter out valid root cause rules, and then perform more accurate root cause alarm positioning based on effective root cause rules.
  • the device 1600 may specifically be a device or a module for performing root cause alarm location in a server or a server in a telecommunication network.
  • the acquisition module 1601 and the processing module 1602 in the device 1600 may specifically be a unit or module having a computing function in the server, for example, a central processing unit.
  • FIG. 17 is a schematic block diagram of an apparatus for locating a root cause alarm in a telecommunication network according to an embodiment of the present application.
  • the apparatus 1700 shown in Figure 17 includes:
  • a memory 1701 configured to store a program
  • the processor 1702 is configured to execute a program stored in the memory 1701.
  • the processor 1702 is specifically configured to perform a method for locating a root cause alarm in the telecommunication network in the embodiment of the present application.
  • the processor 1702 may be specifically configured to perform the steps performed by the processing module 1501 or the processing module 1601.
  • memory 1701 may store alarm association rules for the telecommunications network (specifically may be stored in the form of alarm association rule information) and historical alarm data.
  • the processor 1702 can retrieve the alarm association rules of the telecommunication network and the historical alarm data of the telecommunication network from the memory 1701.
  • the processor 1702 in the device 1700 corresponds to the acquisition module 1501 and the processing module 1502 in the device 1500 (the processor 1702 can implement the functions of the acquisition module 1501 and the processing module 1502), and the processor 702 can also correspond to the acquisition module in the device 1600. 1601 and processing module 1602 (processor 1702 can implement the functions of acquisition module 1601 and processing module 1602).
  • the device 1700 may specifically be a device or a module in the server or server in the telecommunication network for performing root cause alarm location.
  • the memory 1701 in the device 1700 may specifically be a storage unit or a storage module in the server, and the processor 1702 may specifically be a unit or module having a computing function in the server, for example, a central processing unit.
  • FIG. 18 is a schematic block diagram of a root cause alarm locating device according to an embodiment of the present application.
  • the root cause alarm locating device 1800 shown in FIG. 18 specifically includes: an alarm association rule mining module 1801, an associated alarm extraction module 1802, an alarm root cause rule mining module 1803, and a root cause alarm locating module 1804.
  • the root cause alarm locating device 1800 can perform the method for locating the root cause alarm in the telecommunication network in the embodiment of the present application.
  • the alarm association rule mining module 1801 can execute step 101 in the method shown in FIG. 1
  • the associated alarm extraction module 1802 can execute step 105 in the method shown in FIG. 1
  • the alarm root rule mining module 1803 can execute FIG. 1 .
  • the root cause alarm location module 1804 is capable of performing step 106 of the method illustrated in FIG.
  • the alarm association rule mining module 1801 can execute step 201 in the method shown in FIG. 2, and the associated alarm extraction module 1802 can execute step 205 in the method shown in FIG. 2, and the alarm root rule mining module 1803 can execute the map.
  • the root cause alarm location module 1804 is capable of performing step 206 of the method illustrated in Figure 2.
  • the alarm association rule mining module 1801 in the root cause alarm locating device 1800 may correspond to the acquisition module 1501 in the device 1500 and the acquisition module 1601 in the device 1600, for acquiring the alarm association rule of the telecommunication network, and the associated alarm extraction module 1802.
  • the alarm root cause rule mining module 1803 and the root cause alarm location module 1804 correspond to the processing module 1502 in the device 1500 and the processing module 1602 in the device 1600 for determining a root cause alarm in the associated alarm combination.
  • All modules in the root cause alarm locating device 1800 correspond to the processor 1702 in the device 1700 for completing the entire process from acquiring the alarm association rule of the telecommunication network to determining the root cause alarm in the associated alarm combination.
  • FIG. 19 is a schematic diagram of root cause alarm positioning by a root cause alarm locating device according to an embodiment of the present application.
  • the root cause alarm positioning process shown in Figure 19 mainly includes the following steps:
  • Step 1 The alarm association rule mining module 1801 performs mining processing on the historical alarm data set to obtain an alarm association rule.
  • Step 2 The associated alarm extraction module 1802 processes the real-time alarm stream according to the alarm association rule acquired by the alarm association rule module 1801, and extracts the associated alarm combination from the real-time alarm stream.
  • Step 3 The alarm root cause rule mining module 1803 performs screening processing on the alarm association rule acquired by the alarm association rule module 1801 according to the historical alarm data set, and obtains an effective root cause rule;
  • Step 4 The root cause alarm locating module 1804 performs root cause alarm positioning on the associated alarm combination according to the effective root cause rule extracted by the alarm root cause rule mining module 1803, and determines the root cause alarm.
  • FIG. 20 is a schematic diagram of an application scenario of an embodiment of the present application.
  • the method for locating the root cause alarm in the telecommunication network in the embodiment of the present application may be specifically applied to the application scenario shown in FIG.
  • the root cause alarm of the telecommunication network device in the telecommunication network can be located by using the method for locating the root cause alarm in the embodiment of the present application.
  • the device in the telecommunication network may specifically include an ATN domain device, a MW domain device, a RAN domain device, and other domains. device.
  • the unified alarm collection cloud platform can be used to collect the alarms generated in the telecommunication network, and the alarms can be organized into alarm flows according to the alarm reporting time and domain information, and then the alarm flows are reported to the unified alarm monitoring. cloud platform.
  • the unified alarm monitoring cloud platform After receiving the alarm flow, the unified alarm monitoring cloud platform firstly creates a problem list by matching the corresponding alarm combination in the alarm flow through the alarm compression rule of the single-domain single-network element, and then locates the root cause in the telecommunication network in the embodiment of the present application.
  • the alarm method is to locate the root cause alarm for the associated alarm combination in the problem list.
  • the problem list with the root cause alarm information is sent to the operation and maintenance engineer. The engineer checks the corresponding telecommunication device based on the information in the problem list.
  • the root cause alarm information is included. Therefore, as long as the root cause alarm is processed, other related alarms are naturally eliminated, which greatly improves the alarm and fault handling efficiency.
  • the method of the embodiment of the present application may occur in the process of root cause alarm diagnosis of the unified alarm monitoring cloud platform, or the method of locating the root cause alarm in the telecommunication network may occur in the alarm compression, creation problem list and root of the unified alarm monitoring cloud platform.
  • the process of diagnosis due to alarms may occur in the process of root cause alarm diagnosis of the unified alarm monitoring cloud platform, or the method of locating the root cause alarm in the telecommunication network may occur in the alarm compression, creation problem list and root of the unified alarm monitoring cloud platform.
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product.
  • the technical solution of the present application which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including
  • the instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present application.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program code. .

Abstract

本申请提供了定位根因告警的方法、装置和计算机可读存储介质。该方法包括：获取电信网络的告警关联规则；对所述告警关联规则进行分解，得到候选根因规则；根据所述电信网络的历史告警数据确定所述候选根因规则的时序信息，其中，所述候选根因规则包含第一告警和第二告警，所述候选根因规则的时序信息用于指示所述第一告警在时间上先于第二告警发生的概率；根据所述候选根因规则的时序信息，从所述候选根因规则中确定出有效根因规则；从所述电信网络的告警流中提取关联告警组合；根据所述有效根因规则确定所述关联告警组合中的根因告警。本申请能够提高根因告警定位的准确性。

Description

定位根因告警的方法、装置和计算机可读存储介质
本申请要求于2018年03月29日提交中国专利局、申请号为201810268926.7、申请名称为“定位根因告警的方法、装置和计算机可读存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及电信网络故障告警领域，并且更具体地，涉及一种定位根因告警的方法、装置和计算机可读存储介质。
背景技术
随着电信网络规模的不断扩大，电信网络产生的告警种类和数目也在不断增加，为了保证电信网络的正常运行，需要及时从电信网络产生的多种告警中定位出根因告警，以便将这些根因告警尽快消除。
传统方案是由技术专家根据自身经验对电信网络的告警数据进行分析，总结出不同告警之间的因果关系和优先级，并根据不同告警之间的因果关系和优先级构建根因决策网络，最后再根据根因决策网络来定位告警流中的根因告警。
当告警类型较多时，传统方案通过依靠人的经验或者知识无法准确地构建根因决策网络，因此，传统方案无法较为准确地进行根因告警定位。
发明内容
本申请提供一种定位根因告警的方法、装置和计算机可读存储介质，以提高根因告警定位的准确性。
第一方面，提供了一种电信网络中定位根因告警的方法，该方法包括：获取电信网络的告警关联规则；对告警关联规则进行分解，得到候选根因规则；根据电信网络的历史告警数据确定候选根因规则的时序信息；根据候选根因规则的时序信息，从候选根因规则中确定出有效根因规则；从电信网络的告警流中提取关联告警组合；根据有效根因规则确定关联告警组合中的根因告警。
其中，上述候选根因规则包含第一告警和第二告警，该候选根因规则的时序信息用于指示第一告警在时间上先于第二告警发生的概率。
上述历史告警数据包含的可以是电信网络中很多电信设备的告警数据，该历史告警数据可以包含告警的种类，告警发生的时间，告警发生的设备等等。
可选地，对告警关联规则进行分解，得到候选根因规则，包括：对告警关联规则进行分解，得到多个告警；对多个告警进行两两组合，得到候选根因规则。
通过对告警根因规则中的多个告警进行两两组合，能够得到由两个告警组成的候选根因规则，便于对告警关联规则中的任意两个告警之间的因果关系进行分析。
应理解，上述候选根因规则的数量可以是多个，每个候选根因规则均包含两个告警，具体地，每个候选根因规则均包含第一告警和第二告警，并且第一告警可以是位于候选根因规则前面的告警(也可以称为先序告警或者前序告警)，第二告警可以是位于候选根因规则后面的告警(也可以称为后序告警)。
本申请中，根据候选根因规则中的一种告警在时间上先于另一种告警发生的概率，能够从候选根因规则中筛选出有效根因规则(也就是根据时序信息能够从候选根因规则中选择出有效根因规则)，进而可以根据有效根因规则进行更准确的根因告警定位。
可选地，上述获取电信网络的告警关联规则，包括：根据电信网络的历史告警数据确定电信网络的告警关联规则。
具体地，可以通过对电信网络的历史告警数据进行频繁项挖掘来确定或者生成电信网络的告警关联规则。
应理解，频繁项挖掘是数据挖掘领域最基本的一种方法，用来发现大量数据中经常在一起组合出现的数据项或模式，是挖掘数据间关联关系的一种最常用的方法。
上述有效根因规则可以是时序信息满足预设要求的根因规则。
在一种可能的实现方式中，上述时序信息为时序系数值，时序系数值的大小用于指示候选根因规则中的第一告警在时间上先于第二告警发生的概率。
可选地，上述时序系数值越大，候选根因规则中第一告警在时间上先于第二告警发生的概率越大。
在一种可能的实现方式中，当上述时序信息为时序系数值时，上述根据候选根因规则的时序信息，从候选根因规则中确定出有效根因规则，包括：将候选根因规则中时序系数值在预设范围内的根因规则确定为有效根因规则。
通过时序系数值的大小能够从候选根因规则中筛选出来有效性满足要求的根因规则(也就是有效根因规则)，便于后续根据这些有效性较高的根因规则进行根因告警的定位。
可选地，上述将候选根因规则中时序系数值在预设范围内的根因规则确定为有效根因规则，包括：将候选根因规则中时序系数值大于或者等于第一时序系数阈值的根因规则确定为有效根因规则。
可选地，上述时序系数值的取值范围为[0，1]，当时序系数值为0时表示候选根因规则中的第一告警一定不会先于第二告警发生，当时序系数值为1时表示候选根因规则中的第一告警一定会先于第二告警发生。
上述第一时序系数阈值的取值可以为0.5，也就是说，当候选根因规则的时序系数值大于或者等于0.5时，该候选根因规则为有效根因规则。
在一种可能的实现方式中，根据电信网络的历史告警数据确定候选根因规则的时序信息，包括：根据历史告警数据确定第一告警在预设时间间隔内先于或者后于第二告警发生的次数；根据第一告警在预设时间间隔内先于或者后于第二告警发生的次数，确定候选根因规则的时序信息。
通过分析历史告警数据可以得知第一告警和第二告警在过去的某段时间间隔内发生的次数，以及发生的先后顺序，能够确定出第一告警在时间上先于或者第二告警发生的概率，进而可以确定时序信息。
可选地，上述根据历史告警数据确定第一告警在预设时间间隔内先于或者后于第二告 警发生的次数，包括：根据历史告警数据确定第一告警和第二告警分别在预设时间间隔内发生时的时间戳；根据第一告警和第二告警分别在预设时间间隔内发生时的时间戳，确定第一告警在预设时间间隔内先于或者后于第二告警发生的次数。
在一种可能的实现方式中，根据有效根因规则确定关联告警组合中的根因告，包括：从有效根因规则中确定出与关联告警组合对应的目标根因规则，其中，目标根因规则中的告警均存在于关联告警组合中；根据目标根因规则确定关联告警组合中的根因告警。
应理解，在从有效根因规则中确定出与关联告警组合对应的目标根因规则时，具体是将有效根因规则中包含关联告警组合中任意两个告警的根因规则选择出来，得到关联告警组合对应的目标根因规则。
通过从有效根因规则中选择出与关联告警组合相对应的目标根因规则，能够直接将有效根因规则中与关联告警组合密切相关的根因规则选择出来，进而可以根据目标根因规则更有针对性的来定位关联告警组合中的根因告警。
在一种可能的实现方式中，根据目标根因规则确定关联告警组合中的根因告警，包括：基于目标根因规则构建根因决策网络；根据根因决策网络确定关联告警组合中的根因告警。
上述根因决策网络是由目标根因规则中的各个告警组成的告警决策网络。
通过构建根因决策网络，能够更方便更直接地确定出关联告警组合中的根因告警。
在一种可能的实现方式中，根据目标根因规则确定关联告警组合中的根因告警，包括：根据历史告警数据确定目标根因规则的权重信息，该目标根因规则的权重信息用于指示目标根因规则中的告警之间的因果关系强度；根据目标根因规则以及目标根因规则的权重信息，确定关联告警组合中每个告警的影响因子；根据影响因子的大小确定关联告警组合中的根因告警。
其中，每个告警的影响因子用于指示该每个告警对关联告警组合中的其它告警的影响程度。
根据目标根因规则的权重系数能够确定关联告警组合中的每个告警对其它告警的影响程度，进而可以根据每个告警对其它告警的影响长度较为准确地确定出关联告警组合中的根因告警。
可选地，根据历史告警数据确定目标根因规则的权重信息，包括：在得到目标根因规则之后，直接根据历史告警数据来确定目标根因规则的权重信息。
可选地，根据历史告警数据确定目标根因规则的权重信息，包括：在得到目标根因规则之前，根据历史告警数据来确定候选根因规则或者有效根因规则的权重信息；从候选根因规则或者有效根因规则中的权重信息中获取目标根因规则的权重信息。
在一种可能的实现方式中，根据影响因子的大小确定关联告警组合中的根因告警，包括：将关联告警组合中的K个告警确定为根因告警，其中，K为大于等于1的整数，该K个告警的影响子大于或者等于关联告警组合中除K个告警之外的其它任意一个告警的影响因子。
在一种可能的实现方式中，根据历史告警数据确定目标根因规则的权重信息，包括：根据历史告警数据确定目标根因规则的权重信息第三告警和第四告警分别在预设时间间隔内的多个时间窗口内发生的频率；根据第三告警分别在预设时间间隔内的多个时间窗口 内发生的频率，生成第三告警发生的频率序列；根据第四告警分别在预设时间间隔内的多个时间窗口内发生的频率，生成第四告警的发生的频率序列；根据第三告警发生的频率序列与第四告警发生的频率序列的相似程度，确定目标根因规则的权重信息。
第二方面，提供了一种电信网络中定位根因告警的方法。该方法包括：获取电信网络的告警关联规则；对告警关联规则进行分解，得到候选根因规则；根据电信网络的历史告警数据确定候选根因规则的时序信息；根据历史告警数据确定候选根因规则的权重信息，候选根因规则的权重信息用于指示第一告警与第二告警之间的因果关系强度；根据候选根因规则的时序信息和权重信息从候选根因规则中确定出有效根因规则；从电信网络的告警流中提取关联告警组合；根据有效根因规则确定关联告警组合中的根因告警。
其中，上述候选根因规则包括第一告警和第二告警，该候选根因规则的时序信息用于指示第一告警在时间上先于第二告警发生的概率。该候选根因规则的数量可以是多个，也就是说对候选根因规则进行分解后，可以得到多个候选根因规则。
应理解，每个候选根因规则均包含两个告警，具体而言，每个候选根因规则均包含第一告警和第二告警，并且第一告警可以是位于候选根因规则前面的告警(也可以称为先序告警或者前序告警)，第二告警可以是位于候选根因规则后面的告警(也可以称为后序告警)。
可选地，上述对告警关联规则进行分解，得到候选根因规则，具体包括：对告警关联规则进行分解，得到多个告警；对多个告警进行两两组合，得到候选根因规则。
通过对告警根因规则中的多个告警进行两两组合，能够得到由两个告警组成的候选根因规则，便于对告警关联规则中的任意两个告警之间的因果关系进行分析。
本申请中，根据候选根因规则中的一种告警在时间上先于另一种告警发生的概率以及候选根因规则中告警之间的因果关系强度，能够从候选根因规则中较为准确地筛选出有效根因规则，进而可以根据有效根因规则进行更准确的根因告警定位。
在一种可能的实现方式中，上述获取电信网络的告警关联规则，包括：根据电信网络的历史告警数据确定电信网络的告警关联规则。
具体地，可以通过对电信网络的历史告警数据进行频繁项挖掘来确定或者生成电信网络的告警关联规则。
可选地，上述有效根因规则为时序信息和权重信息均满足预设要求的根因规则。
在一种可能的实现方式中，时序信息为时序系数值，权重信息为权重系数值，根据候选根因规则的时序信息和权重信息从候选根因规则中确定出有效根因规则，包括：将候选根因规则中时序系数值在第一预设范围内，且权重系数值在第二预设范围内的根因规则确定为有效根因规则。
可选地，上述时序系数值的取值范围为[0，1]，当时序系数值为0时表示候选根因规则中的第一告警一定不会先于第二告警发生，当时序系数值为1时表示候选根因规则中的第二告警一定先于第一告警发生。
可选地，上述权重系数值的取值范围为[0，1]，当权重系数值为0时表示候选根因规则中的第一告警一定不会导致第二告警的发生，当时序系数值为1时表示候选根因规则中的第一告警一定会导致第二告警的发生。
在一种可能的实现方式中，将候选根因规则中时序系数值在第一预设范围内，且权重 系数值在第二预设范围内的根因规则确定为有效根因规则，包括：将候选根因规则中时序系数值大于或者等于第一时序系数阈值，且权重系数值大于或者等于第一权重系数阈值的根因规则确定为有效根因规则。
可选地，上述第一时序系数阈值为0.5，上述第一权重系数阈值为0。
在一种可能的实现方式中，根据电信网络的历史告警数据确定候选根因规则的时序信息，包括：根据历史告警数据确定第一告警在预设时间间隔内先于或者后于第二告警发生的次数；根据第一告警在预设时间间隔内先于或者后于第二告警发生的次数，确定候选根因规则的时序信息。
通过分析历史告警数据可以得知第一告警和第二告警在过去的某段时间间隔内发生的次数，以及发生的先后顺序，能够确定出第一告警在时间上先于或者第二告警发生的概率，进而可以确定时序信息。
可选地，上述根据历史告警数据确定第一告警在预设时间间隔内先于或者后于第二告警发生的次数，包括：根据历史告警数据确定第一告警和第二告警分别在预设时间间隔内发生时的时间戳；根据第一告警和第二告警分别在预设时间间隔内发生时的时间戳，确定第一告警在预设时间间隔内先于或者后于第二告警发生的次数。
在一种可能的实现方式中，根据历史告警数据确定初始根因规则的权重信息，包括：根据历史告警数据确定第一告警和第二告警分别在预设时间间隔内的多个时间窗口内发生的频率；根据第一告警分别在预设时间间隔内的多个时间窗口内发生的频率，生成第一告警发生的频率序列；根据第二告警分别在预设时间间隔内的多个时间窗口内发生的频率，生成第二告警发生的频率序列；根据第一告警发生的频率序列与第二告警发生的频率序列的相似程度，确定初始根因规则的权重信息。
在一种可能的实现方式中，根据有效根因规则确定关联告警组合中的根因告警，包括：从有效根因规则中确定出与关联告警组合相对应的目标根因规则，其中，目标根因规则中的告警均存在于关联告警组合中；根据目标根因规则确定关联告警组合中的根因告警。
应理解，在从有效根因规则中确定出与关联告警组合对应的目标根因规则时，具体是将有效根因规则中包含关联告警组合中任意两个告警的根因规则选择出来，得到关联告警组合对应的目标根因规则。
通过从有效根因规则中选择出与关联告警组合相对应的目标根因规则，能够直接将有效根因规则中与关联告警组合密切相关的根因规则选择出来，进而可以根据目标根因规则更有针对性的来定位关联告警组合中的根因告警。
在一种可能的实现方式中，根据目标根因规则确定关联告警组合中的根因告警，包括：根据目标根因规则以及目标根因规则的权重信息，确定关联告警组合中每个告警的影响因子，其中，每个告警的影响因子用于指示每个告警对关联告警组合中的其它告警的影响程度；根据影响因子的大小确定关联告警组合中的根因告警。
根据目标根因规则的权重系数能够确定关联告警组合中的每个告警对其它告警的影响程度，进而可以根据每个告警对其它告警的影响长度较为准确地确定出关联告警组合中的根因告警。
在一种可能的实现方式中，根据影响因子的大小确定关联告警组合中的根因告警，包括：将关联告警组合中的K个告警确定为根因告警，其中，K为大于等于1的整数，该K 个告警的影响子大于或者等于关联告警组合中除K个告警之外的其它任意一个告警的影响因子。
第三方面，提供了一种电信网络中定位根因告警的方法。该方法包括：获取告警关联规则信息；对告警关联规则进行分解，生成候选根因规则；获取历史告警数据；根据历史告警数据确定候选根因规则的时序信息；根据时序信息从候选根因规则中选择有效根因规则，得到与所述有效根因规则对应的有效根因规则信息。
上述告警关联规则信息用于指示告警关联规则，根据该告警关联规则信息可以获取告警关联规则。
本申请中，根据候选根因规则中的一种告警在时间上先于另一种告警发生的概率，能够从候选根因规则中筛选出有效根因规则(也就是根据时序信息能够从候选根因规则中选择出有效根因规则)，并生成有效根因规则信息，便于后续可以根据该有效根因规则信息来进行更准确的根因告警定位。
在一种可能的实现方式中，上述方法还包括：存储有效根因规则信息。
通过存储有效根因规则信息，能够在后续方便地提取该有效根因规则信息并进行根因告警的定位。
在一种可能的实现方式中，上述方法还包括：从所述电信网络的告警流中提取关联告警组合；根据所述有效根因规则信息指示的有效根因规则确定所述关联告警组合中的根因告警。
通过预先获取的有效根因规则信息能够进行根因告警定位，可以提高根因告警定位的效率。
第四方面，提供了一种电信网络中定位根因告警的方法。该方法包括：获取告警关联规则信息；对告警关联规则进行分解，生成候选根因规则；根据历史告警数据确定候选根因规则的时序信息；根据历史告警数据确定候选根因规则的权重信息；根据时序信息和权重信息从候选根因规则中选择有效根因规则，得到与所述有效根因规则对应的有效根因规则信息。
本申请中，根据候选根因规则中的一种告警在时间上先于另一种告警发生的概率以及候选根因规则中告警之间的因果关系强度，能够从候选根因规则中较为准确地筛选出有效根因规则，并生成有效根因规则信息，便于后续可以根据该有效根因规则信息来进行更准确的根因告警定位。
在一种可能的实现方式中，上述方法还包括：存储有效根因规则信息。
通过存储有效根因规则信息，能够在后续方便地提取该有效根因规则信息并进行根因告警的定位。
在一种可能的实现方式中，上述方法还包括：从所述电信网络的告警流中提取关联告警组合；根据所述有效根因规则信息指示的有效根因规则确定所述关联告警组合中的根因告警。
通过预先获取的有效根因规则信息能够进行根因告警定位，可以提高根因告警定位的效率。
第五方面，提供一种定位根因告警的装置，该定位根因告警的装置包括用于执行上述第一方面、第二方面、第三方面或者第四方面所述的方法的模块。
第六方面，提供一种定位根因告警的装置，该定位根因告警的装置包括存储器和处理器，其中，存储器用于存储程序，处理器用于执行上述存储器存储的程序，当上述程序被执行时，处理器用于执行上述第一方面、第二方面、第三方面或者第四方面所述的方法。
可选地，上述存储器包括非易失性存储介质，该非易失性存储介质用于存储程序。
可选地，上述处理器为中央处理器，该中央处理器与上述非易失性存储介质相连，用于执行非易失性存储介质存储的程序。
第七方面，提供一种计算机可读介质，该计算机可读介质存储用于设备执行的程序代码，上述程序代码包括用于执行上述第一方面、第二方面、第三方面或者第四方面所述的方法。
第八方面，提供一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行上述第一方面、第二方面、第三方面或者第四方面所述的方法。
第九方面，提供一种服务器，包括上述第五方面或者第六方面中的定位根因告警的装置。
附图说明
图1是本申请实施例的电信网络中定位根因告警的方法的示意性流程图；
图2是告警A和告警B在部分时间窗口发生情况的示意图；
图3是根因决策网络的示意图；
图4是告警A和告警B在部分时间窗口发生次数的示意图；
图5是本申请实施例的电信网络中定位根因告警的方法的示意性流程图；
图6是根因决策网络的示意图；
图7是本申请实施例的电信网络中定位根因告警的方法的示意性流程图；
图8是本申请实施例的电信网络中定位根因告警的方法的示意性流程图；
图9是本申请实施例的电信网络中定位根因告警的方法的示意性流程图；
图10是告警A和告警B在部分时间窗口发生情况的示意图；
图11是告警A和告警B在部分时间窗口发生次数的示意图；
图12是本申请实施例的电信网络中定位根因告警的方法的示意性流程图；
图13是根因决策网络的示意图；
图14是确定关联告警组合A 1A 2A 3A 4A 5A 6中的根因告警的示意性流程图；
图15是本申请实施例的电信网络中定位根因告警的装置的示意性框图；
图16是本申请实施例的电信网络中定位根因告警的装置的示意性框图；
图17是本申请实施例的电信网络中定位根因告警的装置的示意性框图；
图18是本申请实施例的根因告警定位装置的示意性框图；
图19是本申请实施例的根因告警定位装置进行根因告警定位的示意图；
图20是本申请实施例的应用场景的示意图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本申请实施例的电信网络中定位根因告警的方法可以应用于电信网络中，用于对电信 网络设备进行根因告警定位。本申请实施例的电信网络中定位根因告警的方法可以由电信网络中的服务器或者服务器集群执行，电信网络中的服务器可以是指安装了主流操作系统(例如，windows、unix等)的通用计算机系统。
上述电信网络可以是构成多个用户相互通信的通信体系，是人类实现远距离通信的重要基础设施，电信网络利用电缆、无线、光纤或者其它电磁系统来传送、发射和接收标识、文字、图像、声音或其它信号。
电信网络通常可以被划分为多个域，例如，只考虑传输网和无线网的话，可以将电信网络从上到下可按层次划分为传输接入网(access transport network，ATN)域、微波(microwave，MW)域和无线(radio access network，RAN)域，其中，ATN域也可以称为数通域。因此，按域进行划分的话，电信网络设备包括ATN域设备、MW域设备、RAN域设备以及其他域设备。
图1是本申请实施例的电信网络中定位根因告警的方法的示意性流程图。图1所示的方法包括步骤101至步骤106，其中，步骤104和步骤105的发生在时间上没有严格的先后顺序，步骤105既可以发生在步骤104之前，也可以发生在步骤104之后，或者，步骤104和步骤105可以同时发生，下面分别对步骤101至步骤106进行详细的介绍。
101、获取电信网络的告警关联规则。
上述告警关联规则既可以预设设置好的，也可以是实时获取的。当图1所示的方法由服务器执行时，上述告警关联规则可以是预先设置在服务器中(例如，预先将该告警关联规则保存在存储器中)，当需要获取该告警关联规则时，可以直接从服务器中调取该告警关联规则。
此外，还可以根据电信网络的历史告警数据来获取电信网络的告警关联规则。具体地，可以先获取电信网络的历史告警数据，然后对该历史告警数据进行频繁项挖掘来生成电信网络的告警关联规则。
102、对告警关联规则进行分解，得到候选根因规则。
具体地，可以对告警关联规则进行分解，得到多个告警，然后再对多个告警进行两两组合，进而得到候选根因规则。
通过对告警根因规则中的多个告警进行两两组合，能够得到由两个告警组成的候选根因规则，便于对告警关联规则中的任意两个告警之间的因果关系进行分析。
例如，对告警关联规则ABC进行分解，得到告警A、告警B和告警C，对这些告警进行两两组合可以得到候选根因规则{A->B，A->C，B->A，B->C，C->A，C->B}。
由上述示例可知，候选根因规则的数量可以是多个，每个候选根因规则均包含两个告警。
103、根据电信网络的历史告警数据确定候选根因规则的时序信息。
其中，上述候选根因规则包含第一告警和第二告警，候选根因规则的时序信息用于指示第一告警在时间上先于第二告警发生的概率。
以上述示例中的候选根因规则A->B为例，在候选根因规则A->B中，A为第一告警，B为第二告警，或者，A为第二告警，B为第一告警，候选根因规则A->B的时序信息用于指示告警A在时间上先于告警B发生的概率。
另外，上述历史告警数据可以是一段时间内从电信网络中的各个设备收集来的告警数 据，该历史告警数据可以包括告警发生的设备、告警发生的时间以及告警的种类等等。
可选地，根据电信网络的历史告警数据确定候选根因规则的时序信息，包括：根据历史告警数据确定第一告警在预设时间间隔内先于或者后于第二告警发生的次数；根据第一告警在预设时间间隔内先于或者后于第二告警发生的次数，确定候选根因规则的时序信息。
通过分析历史告警数据可以得知第一告警和第二告警在过去的某段时间间隔内发生的次数，以及发生的先后顺序，能够确定出第一告警在时间上先于或者第二告警发生的概率，进而可以确定时序信息。
具体地而言，在根据历史告警数据确定第一告警在预设时间间隔内先于或者后于第二告警发生的次数时，可以先根据历史告警数据确定第一告警和第二告警分别在预设时间间隔内发生时的时间戳，然后再根据第一告警在预设时间间隔内发生时的时间戳与第二告警在预设时间间隔内发生时的时间戳的先后顺序可以确定第一告警在预设时间间隔内先于或者后于第二告警发生的次数。
在确定第一告警在预设时间间隔内先于或者后于第二告警发生的次数时，可以将该预设时间间隔划分成多个时间窗口，然后确定每个时间窗口内告警A先于告警B发生的次数，最后再得到在预设时间间隔内第一告警先于或者后于第二告警发生的次数。
上述预设时间间隔可以是一个相对较长的时间，而每个时间窗口可以是一个很短的时间，例如，上述时间间隔可以是3个月，上述时间窗口可以是对上述预设时间间隔按照5分钟的时间周期进行划分得到的。
例如，需要确定候选根因规则A->B的时序信息，那么，可以先将预设时间间隔划分为多个时间窗口，然后再根据历史告警数据确定告警A和告警B分别在每个时间窗口内发生的时间戳，得到告警A和告警B在各个时间窗口的发生的情况，最后再综合告警A和告警B在各个时间窗口内发生的情况就可以得到告警A在预设时间间隔内先于告警B发生的次数，进而得到候选根因规则A->B的时序信息。
图2示出了告警A和告警B在部分时间窗口(窗口0至窗口2)发生的情况，具体地，在窗口0至窗口2中，告警A和告警B发生的情况如下：
在窗口0内，告警A发生了2次，告警B发生了1次；
在窗口1内，告警A发生了3次，告警B发生了2次；
在窗口2内，告警A发生了2次，告警B发生了3次。
其中，在窗口0内，A0至A6分别记录了告警A在不同时间窗口内发生时的时间戳，B0至B5分别记录了告警B在不同时间窗口内发生时的时间戳。
通过分别分析告警A和告警B发生在窗口0发生时的时间戳，能够得到告警A在时间窗口0内先于告警B发生的次数，通过类似的方式可以得到告警A在其它时间窗口内先于告警B发生的次数，将告警A在各个时间窗口内先于告警B发生的次数求和就得到了告警A在预设时间间隔内先于告警B发生的次数。最终再根据告警A在预设时间间隔内先于告警B发生的次数就可以得到候选根因规则A->B的时序信息。
104、根据候选根因规则的时序信息，从候选根因规则中确定出有效根因规则。
上述有效根因规则可以是时序信息满足预设要求的根因规则。因此，可以从候选根因规则中选择出时序信息满足预设要求的根因规则作为有效根因规则。
上述时序信息具体可以用时序系数值表示，时序系数值的大小可以表示候选根因规则的有效性。例如，当候选根因规则的时序系数值越大时，候选根因规则的第一告警在时间上先于第二告警发生的概率越大，该候选根因规则的有效性越高；当候选根因规则的时序系数值越小时，候选根因规则的第一告警在时间上先于第二告警发生的概率越小，该候选根因规则的有效性越低。
可选地，上述时序系数值的取值范围为[0，1]，当时序系数值为0时表示候选根因规则中的第一告警一定不会先于第二告警发生(第一告警先于第二告警发生的概率为0)，当时序系数值为1时表示候选根因规则中的第一告警一定会先于第二告警发生(第一告警先于第二告警发生的概率为1)。
当时序信息具体为时序系数值时，可以根据时序系数值从候选根因规则中筛选出有效根因规则。
可选地，作为一个实施例，从候选根因规则中确定出有效根因规则，包括：将候选根因规则中时序系数值在预设范围内的根因规则确定为有效根因规则。
通过时序系数值与预设范围的大小关系，能够从候选根因规则中筛选出来有效性满足要求的根因规则(也就是有效根因规则)，便于后续根据这些有效性较高的根因规则进行根因告警的定位。
具体地，可以将候选根因规则中时序系数值大于或者等于第一时序系数阈值的根因规则确定为有效根因规则。
上述第一时序系数阈值的取值可以为0.5，因此，当某个候选根因规则的时序系数值大于或者等于0.5时，就会将该候选根因规则选择出来作为有效根因规则。
105、从电信网络的告警流中提取关联告警组合。
上述关联告警组合中的告警之间存在一定的关联关系。通常情况下，可以通过告警压缩技术将告警流中存在一定关联关系的多个告警提取出来，得到关联告警组合。
进一步地，由于在电信网络实际的业务场景中，客户一般会重点关注某些与业务强相关的告警，因此，可以采用告警压缩技术将告警流中与业务告警相关联的告警组合在一起，得到关联告警组合。
106、根据有效根因规则确定关联告警组合中的根因告警。
具体地，可以根据有效根因规则中的不同告警之间的因果关系来确定关联告警组合中的根因告警。
例如，关联告警组合为ABC，有效根因规则为{A->B，A->C，B->D，C->E，D->F}，那么，根据有效根因规则可知，告警A的发生会导致告警B和告警C的发生，因此，可以确定告警A为关联告警组合ABC中的根因告警。
本申请中，根据候选根因规则中的一种告警在时间上先于另一种告警发生的概率，能够从候选根因规则中筛选出有效根因规则(也就是根据时序信息能够从候选根因规则中选择出有效根因规则)，进而可以根据有效根因规则进行更准确的根因告警定位。
应理解，在根据有效根因规则确定关联告警组合中的根因告警时，还可以先从有效根因规则中选择出与关联告警组合相关的根因告警，然后再根据这些根因告警来确定关联告警组合中的根因告警。
可选地，作为一个实施例，上述根据有效根因规则确定关联告警组合中的根因告，包 括：从有效根因规则中确定出与关联告警组合对应的目标根因规则；根据目标根因规则确定关联告警组合中的根因告警。
其中，上述目标根因规则中的告警均存在于关联告警组合中。
例如，关联告警组合为ABC，有效根因规则为{A->B，A->C，B->D，C->E，D->F}，其中，根因规则A->B中的告警A和告警B均存在于关联告警组合ABC中，同样，根因规则A->C中的告警A和告警C均存在于关联告警组合ABC中，因此，可以将根因规则A->B和根因规则A->C从有效根因规则中选择出来，得到目标根因规则{A->B，A->C}。
通过从有效根因规则中选择出与关联告警组合相对应的目标根因规则，能够直接将有效根因规则中与关联告警组合密切相关的根因规则选择出来，进而可以根据目标根因规则更有针对性的来定位关联告警组合中的根因告警。
进一步地，为了更方便地根据目标根因规则来定位关联告警组合中的根因告警，还可以先根据目标根因规则构建根因决策网络，然后再根据该根因决策网络来定位关联告警组合中的根因告警。
例如，关联告警组合为ABC，目标根因规则为{A->B，A->C}，那么，根据目标根因规则可以构建一个简单的根因决策网络，该根因决策网络如图3所示，根据图3所示的根因决策网络能够很方便地确定出告警A为关联告警组合ABC的根因告警。
通过构建根因决策网络，能够更方便更直接地确定出关联告警组合中的根因告警。
在本申请中，除了直接根据目标根因规则确定关联告警组合中的根因告警之外，还可以先获取目标根因规则的权重信息，然后再根据目标根因规则以及目标根因规则的权重信息来确定关联告警组合中的根因告警。
可选地，作为一个实施例，图1所示的方法还包括：根据历史告警数据确定目标根因规则的权重信息，其中，该目标根因规则的权重信息用于指示该目标根因规则中的告警之间的因果关系强度。
应理解，获取目标根因规则的权重信息有两种方式。第一种方式，在得到目标根因规则之后，直接根据历史告警数据来确定目标根因规则的权重信息；第二种方式，在得到目标根因规则之前，根据历史告警数据来确定候选根因规则或者有效根因规则的权重信息，这样在得到目标根因规则之后，可以直接从候选根因规则或者有效根因规则中的权重信息中获取目标根因规则的权重信息。
也就是说，目标根因规则的权重信息既可以在从有效根因规则中确定出目标根因规则之后确定，也可以在从有效根因规则中确定出目标根因规则之前确定。
具体地，可以通过以下过程来确定目标根因规则的权重信息。
首先，根据历史告警数据确定目标根因规则的第三告警和第四告警分别在预设时间间隔内的多个时间窗口内发生的频率；
其次，根据第三告警分别在预设时间间隔内的多个时间窗口内发生的频率，生成第三告警发生的频率序列；
再次，根据第四告警分别在预设时间间隔内的多个时间窗口内发生的频率，生成第四告警的发生的频率序列；
最后，根据第三告警发生的频率序列与第四告警发生的频率序列的相似程度，确定目标根因规则的权重信息。
当直接确定候选根因规则或者有效根因规则的权重信息时，也可以按照上述确定目标根因规则的权重系数的方式进行。
应理解，当第三告警发生的频率序列与第四告警发生的频率序列的相似程度越大时，第三告警和第四告警之间的因果关系越强；当第三告警发生的频率序列与第四告警发生的频率序列的相似程度越小时，第三告警和第四告警之间的因果关系越弱。
应理解，告警在预设时间间隔内的多个时间窗口内发生的频率具体可以是指该告警在预设时间间隔内的多个时间窗口中的每个时间窗口内发生的次数。
例如，需要确定目标根因规则A->B的权重信息，那么，可以先将预设时间间隔划分为多个时间窗口，然后再根据历史告警数据确定告警A和告警B分别在每个时间窗口内发生的次数，最后再综合告警A和告警B在各个时间窗口内发生的次数就可以得到告警A和告警B发生的频率序列。
图4示出了告警A和告警B在部分时间窗口(窗口0至窗口2)发生的次数，具体地，在窗口0至窗口2中，告警A分别发生了2次、3次和2次，在窗口0至窗口2中，告警A分别发生了1次、2次和3次。
假设预设时间间隔仅由窗口0至窗口2组成，那么，告警A发生的频率序列为2 3 2，告警B发生的频率序列为1 2 3。接下来，就可以根据频率序列2 3 2与频率序列1 2 3的相似性来确定目标根因规则A->B的权重信息。
在得到了目标根因规则的权重信息之后，就可以直接根据目标根因规则以及目标根因规则的权重信息来确定关联告警组合中的根因告警了。
可选地，作为一个实施例，上述根据目标根因规则确定关联告警组合中的根因告警，包括：根据目标根因规则以及目标根因规则的权重信息，确定关联告警组合中每个告警的影响因子；根据影响因子的大小确定关联告警组合中的根因告警。
其中，上述每个告警的影响因子用于指示该每个告警对该关联告警组合中的其它告警的影响程度。
应理解，一个告警对其它告警的影响程度可以是该告警发生时会导致其它告警发生的可能性的大小。例如，告警A对告警B的影响程度非常大，那么，告警A的发生很有可能会导致告警B的发生。
例如，对于关联告警组合ABC，告警A的影响因子用于指示告警A对关联告警ABC中的告警B和告警C的影响程度，如果告警A的影响因子大于告警B的影响因子和告警C的影响因子，那么，可以认为在告警A、告警B和告警C中，告警A对关联告警组合ABC中的其它告警的影响程度最大，可以将告警A确定为关联告警组合ABC中的根因告警。
在根据影响因子的大小确定关联告警组合中的根因告警时，既可以将影响因子最大的告警确定为关联告警组合中根因告警，也可以将影响因子最大的几个告警都确定为关联告警组合中的根因告警。
可选地，作为一个实施例，根据影响因子的大小确定所述关联告警组合中的根因告警，包括：将关联告警组合中的K个告警确定为根因告警，其中，K为大于等于1的整数，并且该K个告警的影响子大于或者等于关联告警组合中除K个告警之外的其它任意一个告警的影响因子。
上述选择根因告警的方式也可以理解为是从关联告警中选择K个影响因子最大的告警作为根因告警。当K为1时，是将关联告警组合中影响因子最大的告警确定为关联告警组合中根因告警；当K大于1时，是将关联告警组合中影响因子最大的几个告警确定为关联告警组合中的根因告警。
为了从候选根因规则中选择出更有效的根因规则，可以根据候选根因规则的时序信息和权重信息从候选根因规则中选择出有效根因规则。为此，本申请实施例提出了另一种电信网络中定位根因告警的方法，下面结合图5对这种方法进行详细的介绍。
图5是本申请实施例的电信网络中定位根因告警的方法的示意性流程图。图5所示的方法包括步骤201至步骤206，其中，步骤204和步骤205的发生在时间上没有严格的先后顺序，步骤205既可以发生在步骤204之前，也可以发生在步骤204之后，或者，步骤204和步骤205可以同时发生，下面分别对步骤201至步骤206进行详细的介绍。
应理解，图5所示的方法中的步骤201至步骤203的内容与图1所示的方法中的步骤101至步骤103的内容实质上是相同的(步骤203中确定候选根因规则的时序信息与步骤103中确定候选根因规则的时序信息的内容是相同的)，上文中对步骤101至步骤103的限定和解释同样适用于201至步骤203。类似地，步骤205和步骤206的内容分别与步骤105和步骤106的内容实质上也是相同的，上文中对步骤105和步骤106的限定和解释同样适用于205和步骤206。因此，为了简洁，下面在描述图5所示的方法的各个步骤时，将适当省略重复的描述。
201、获取电信网络的告警关联规则。
当图5所示的方法由服务器执行时，上述告警关联规则可以预先设置在服务器中，例如，上述告警关联规则预先设置在服务器的存储器中，当执行步骤201时，可以直接从服务器的存储器中直接获取该告警关联规则。另外，上述告警关联规则也可以是服务器实时获取的，具体地，服务器可以根据电信网络的历史告警数据来获取电信网络的告警关联规则。在根据历史告警数据获取告警关联规则时，可以先获取电信网络的历史告警数据，然后对该历史告警数据进行频繁项挖掘来生成电信网络的告警关联规则。
202、对告警关联规则进行分解，得到候选根因规则。
具体地，可以先对告警关联规则进行分解，然后再对告警关联规则分解得到的告警进行两两组合，得到候选根因规则。
通过对告警根因规则中的多个告警进行两两组合，能够得到由两个告警组成的候选根因规则，便于对告警关联规则中的任意两个告警之间的因果关系进行分析。
例如，对告警关联规则ABCD进行分解，得到告警A、告警B、告警C和告警D，然后对这四个告警进行两两组合可以得到候选规则{A->B，A->C，A->D，B->A，B->C，B->D，C->A，C->B，C->D，D->A，D->B，D->C}。
由上述示例可知，候选根因规则的数量可以是多个(根据告警关联规则ABCD可以得到12个候选根因规则)，每个候选根因规则均包含两个告警。
203、根据电信网络的历史告警数据确定候选根因规则的时序信息。
其中，上述候选根因规则包含第一告警和第二告警，候选根因规则的时序信息用于指示第一告警在时间上先于第二告警发生的概率。
以候选根因规则A->B为例，A为第一告警，B为第二告警，或者A为第二告警，B 为第一告警，确定候选根因规则A->B的时序信息实质上就是确定告警A(或者告警B)在时间上先于告警B(或者告警A)发生的概率。
在本申请中，可以通过分析历史告警数据来得到第一告警在时间上先于第二告警发生的概率，进而确定候选根因规则的时序信息。
具体地，可以根据历史告警数据先确定第一告警在预设时间间隔内先于或者后于第二告警发生的次数，然后再根据第一告警在预设时间间隔内先于或者后于第二告警发生的次数来确定候选根因规则的时序信息。
例如，在一段时间间隔内，第一告警和第二告警均发生了10次，其中，第一告警有7次在第二告警之前发生，第一告警有3次在第二告警之后发生，那么，当时序信息具体为时序系数时，那么，可以确定该候选规则告警的时序系数值为0.7，该时序系数值大于0.5表示第一告警先于第二告警发生的次数大于第二告警先于第一告警发生的次数。
通过分析历史告警数据可以得知第一告警和第二告警在过去的某段时间间隔内发生的次数和发生的先后顺序，能够确定出第一告警在时间上先于或者第二告警发生的概率，进而可以确定时序信息。
可选地，根据历史告警数据确定第一告警在预设时间间隔内先于或者后于第二告警发生的次数，具体包括：根据历史告警数据确定第一告警和第二告警分别在预设时间间隔内发生时的时间戳，然后再根据第一告警在预设时间间隔内发生时的时间戳与第二告警在预设时间间隔内发生时的时间戳的先后顺序可以确定第一告警在预设时间间隔内先于或者后于第二告警发生的次数。
204、根据历史告警数据确定候选根因规则的权重信息，候选根因规则的权重信息用于指示第一告警与第二告警之间的因果关系强度。
具体地，可以通过以下过程来确定候选根因规则的权重信息。
首先，根据历史告警数据确定候选根因规则的第一告警和第二告警分别在预设时间间隔内的多个时间窗口内发生的频率；
其次，根据第一告警分别在预设时间间隔内的多个时间窗口内发生的频率，生成第一告警发生的频率序列；
再次，根据第二告警分别在预设时间间隔内的多个时间窗口内发生的频率，生成第二告警的发生的频率序列；
最后，根据第一告警发生的频率序列与第二告警发生的频率序列的相似程度，确定候选根因规则的权重信息。
当第一告警发生的频率序列与第二告警发生的频率序列的相似程度越大时，第一告警和第二告警之间的因果关系越强；当第一告警发生的频率序列与第二告警发生的频率序列的相似程度越小时，第一告警和第二告警之间的因果关系越弱。
205、根据候选根因规则的时序信息和权重信息从候选根因规则中确定出有效根因规则。
可选地，当时序信息为时序系数值，权重信息为权重系数值时，根据候选根因规则的时序信息和权重信息从候选根因规则中确定出有效根因规则，具体包括：将候选根因规则中时序系数值在第一预设范围内，且权重系数值在第二预设范围内的根因规则确定为有效根因规则。
上述时序系数值的取值范围可以为[0，1]，当时序系数值为0时表示候选根因规则中的第一告警一定不会先于第二告警发生(第一告警先于第二告警发生的概率为0)，当时序系数值为1时表示候选根因规则中的第二告警一定先于第一告警发生(第一告警先于第二告警发生的概率为1)。
上述权重系数值的取值范围可以为[0，1]，当权重系数值为0时表示候选根因规则中的第一告警一定不会导致第二告警的发生(第一告警导致第二告警发生的概率为0)，当时序系数值为1时表示候选根因规则中的第一告警一定会导致第二告警的发生(第一告警导致第二告警发生的概率为1)。
可选地，将候选根因规则中时序系数值在第一预设范围内，且权重系数值在第二预设范围内的根因规则确定为有效根因规则，包括：将候选根因规则中时序系数值大于或者等于第一时序系数阈值，且权重系数值大于或者等于第一权重系数阈值的根因规则确定为有效根因规则。
上述第一时序系数阈值可以为0.5，而第一权重系数阈值可以为0。
应理解，步骤205中是综合考虑时序信息和权重信息而从候选根因规则中选择出有效根因规则，而步骤104中仅考虑时序信息而从候选根因规则中选择出有效根因规则，与步骤104相比，步骤205中根据时序信息和权重信息能够从候选根因规则中选择出更有效的根因规则作为有效根因规则。
206、从电信网络的告警流中提取关联告警组合。
关联告警组合中的告警之间一般会存在一定的关联关系。因此，在通常情况下，可以通过告警压缩技术将告警流中存在一定关联关系的多个告警提取出来，得到关联告警组合。而在电信网络实际的业务场景中，客户一般会重点关注某些与业务强相关的告警，因此，可以采用告警压缩技术将告警流中与业务告警相关联的告警组合在一起，得到关联告警组合。
207、根据有效根因规则确定关联告警组合中的根因告警。
具体地，可以根据有效根因规则中的不同告警之间的因果关系来确定关联告警组合中的根因告警。
例如，关联告警组合为ABC，有效根因规则为{A->B，A->C，B->D，C->E，D->F}，那么，根据该有效根因规则可知，告警A的发生会导致告警B的发生，同样，告警A的发生也会导致告警C的发生，因此，可以确定告警A为关联告警组合ABC中的根因告警。
另外，还可以根据有效根因规则中的不同告警之间的因果关系以及有效根因规则的权重信息来确定关联组合中的根因告警。
本申请中，根据候选根因规则中的一种告警在时间上先于另一种告警发生的概率以及候选根因规则中告警之间的因果关系强度，能够从候选根因规则中较为准确地筛选出有效根因规则，进而可以根据有效根因规则进行更准确的根因告警定位。
在根据有效根因规则确定关联告警组合中的根因告警时，还可以先从有效根因规则中选择出与关联告警组合相关的目标根因告警，然后再根据目标根因告警来确定关联告警组合中的根因告警。
可选地，作为一个实施例，上述根据有效根因规则确定关联告警组合中的根因告警，包括：从有效根因规则中确定出与关联告警组合对应的目标根因规则，其中，目标根因规 则中的告警均存在于关联告警组合中；根据目标根因规则确定关联告警组合中的根因告警。
例如，关联告警组合为ABCD，有效根因规则为{A->B，A->C，C->D，C->E，D->F}其中，根因规则A->B中的告警A和告警B均存在于关联告警组合ABCD中，同样，根因规则A->C、C->D中的告警也都存在于关联告警组合ABCD中，因此，可以将根因规则A->B、A->C和C->D从有效根因规则中选择出来，得到目标根因规则{A->B，A->C，C->D}。
通过从有效根因规则中选择出与关联告警组合相对应的目标根因规则，能够直接将有效根因规则中与关联告警组合密切相关的根因规则选择出来，进而可以根据目标根因规则更有针对性的来定位关联告警组合中的根因告警。
进一步地，为了更方便地根据目标根因规则来定位关联告警组合中的根因告警，还可以先根据目标根因规则构建根因决策网络，然后再根据该根因决策网络来定位关联告警组合中的根因告警。
例如，关联告警组合为ABCD，目标根因规则为{A->B，A->C，C->D}，那么，根据目标根因规则可以构建一个简单的根因决策网络，该根因决策网络如图6所示，根据图6所示的根因决策网络能够很方便地确定出告警A为关联告警组合ABCD中的根因告警。
可选地，作为一个实施例，上述根据目标根因规则确定关联告警组合中的根因告警，包括：根据目标根因规则以及目标根因规则的权重信息，确定关联告警组合中每个告警的影响因子；根据影响因子的大小确定关联告警组合中的根因告警。
其中，上述每个告警的影响因子用于指示该每个告警对该关联告警组合中的其它告警的影响程度。
例如，对于关联告警组合ABCD，告警A的影响因子用于指示告警A对关联告警ABCD中的告警B、告警C和告警C的影响程度。如果告警A的影响因子大于关联告警组合ABCD中的其它告警的影响因子，那么，就可以认为在告警A、告警B、告警C和告警D中，告警A对关联告警组合ABCD中的其它告警的影响程度最大，可以将告警A确定为关联告警组合ABCD中的根因告警。
在根据影响因子的大小确定关联告警组合中的根因告警时，既可以将影响因子最大的告警确定为关联告警组合中根因告警，也可以将影响因子最大的几个告警都确定为关联告警组合中的根因告警。
可选地，作为一个实施例，根据影响因子的大小确定所述关联告警组合中的根因告警，包括：将关联告警组合中的K个告警确定为根因告警，其中，K为大于等于1的整数，并且该K个告警的影响子大于或者等于关联告警组合中除K个告警之外的其它任意一个告警的影响因子。
上述选择根因告警的方式也可以理解为是从关联告警中选择K个影响因子最大的告警作为根因告警。当K为1时，是将关联告警组合中影响因子最大的告警确定为关联告警组合中根因告警；当K大于1时，是将关联告警组合中影响因子最大的几个告警确定为关联告警组合中的根因告警。
应理解，在本申请中，在确定了有效根因规则之后，除了直接根据该有效根因规则确定关联告警组合中的根因告警之外，还可以生成有效根因规则信息，将该有效根因规则信 息存储起来供根因告警定位时使用，或者，也可以将该有效根因规则信息传输给电信网络设备，使得电信网络设备能够根据该有效根因规则信息进行根因告警定位、
图7是本申请实施例的电信网络中定位根因告警的方法的示意性流程图。图7所示的方法包括：
301、获取告警关联规则信息。
当图7所示的方法由服务器执行时，上述告警关联规则信息可以是预先存储在服务器的存储器或者存储模块中的信息，当执行步骤301时，可以直接从存储器中直接获取该告警关联规则信息。告警关联规则信息具体用于指示告警关联规则，因此，在得到了该告警关联规则信息之后，就可以得到告警关联规则。
302、对告警关联规则进行分解，生成候选根因规则。
步骤302中的内容与上文中的步骤101和步骤202的内容的实质是相同的，上文中对步骤102和步骤202的限定、解释和扩展同样适用于步骤302。
303、获取历史告警数据。
当图7所示的方法由服务器执行时，可以从服务器的存储器或者存储模块中获取历史告警数据。
304、根据历史告警数据确定候选根因规则的时序信息。
305、根据时序信息从候选根因规则中选择有效根因规则，得到与所述有效根因规则对应的有效根因规则信息。
步骤304和步骤305的内容分别与上文中的步骤103和步骤104的内容的实质是相同的，上文中对步骤103和步骤104的限定、解释和扩展同样适用于步骤304和步骤305。
在本申请中，从候选根因规则中选择有效根因规则时，除了根据时序信息进行选择之外，还可以根据候选根因规则的时序信息和权重信息从候选根因规则中选择有效根因规则。
可选地，图7所示的方法还包括：存储有效根因规则信息。
具体地，当图7所示的方法由服务器执行时，可以将有效根因规则信息存储到服务器的存储器或者存储模块中。
通过存储有效根因规则信息，能够在后续方便地提取该有效根因规则信息并进行根因告警的定位。
可选地，图7所示的方法还包括：从电信网络的告警流中提取关联告警组合；根据有效根因规则信息指示的有效根因规则确定关联告警组合中的根因告警。
通过预先获取的有效根因规则信息能够进行根因告警定位，可以提高根因告警定位的效率。
图8是本申请实施例的电信网络中定位根因告警的方法的示意性流程图。图8所示的方法包括：
401、获取告警关联规则信息。
当图8所示的方法由服务器执行时，上述告警关联规则信息可以是预先存储在服务器的存储器或者存储模块中的信息，当执行步骤401时，可以直接从存储器中直接获取该告警关联规则信息。告警关联规则信息具体用于指示告警关联规则，因此，在得到了该告警关联规则信息之后，就可以得到告警关联规则。
402、对告警关联规则进行分解，生成候选根因规则。
上文中对步骤102和步骤202的限定、解释和扩展同样适用于步骤402。
403、根据历史告警数据确定候选根因规则的时序信息。
404、根据历史告警数据确定候选根因规则的权重信息。
上文中对步骤203的限定、解释和扩展同样适用于步骤403和步骤404。
405、根据时序信息和权重信息从候选根因规则中选择有效根因规则，得到有效根因规则信息。
上文中对步骤205的限定、解释和扩展同样适用于步骤405。
本申请中，根据候选根因规则中的一种告警在时间上先于另一种告警发生的概率以及候选根因规则中告警之间的因果关系强度，能够从候选根因规则中较为准确地筛选出有效根因规则，并生成有效根因规则信息，便于后续可以根据该有效根因规则信息来进行更准确的根因告警定位。
可选地，作为一个实施例，图8所示的方法还包括：存储有效根因规则信息。
具体地，当图8所示的方法由服务器执行时，可以将有效根因规则信息存储到服务器的存储器或者存储模块中。
通过存储有效根因规则信息，能够在后续方便地提取该有效根因规则信息并进行根因告警的定位。
在一种可能的实现方式中，图8所示的方法还包括：从所述电信网络的告警流中提取关联告警组合；根据所述有效根因规则信息指示的有效根因规则确定所述关联告警组合中的根因告警。
通过预先获取的有效根因规则信息能够进行根因告警定位，可以提高根因告警定位的效率。
为了更好地理解本申请实施例的电信网络中定位根因告警的方法，下面结合具体的实施例对本申请实施例的电信网络中定位根因告警的方法进行详细的介绍。
本申请实施例的电信网络中定位根因告警的方法的整个过程可以大致分为两个阶段。第一阶段：确定出有效告警根因规则集合；第二阶段：基于该有效告警根因规则集合确定出关联告警组合中的根因告警。这里的有效告警根因规则集合相当于上文中从候选根因规则中选择出来的有效根因规则。
下面结合图9至图14分别对上述定位告警中的第一阶段和第二阶段进行描述。
如图9所示，确定有效根因规则集合的具体包括步骤501至步骤508，步骤501至步骤508中的具体过程可以由服务器或者服务器集群执行，下面分别对步骤501至步骤508进行详细的说明。
501、获取历史告警数据。
该历史告警数据可以是一段时间内从电信网络中的各个设备收集来的告警数据，该历史告警数据可以包括告警发生的设备、告警发生的时间以及告警的种类等等。
应理解，历史告警数据可以直接由服务器或者服务器集群收集。或者，历史告警数据也可以由专门的告警收集平台来收集，例如，告警数据可以由统一告警收集云平台来收集，服务器或者服务器集群在从统一告警收集云平台获取历史告警数据。
502、获取告警关联规则。
上述告警关联规则可以是通过对历史告警数据进行频繁挖掘而生成的。在获取该告警关联规则时，既可以通过对历史告警数据进行频繁挖掘而得到，也可以直接获取预先设置的告警关联规则，该预先设置的告警关联规则可以是之前通过对历史告警数据进行频繁挖掘得到，并且预先设置在服务器或者服务器集群中(具体可以是将告警关联规则设预先存储在服务器中)。
503、对告警关联规则进行分解，生成候选根因规则。
告警关联规则中包含的告警相互之间一般都有一定的关联关系或者因果关系，也就是说，告警关联规则中的一个告警的发生可能会导致另一个告警的发生。为了得到告警关联规则中的不同告警之间的关联关系或者因果关系，可以先对告警关联规则进行两两分解，分析每两个告警之间的关联关系。
在对告警关联规则进行分解时，比较常用的方法是将关联根因规则进行分解，并对分解得到的告警进行两两组合，以得到候选根因规则。应理解，这里的候选根因规则的数量可以是多个，其中，每个候选根因规则中包含两个告警。
例如，关联根因规则ABC共包含告警A、告警B和告警C，告警关联规则ABC表示告警A、告警B和告警C有一定的关联关系，对关联根因规则ABC进行分解可以得到6个候选根因规则，这6个候选根因规则分别是A->B，A->C，B->A，B->C，C->A，C->B。
504、根据历史告警数据生成候选根因规则的原始时间序列和频次时间序列。
候选根因规则的原始时间序列是候选根因规则中的告警在一段时间间隔内发生的时间所形成的时间序列，而候选根因规则频次时间序列是指在候选根因规则中的告警在一段时间间隔内发生的频率所组成的序列。
下面以候选根因规则A->B为例详细说明如何确定候选根因规则的原始时间序列和频次时间序列；
如图10所示，将一段时间(例如，三个月)内电信网络中所有发生的告警A按照时间戳从小到大的顺序进行排列，得到一条告警A序列，然后按照一定的时间周期(例如，5分钟)划分告警A序列，得到多个时间窗口(图6中仅示意性的示出了5个窗口)，将同一时间窗口内发生在同一台设备上的告警A仅保留一个，从而得到告警A的原始时间序列，通过相同的方式可以获取告警B的原始时间序列。如图10所示，告警A的原始时间序列和告警B的原始时间序列组成了候选根因规则A->B的原始时间序列。
应理解，根据候选根因规则告警的原始时间序列指示出了候选根因规则中的各个告警在一段时间内发生时的时间戳，因此，在原始时间序列的基础上可以得到上文中描述的候选根因规则的时序信息。
候选根因规则的频次时间序列可以在候选根因规则的原始时间序列的基础上构建。
仍以候选根因规则A->B为例，可以统计告警A和告警B的原始时间序列分别在各个窗口发生的告警次数，然后将告警A和告警B在各个窗口内发生的次数填到窗口中就得到了候选根因规则A->B的频次时间序列。
例如，候选根因规则A->B的原始时间序列的窗口1中包含告警A2、A3和A4(A2、A3和A4可以认为是发生在不同设备上的告警A)，候选根因规则A->B的原始时间序列的窗口1中包含告警B1和B2(B1和B2可以认为是发生在不同设备上的告警B)，也就是说告警A在窗口1内发生了3次，告警B在窗口1内发生了2次，接下来，将告警A 和告警B在窗口1的发生的次数分别填到窗口1中告警A和告警B对应的位置。按照上述方式对其它窗口进行类似处理就可以得到如图7所示的候选根因规则A->B的频次时间序列。最终得到候选根因规则A->B中告警A的频次时间序列为2 3 2 1 1，候选根因规则A->B中告警B的频次时间序列为1 2 3 0 1。
应理解，这里的频次时间序列与上文中的频率序列的含义是相同的，均表示候选根因规则中的告警在一段时间间隔内的多个窗口内发生的频率或者次数。
505、根据候选根因规则的原始时间序列计算候选根因规则的时序系数。
应理解，步骤505中的时序系数是上文中描述的时序信息的一种具体表现形式。
候选根因规则的时序系数用于反映候选根因规则中的一个告警在时间上先于另一个告警的发生的概率，用来验证候选根因规则所表示的因果关系的有效性。例如，候选根因规则A->B的时序系数反映的是告警A在时间上先于告警B发生的概率，用于表示候选根因规则A->B表示的因果关系的有效性。
具体地，候选根因规则A->B的时序系数能够反映候选A->B所表示的因果关系的有效性，时序系数的数值越大，告警A先于告警B发生的概率越大，表示告警A越有可能导致告警B的发生。也就是说，如果在大部分时间窗口内，告警A总是发生在告警B之前，则可以很大程度认为A->B是成立的。
候选根因规则的原始时间序列能够反映候选根因规则中的不同告警发生的时间，而候选根因规则的时序系数反映的是候选根因规则中的一个告警先于另一个告警发生的概率。根据候选根因规则中的不同告警发生的时间能够计算出候选根因规则中的一个告警先于另一个告警发生的概率。也就是说，根据候选根因规则的原始时间序列能够计算出候选根因规则的时序系数。
下面结合图10计算候选根因规则A->B的时序系数，具体地，可以根据公式(1)计算候选根因规则A->B的时序系数。
Figure PCTCN2019071583-appb-000001
其中，T(A,B)表示候选根因规则A->B的时序系数，
Figure PCTCN2019071583-appb-000002
和
Figure PCTCN2019071583-appb-000003
分别表示告警A和告警B的原始时间序列在窗口i的时间期望，S表示时间窗口数，函数I(x)为指示函数，当x>0时，I(x)＝1，x≤0时，I(x)＝0，prior_t(x,y)为先验函数，表示告警x→y的先验时序知识，prior_t(x,y)的数值可以依靠人的经验产生，α为调和参数，当α＝0时，在确定时序系数时不采用先验知识。
T(A,B)的时序系数的取值在不同的范围时可以表示候选根因规则A->B具有不同的有效性。
T(A,B)的时序系数表示的含义的一种具体情况如下：
当T(A,B)>0.5时，候选根因规则A->B为有效根因规则；
当0<T(A,B)<0.5时，候选根因规则A->B为无效根因规则；
当T(A,B)＝0.5时，候选根因规则A->B和候选根因规则B->A均为有效根因规则；
当T(A,B)＝0时，候选根因规则A->B和候选根因规则B->A均为无效根因规则。
应理解，T(A,B)的时序系数在不同取值范围内所表示的含义还可以有其他的情况， 本申请对此不做限制。
在实际的应用场景中，由于受到告警采集时间精度等因素的影响，告警A在时间上先于告警B发生的统计特征不能完全作为A->B的充分条件。因此，在某些特殊的场景下，需要再结合专家的经验来确定A->B的有效性。例如，在每一时间窗口内，告警A和告警B实际发生的时间间隔在毫秒内，而告警采集设备的采集精度只能精确到秒，那么，告警A和告警B的采集时间(时间戳)很可能是相同的，导致无法根据告警A和告警B发生的先后顺序来确定A->B的有效性，在这种情况下就需要依靠专家的经验，通过prior_t(A,B)直接为候选根因规则A->B的时序系数赋值(例如，0.6)
506、根据时序系数从候选根因规则中选择有效根因规则。
具体地，可以将候选根因规则中时序系数值大于一定阈值的根因规则选择出来作为有效根因规则。
例如，可以将候选根因规则中时序系数值大于或者等于0.5的根因规则选择出来作为有效根因规则。
假设，候选根因规则包括A->B、A->C、B->A、B->C、C->A和C->B，各个候选规则的时序系数值分为为A->B(0.6)、A->C(0.7)、B->A(0.4)、B->C(0.5)、C->A(0.3)和C->B(0.4)。那么，可以将时序系数值大于或者等于0.5的根因规则A->B、A->C和B->C从候选根因规则中选择出来作为有效根因规则。
507、根据频次时间序列计算候选根因规则的权重系数。
候选根因规则的权重系数用于表示候选根因规则所表示的因果关系的强度。例如，候选根因规则A->B的权重系数用于表示告警A与告警B之间的因果关系强度，候选根因规则A->B的权重系数越大表示告警A与告警B之间的因果关系强度越高。
在根据频次时间序列计算候选根因规则的权重系数时，具体可以根据候选根因规则中的各个告警的频次时间序列的相似性来确定候选根因的权重系数，候选根因规则中的各个告警的频次时间序列的相似性越高，候选根因规则的权重系数越大。
下面结合图11计算候选根因规则A->B的时序系数，具体地，可以根据公式(2)计算候选根因规则A->B的权重系数。
Figure PCTCN2019071583-appb-000004
其中，W(A,B)表示候选根因规则A->B的权重系数，C Ai和C Bi分别表示告警A和告警B的频次时间序列在窗口i内发生的频次值(频率值)，S为时间窗口数，prior_t(x,y)为先验函数，表示告警x→y的先验时序知识，prior_t(x,y)的数值可以依靠人的经验产生，α为调和参数，当α＝0时，在确定权重系数时不适用先验知识。
经过以上步骤可以得到有效根因规则的时序系数和权重系数，进而可以得到三元组形式的有效根因规则。
以有效根因规则A->B为例，可以得到如表1所示的有效根因规则A->B的三元组信息。
表1
告警A 告警B 权重W
如表1所示，告警A为先序告警，告警B为后序告警，告警A与告警B之间的权重系数为W。
508、输出告警根因规则集合。
将有效根因规则组合在一起，得到告警根因规则集合。
例如，经过步骤506之后得到的有效根因规则为A->B、A->C和B->C，其中，A->B、A->C和B->C的权重系数分别为0.8、0.4和0.6，那么，可以得到告警根因规则集合{(A->B，0.8)，(A->C，0.4)，(B->C，0.6)}。
如图12所示，确定有效根因规则集合的具体包括步骤601至步骤607，下面分别对步骤601至607进行详细的说明。
601、获取告警流。
具体地，可以从告警收集云平台获取告警流。
602、从告警流中提取关联告警组合。
具体地，可以采用告警压缩技术将告警流中与业务告警相关联的告警组合在一起，得到关联告警组合。
603、获取告警根因规则集合
步骤603中的告警根因规则集合可以是从经过上述步骤501至步骤507获得的。
604、根据关联告警组合从告警根因规则集合中选取对应的根因规则，生成根因决策网络。
在根据关联告警组合从告警根因规则集合中选取对应的根因规则时，要选择告警均存在于关联告警组合中的根因规则。
例如，从告警流中提取了关联告警组合A 1A 2A 3A 4A 5A 6，那么，可以从根因规则集合中选择以下根因规则：
(A 1->A 2，d 1)
(A 1->A 3，d 2)
(A 2->A 4，d 3)
(A 3->A 5，d 4)
(A 5->A 6，d 5)
其中，d 1至d 5分别是这些根因规则的权重系数。
接下来，可以根据以上选择出来的根因规则构造根因决策网络，构造得到的根因决策网络如图13所示。
605、根据根因决策网络确定关联告警组合中的每个告警的影响因子
应理解，这里的影响因子用于指示告警的影响范围，它反映的是某个告警为根因告警的可能性大小(或者称为权重)，以便于后续根据该影响因子作为根因告警的推荐或者判断。影响因子越大说明该告警为根因告警的可能性越大。
具体地，可以根据公式(3)来计算各个告警的影响因子。
Figure PCTCN2019071583-appb-000005
其中，IF(A)为告警A的影响因子，N out(A)表示根因决策网络中以A为先序告警的所有后序告警的集合，α为调和参数，0＜α≤1，可以根据经验来设置的α数值。
以图13所示的根因决策网络为例，根据上述公式(3)可以得到关联告警组合A 1A 2A 3A 4A 5A 6中各个告警的影响因子如公式(4)至公式(9)所示：
IF(A 1)＝1+d 1(1+d 3)+d 2(1+d 4(1+d 5)   (4)
IF(A 2)＝1+d 3   (5)
IF(A 3)＝1+d 4(1+d 5)   (6)
IF(A 4)＝0   (7)
IF(A 5)＝1+d 5   (8)
IF(A 6)＝1+d 6   (9)
606、按照影响因子大小对关联告警组合中的各个告警进行排序
经过步骤605可以得到各个告警的影响因子，接下来可以按照影响因子从大到小或者从小到大的顺序对关联告警组合中的各个告警进行排序。
607、输出影响因子最大的K个告警作为关联告警组合的根因告警。
根据步骤606的排序结果可以从各个告警中选择出影响因子最大的K个告警作为根因告警。这里的K的数值可以是大于或者等于1的整数，K的数值可以根据实际需要进行设置。
下面结合图14对确定关联告警组合A 1A 2A 3A 4A 5A 6中的根因告警的具体过程进行详细描述。
图14所示的确定根因告警的过程主要包括以下步骤：
701、选择与关联告警组合对应的根因规则。
将有效根因规则中包含A 1A 2A 3A 4A 5A 6中任意两个告警的根因规则选择出来，得到的A 1A 2A 3A 4A 5A 6对应的根因规则具体如下：
(A 1->A 2，d 1)
(A 1->A 3，d 2)
(A 2->A 4，d 3)
(A 3->A 5，d 4)
(A 5->A 6，d 5)
其中，d 1至d 5分别是这些根因规则的权重系数。
702、构建根因决策网络。
基于上述关联告警组合A 1A 2A 3A 4A 5A 6对应的根因规则来构建根因规则网络，在构建根因决策网络时具体是根据根因告警中的告警的顺序将各个告警搭建成一个网络，并标注相应的权重系数。
703、计算各个告警的影响因子并根据影响因子的大小对各个告警进行排序。
关联告警组合A 1A 2A 3A 4A 5A 6中各个告警的影响因子如下：
IF(A 1)＝1+d 1(1+d 3)+d 2(1+d 4(1+d 5)
IF(A 2)＝1+d 3
IF(A 3)＝1+d 4(1+d 5)
IF(A 4)＝0
IF(A 5)＝1+d 5
IF(A 6)＝1+d 6
根据影响因子的大小对各个告警进行排序，得到如下结果：
IF(A 1)＞IF(A 2)＞IF(A 3)＞IF(A 5)＞IF(A 4)＝IF(A 6)
也就是说，A 1为关联告警组合A 1A 2A 3A 4A 5A 6中影响因子最大的告警，A 4和A 6为关联告警组合A 1A 2A 3A 4A 5A 6中影响因子最小的两个告警，接下来，可以根据需要从关联告警组合A 1A 2A 3A 4A 5A 6选择出满足要求的告警作为根因告警。
704、输出影响因子最大的2个告警A 1和A 2为根因告警。
应理解，在实际应用过程中可以根据需要确定从关联告警组合中选择出来的根因告警的数量，根因告警的数量既可以是一个也可以是多个。
上文结合图1至图14对本申请实施例的电信网络中定位根因告警的方法进行了详细的介绍，下面结合图15和图16对本申请实施例的电信网络中定位根因告警的装置进行详细的介绍。应理解，图15和图16中的装置能够执行本申请实施例的电信网络中定位根因告警的方法的各个步骤，图15和图16中的装置可以是本申请实施例的电信网络中定位根因告警的方法的执行主体。为了简洁，下面在对图15和图16所示的装置进行介绍时，适当省略重复的描述。
图15是本申请实施例的电信网络中定位根因告警的装置的示意性框图。图15所示的装置1500包括：
获取模块1501，用于获取电信网络的告警关联规则；
处理模块1502，所述处理模块1502用于：对所述告警关联规则进行分解，得到候选根因规则；根据所述电信网络的历史告警数据确定所述候选根因规则的时序信息，其中，所述候选根因规则包含第一告警和第二告警，所述候选根因规则的时序信息用于指示所述第一告警在时间上先于第二告警发生的概率；根据所述候选根因规则的时序信息，从所述候选根因规则中确定出有效根因规则；从所述电信网络的告警流中提取关联告警组合；根据所述有效根因规则确定所述关联告警组合中的根因告警。
本申请中，根据候选根因规则中的一种告警在时间上先于另一种告警发生的概率，能够从候选根因规则中筛选出有效根因规则(也就是根据时序信息能够从候选根因规则中选择出有效根因规则)，进而可以根据有效根因规则进行更准确的根因告警定位。
上述装置1500具体可以是电信网络中的服务器或者服务器中用于进行根因告警定位的装置或者模块。装置1500中的获取模块1501和处理模块1502具体可以是服务器中的具有计算功能的单元或者模块，例如，中央处理器。
图16是本申请实施例的电信网络中定位根因告警的装置的示意性框图。图16所示的装置1600包括：
获取模块1601，用于获取电信网络的告警关联规则；
处理模块1602，所述处理模块1602具体用于：对所述告警关联规则进行分解，得到候选根因规则；根据所述电信网络的历史告警数据确定所述候选根因规则的时序信息，其中，所述候选根因规则包括第一告警和第二告警，所述候选根因规则的时序信息用于指示所述第一告警在时间上先于所述第二告警发生的概率；根据所述历史告警数据确定所述候选根因规则的权重信息，所述候选根因规则的权重信息用于指示所述第一告警与所述第二 告警之间的因果关系强度；根据所述候选根因规则的时序信息和权重信息从所述候选根因规则中确定出有效根因规则；从所述电信网络的告警流中提取关联告警组合；根据所述有效根因规则确定所述关联告警组合中的根因告警。
本申请中，根据候选根因规则中的一种告警在时间上先于另一种告警发生的概率以及候选根因规则中告警之间的因果关系强度，能够从候选根因规则中较为准确地筛选出有效根因规则，进而可以根据有效根因规则进行更准确的根因告警定位。
上述装置1600具体可以是电信网络中的服务器或者服务器中用于进行根因告警定位的装置或者模块。装置1600中的获取模块1601和处理模块1602具体可以是服务器中的具有计算功能的单元或者模块，例如，中央处理器。
图17是本申请实施例的电信网络中定位根因告警的装置的示意性框图。图17所示的装置1700包括：
存储器1701，用于存储程序；
处理器1702，用于执行存储器1701中存储的程序，当存储器1701中存储的程序被执行时，处理器1702具体用于执行本申请实施例的电信网络中定位根因告警的方法。例如，处理器1702可以具体用于执行上述处理模块1501或者处理模块1601执行的步骤。
应理解，对于装置1700来说，存储器1701可以存储电信网络的告警关联规则(具体可以以告警关联规则信息的形式存储)和历史告警数据。处理器1702可以从存储器1701中调取电信网络的告警关联规则以及电信网络的历史告警数据。
装置1700中的处理器1702对应于装置1500中的获取模块1501和处理模块1502(处理器1702能够实现获取模块1501和处理模块1502的功能)，处理器702还可以对应于装置1600中的获取模块1601和处理模块1602(处理器1702能够实现获取模块1601和处理模块1602的功能)。
装置1700具体可以是电信网络中的服务器或者服务器中用于进行根因告警定位的装置或者模块。装置1700中的存储器1701具体可以是服务器中的存储单元或者存储模块，处理器1702具体可以是服务器中的具有计算功能的单元或者模块，例如，中央处理器。
图18是本申请实施例的根因告警定位装置的示意性框图。图18所示的根因告警定位装置1800具体包括：告警关联规则挖掘模块1801、关联告警提取模块1802、告警根因规则挖掘模块1803和根因告警定位模块1804。
根因告警定位装置1800能够执行本申请实施例的电信网络中定位根因告警的方法。例如，告警关联规则挖掘模块1801能够执行图1所示的方法中的步骤101，关联告警提取模块1802能够执行图1所示的方法中的步骤105，告警根因规则挖掘模块1803能够执行图1所示的方法中的步骤102至步骤104，根因告警定位模块1804能够执行图1所示的方法中的步骤106。
再如，告警关联规则挖掘模块1801能够执行图2所示的方法中的步骤201，关联告警提取模块1802能够执行图2所示的方法中的步骤205，告警根因规则挖掘模块1803能够执行图2所示的方法中的步骤202至步骤204，根因告警定位模块1804能够执行图2所示的方法中的步骤206。
根因告警定位装置1800中的告警关联规则挖掘模块1801可以对应于装置1500中的获取模块1501和装置1600中的获取模块1601，用于获取电信网络的告警关联规则，而 关联告警提取模块1802、告警根因规则挖掘模块1803和根因告警定位模块1804对应于装置1500中的处理模块1502和装置1600中的处理模块1602，用于确定关联告警组合中的根因告警。
根因告警定位装置1800中的全部模块对应于装置1700中的处理器1702，用于完成从获取电信网络的告警关联规则到确定关联告警组合中的根因告警的整个过程。
为了更好地理解根因告警定位装置1800中各个模块的工作流程，下面结合图19对根因告警定位装置1800进行根因告警定位的整个过程进行简单的介绍。
图19是本申请实施例的根因告警定位装置进行根因告警定位的示意图。图19所示的根因告警定位过程主要包括以下步骤：
步骤1：告警关联规则挖掘模块1801对历史告警数据集进行挖掘处理，得到告警关联规则；
步骤2：关联告警提取模块1802依据告警关联规则模块1801获取的告警关联规则对实时告警流进行处理，从实时告警流中提取关联告警组合；
步骤3：告警根因规则挖掘模块1803根据历史告警数据集对告警关联规则模块1801获取的告警关联规则进行筛选处理，得到有效根因规则；
步骤4：根因告警定位模块1804根据告警根因规则挖掘模块1803提取出来的有效根因规则对关联告警组合进行根因告警定位，确定根因告警。
图20是本申请实施例的应用场景的示意图。
本申请实施例的电信网络中定位根因告警的方法可以具体应用在图20所示的应用场景中。利用本申请实施例的定位根因告警的方法可以定位电信网络中的电信网络设备的根因告警，其中，电信网络中的设备具体可以包括ATN域设备、MW域设备、RAN域设备以及其他域设备。
如图20所示，可以利用统一告警收集云平台对电信网络中产生的告警进行收集，并可以根据告警上报时间和域信息将告警分域组织成告警流，然后将告警流上报给统一告警监控云平台。统一告警监控云平台在接收到告警流之后，先通过单域单网元的告警压缩规则从告警流中匹配相应的告警组合来创建问题单，然后通过本申请实施例的电信网络中定位根因告警的方法为问题单中的关联告警组合定位出根因告警，最后将添加了根因告警信息的问题单派发给运维工程师，工程师基于该问题单中信息去检查对应的电信设备，由于问题单包含了根因告警信息，所以只要处理了根因告警，其他相关联的告警自然会消除，很大程度上提升了告警和故障处理效率。
本申请实施例的方法可以发生在统一告警监控云平台的根因告警诊断的过程，或者，电信网络中定位根因告警的方法可以发生在统一告警监控云平台的告警压缩、创建问题单和根因告警诊断的过程。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装 置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (29)

  1. 一种电信网络中定位根因告警的方法，其特征在于，包括：
    获取电信网络的告警关联规则；
    对所述告警关联规则进行分解，得到候选根因规则；
    根据所述电信网络的历史告警数据确定所述候选根因规则的时序信息，其中，所述候选根因规则包含第一告警和第二告警，所述候选根因规则的时序信息用于指示所述第一告警在时间上先于第二告警发生的概率；
    根据所述候选根因规则的时序信息，从所述候选根因规则中确定出有效根因规则；
    从所述电信网络的告警流中提取关联告警组合；
    根据所述有效根因规则确定所述关联告警组合中的根因告警。
  2. 如权利要求1所述的方法，其特征在于，所述时序信息为时序系数值，所述根据所述候选根因规则的时序信息，从所述候选根因规则中确定出有效根因规则，包括：
    将所述候选根因规则中时序系数值在预设范围内的根因规则确定为所述有效根因规则。
  3. 如权利要求1或2所述的方法，其特征在于，所述根据所述电信网络的历史告警数据确定所述候选根因规则的时序信息，包括：
    根据所述历史告警数据确定所述第一告警在预设时间间隔内先于或者后于所述第二告警发生的次数；
    根据所述第一告警在所述预设时间间隔内先于或者后于所述第二告警发生的次数，确定所述候选根因规则的时序信息。
  4. 如权利要求1-3中任一项所述的方法，其特征在于，所述根据所述有效根因规则确定所述关联告警组合中的根因告，包括：
    从所述有效根因规则中确定出与所述关联告警组合对应的目标根因规则，其中，所述目标根因规则中的告警均存在于所述关联告警组合中；
    根据所述目标根因规则确定所述关联告警组合中的根因告警。
  5. 如权利要求4所述的方法，其特征在于，所述根据所述目标根因规则确定所述关联告警组合中的根因告警，包括：
    根据所述历史告警数据确定所述目标根因规则的权重信息，所述目标根因规则的权重信息用于指示所述目标根因规则中的告警之间的因果关系强度；
    根据所述目标根因规则以及所述目标根因规则的权重信息，确定所述关联告警组合中每个告警的影响因子，其中，所述每个告警的影响因子用于指示所述每个告警对所述关联告警组合中的其它告警的影响程度；
    根据影响因子的大小确定所述关联告警组合中的根因告警。
  6. 如权利要求5所述的方法，其特征在于，所述根据影响因子的大小确定所述关联告警组合中的根因告警，包括：
    将所述关联告警组合中的K个告警确定为所述根因告警，其中，K为大于等于1的整数，所述K个告警的影响子大于或者等于所述关联告警组合中除所述K个告警之外的其 它任意一个告警的影响因子。
  7. 如权利要求5或6所述的方法，其特征在于，所述根据所述历史告警数据确定所述目标根因规则的权重信息，包括：
    根据所述历史告警数据确定所述目标根因规则的第三告警和第四告警分别在预设时间间隔内的多个时间窗口内发生的频率；
    根据所述第三告警分别在预设时间间隔内的多个时间窗口内发生的频率，生成所述第三告警发生的频率序列；
    根据所述第四告警分别在预设时间间隔内的多个时间窗口内发生的频率，生成所述第四告警的发生的频率序列；
    根据所述第三告警发生的频率序列与所述第四告警发生的频率序列的相似程度，确定所述目标根因规则的权重信息。
  8. 一种电信网络中定位根因告警的方法，其特征在于，包括：
    获取电信网络的告警关联规则；
    对所述告警关联规则进行分解，得到候选根因规则；
    根据所述电信网络的历史告警数据确定所述候选根因规则的时序信息，其中，所述候选根因规则包括第一告警和第二告警，所述候选根因规则的时序信息用于指示所述第一告警在时间上先于所述第二告警发生的概率；
    根据所述历史告警数据确定所述候选根因规则的权重信息，所述候选根因规则的权重信息用于指示所述第一告警与所述第二告警之间的因果关系强度；
    根据所述候选根因规则的时序信息和权重信息从所述候选根因规则中确定出有效根因规则；
    从所述电信网络的告警流中提取关联告警组合；
    根据所述有效根因规则确定所述关联告警组合中的根因告警。
  9. 如权利要求8所述的方法，其特征在于，所述时序信息为时序系数值，所述权重信息为权重系数值，所述根据所述候选根因规则的时序信息和权重信息从所述候选根因规则中确定出有效根因规则，包括：
    将所述候选根因规则中时序系数值在第一预设范围内，且权重系数值在第二预设范围内的根因规则确定为所述有效根因规则。
  10. 如权利要8或9所述的方法，其特征在于，所述根据所述电信网络的历史告警数据确定所述候选根因规则的时序信息，包括：
    根据所述历史告警数据确定所述第一告警在所述预设时间间隔内先于或者后于第二告警发生的次数；
    根据所述第一告警在所述预设时间间隔内先于或者后于所述第二告警发生的次数，确定所述候选根因规则的时序信息。
  11. 如权利要求8-10中任一项所述的方法，其特征在于，所述根据所述历史告警数据确定所述初始根因规则的权重信息，包括：
    根据所述历史告警数据确定所述第一告警和所述第二告警分别在预设时间间隔内的多个时间窗口内发生的频率；
    根据所述第一告警分别在预设时间间隔内的多个时间窗口内发生的频率，生成所述第 一告警发生的频率序列；
    根据所述第二告警分别在预设时间间隔内的多个时间窗口内发生的频率，生成所述第二告警发生的频率序列；
    根据所述第一告警发生的频率序列与所述第二告警发生的频率序列的相似程度，确定所述初始根因规则的权重信息。
  12. 如权利要求8-11中任一项所述的方法，其特征在于，所述根据所述有效根因规则确定所述关联告警组合中的根因告警，包括：
    从所述有效根因规则中确定出与所述关联告警组合相对应的目标根因规则，其中，所述目标根因规则中的告警均存在于所述关联告警组合中；
    根据所述目标根因规则确定所述关联告警组合中的根因告警。
  13. 如权利要求12所述的方法，其特征在于，所述根据所述目标根因规则确定所述关联告警组合中的根因告警，包括：
    根据所述目标根因规则以及所述目标根因规则的权重信息，确定所述关联告警组合中每个告警的影响因子，其中，所述每个告警的影响因子用于指示所述每个告警对所述关联告警组合中的其它告警的影响程度；
    根据影响因子的大小确定所述关联告警组合中的根因告警。
  14. 如权利要求13所述的方法，其特征在于，所述根据影响因子的大小确定所述关联告警组合中的根因告警，包括：
    将所述关联告警组合中的K个告警确定为所述根因告警，其中，K为大于等于1的整数，所述K个告警的影响子大于或者等于所述关联告警组合中除所述K个告警之外的其它任意一个告警的影响因子。
  15. 一种定位根因告警的装置，其特征在于，包括：
    获取模块，用于获取电信网络的告警关联规则；
    处理模块，所述处理模块用于：
    对所述告警关联规则进行分解，得到候选根因规则；
    根据所述电信网络的历史告警数据确定所述候选根因规则的时序信息，其中，所述候选根因规则包含第一告警和第二告警，所述候选根因规则的时序信息用于指示所述第一告警在时间上先于第二告警发生的概率；
    根据所述候选根因规则的时序信息，从所述候选根因规则中确定出有效根因规则；
    从所述电信网络的告警流中提取关联告警组合；
    根据所述有效根因规则确定所述关联告警组合中的根因告警。
  16. 如权利要求15所述的装置，其特征在于，所述时序信息为时序系数值，所述处理模块具体用于：
    将所述候选根因规则中时序系数值在预设范围内的根因规则确定为所述有效根因规则。
  17. 如权利要求15或16所述的装置，其特征在于，所述处理模块具体用于：
    根据所述历史告警数据确定所述第一告警在预设时间间隔内先于或者后于所述第二告警发生的次数；
    根据所述第一告警在所述预设时间间隔内先于或者后于所述第二告警发生的次数，确 定所述候选根因规则的时序信息。
  18. 如权利要求15-17中任一项所述的装置，其特征在于，所述处理模块具体用于：
    从所述有效根因规则中确定出与所述关联告警组合对应的目标根因规则，其中，所述目标根因规则中的告警均存在于所述关联告警组合中；
    根据所述目标根因规则确定所述关联告警组合中的根因告警。
  19. 如权利要求18所述的装置，其特征在于，所述处理模块具体用于：
    根据所述历史告警数据确定所述目标根因规则的权重信息，所述目标根因规则的权重信息用于指示所述目标根因规则中的告警之间的因果关系强度；
    根据所述目标根因规则以及所述目标根因规则的权重信息，确定所述关联告警组合中每个告警的影响因子，其中，所述每个告警的影响因子用于指示所述每个告警对所述关联告警组合中的其它告警的影响程度；
    根据影响因子的大小确定所述关联告警组合中的根因告警。
  20. 如权利要求19所述的装置，其特征在于，所述处理模块具体用于：
    将所述关联告警组合中的K个告警确定为所述根因告警，其中，K为大于等于1的整数，所述K个告警的影响子大于或者等于所述关联告警组合中除所述K个告警之外的其它任意一个告警的影响因子。
  21. 如权利要求19或20所述的装置，其特征在于，所述处理模块具体用于：
    根据所述历史告警数据确定所述目标根因规则的第三告警和第四告警分别在预设时间间隔内的多个时间窗口内发生的频率；
    根据所述第三告警分别在预设时间间隔内的多个时间窗口内发生的频率，生成所述第三告警发生的频率序列；
    根据所述第四告警分别在预设时间间隔内的多个时间窗口内发生的频率，生成所述第四告警的发生的频率序列；
    根据所述第三告警发生的频率序列与所述第四告警发生的频率序列的相似程度，确定所述目标根因规则的权重信息。
  22. 一种定位根因告警的装置，其特征在于，包括：
    获取模块，用于获取电信网络的告警关联规则；
    处理模块，所述处理模块具体用于：
    对所述告警关联规则进行分解，得到候选根因规则；
    根据所述电信网络的历史告警数据确定所述候选根因规则的时序信息，其中，所述候选根因规则包括第一告警和第二告警，所述候选根因规则的时序信息用于指示所述第一告警在时间上先于所述第二告警发生的概率；
    根据所述历史告警数据确定所述候选根因规则的权重信息，所述候选根因规则的权重信息用于指示所述第一告警与所述第二告警之间的因果关系强度；
    根据所述候选根因规则的时序信息和权重信息从所述候选根因规则中确定出有效根因规则；
    从所述电信网络的告警流中提取关联告警组合；
    根据所述有效根因规则确定所述关联告警组合中的根因告警。
  23. 如权利要求22所述的装置，其特征在于，所述时序信息为时序系数值，所述权 重信息为权重系数值，所述处理模块具体用于：
    将所述候选根因规则中时序系数值在第一预设范围内，且权重系数值在第二预设范围内的根因规则确定为所述有效根因规则。
  24. 如权利要22或23所述的装置，其特征在于，所述处理模块具体用于：
    根据所述历史告警数据确定所述第一告警在所述预设时间间隔内先于或者后于第二告警发生的次数；
    根据所述第一告警在所述预设时间间隔内先于或者后于所述第二告警发生的次数，确定所述候选根因规则的时序信息。
  25. 如权利要求22-24中任一项所述的装置，其特征在于，所述处理模块具体用于：
    根据所述历史告警数据确定所述第一告警和所述第二告警分别在预设时间间隔内的多个时间窗口内发生的频率；
    根据所述第一告警分别在预设时间间隔内的多个时间窗口内发生的频率，生成所述第一告警发生的频率序列；
    根据所述第二告警分别在预设时间间隔内的多个时间窗口内发生的频率，生成所述第二告警发生的频率序列；
    根据所述第一告警发生的频率序列与所述第二告警发生的频率序列的相似程度，确定所述初始根因规则的权重信息。
  26. 如权利要求22-24中任一项所述的装置，其特征在于，所述处理模块具体用于：
    从所述有效根因规则中确定出与所述关联告警组合相对应的目标根因规则，其中，所述目标根因规则中的告警均存在于所述关联告警组合中；
    根据所述目标根因规则确定所述关联告警组合中的根因告警。
  27. 如权利要求26所述的装置，其特征在于，所述处理模块具体用于：
    根据所述目标根因规则以及所述目标根因规则的权重信息，确定所述关联告警组合中每个告警的影响因子，其中，所述每个告警的影响因子用于指示所述每个告警对所述关联告警组合中的其它告警的影响程度；
    根据影响因子的大小确定所述关联告警组合中的根因告警。
  28. 如权利要求27所述的装置，其特征在于，所述处理模块具体用于：
    将所述关联告警组合中的K个告警确定为所述根因告警，其中，K为大于等于1的整数，所述K个告警的影响子大于或者等于所述关联告警组合中除所述K个告警之外的其它任意一个告警的影响因子。
  29. 一种计算机可读存储介质，其特征在于，包括指令，当所述指令在计算机上运行时，使得计算机执行权利要求1-14任选一所述方法。
PCT/CN2019/071583 2018-03-29 2019-01-14 定位根因告警的方法、装置和计算机可读存储介质 WO2019184557A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US17/035,054 US20210014103A1 (en) 2018-03-29 2020-09-28 Method and apparatus for locating root cause alarm, and computer-readable storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810268926.7A CN109905270B (zh) 2018-03-29 2018-03-29 定位根因告警的方法、装置和计算机可读存储介质
CN201810268926.7 2018-03-29

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/035,054 Continuation US20210014103A1 (en) 2018-03-29 2020-09-28 Method and apparatus for locating root cause alarm, and computer-readable storage medium

Publications (1)

Publication Number Publication Date
WO2019184557A1 true WO2019184557A1 (zh) 2019-10-03

Family

ID=66943227

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/071583 WO2019184557A1 (zh) 2018-03-29 2019-01-14 定位根因告警的方法、装置和计算机可读存储介质

Country Status (3)

Country Link
US (1) US20210014103A1 (zh)
CN (1) CN109905270B (zh)
WO (1) WO2019184557A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220166660A1 (en) * 2020-11-23 2022-05-26 Capital One Services, Llc Identifying network issues in a cloud computing environment

Families Citing this family (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110245168B (zh) * 2019-06-20 2021-08-31 国网江苏省电力有限公司南京供电分公司 一种提取电网历史告警中异常事件特征信号的方法及系统
CN112131083B (zh) * 2019-06-25 2022-06-07 大唐移动通信设备有限公司 一种告警事务处理方法及装置
CN111147289B (zh) * 2019-12-16 2022-03-04 东软集团股份有限公司 告警关联关系确定方法、监测方法、装置、介质及设备
CN113127528A (zh) * 2019-12-30 2021-07-16 中移信息技术有限公司 系统根因定位方法、装置、设备及计算机存储介质
CN111522705A (zh) * 2020-03-23 2020-08-11 广东工业大学 一种工业大数据智能运维解决方法
US11269711B2 (en) 2020-07-14 2022-03-08 Juniper Networks, Inc. Failure impact analysis of network events
CN112104495B (zh) * 2020-09-09 2022-07-05 四川信息职业技术学院 一种基于网络拓扑的系统故障根因定位方法
US11888679B2 (en) * 2020-09-25 2024-01-30 Juniper Networks, Inc. Hypothesis driven diagnosis of network systems
US11336507B2 (en) * 2020-09-30 2022-05-17 Cisco Technology, Inc. Anomaly detection and filtering based on system logs
CN112636967A (zh) * 2020-12-18 2021-04-09 北京浪潮数据技术有限公司 一种根因分析方法、装置、设备及存储介质
CN112799868B (zh) * 2021-02-08 2023-01-24 腾讯科技（深圳）有限公司 一种根因确定方法、装置、计算机设备及存储介质
US20220385526A1 (en) * 2021-06-01 2022-12-01 At&T Intellectual Property I, L.P. Facilitating localization of faults in core, edge, and access networks
CN113285840B (zh) * 2021-06-11 2021-09-17 云宏信息科技股份有限公司 存储网络故障根因分析方法及计算机可读存储介质
US20230016199A1 (en) * 2021-07-16 2023-01-19 State Farm Mutual Automobile Insurance Company Root cause detection of anomalous behavior using network relationships and event correlation
CN113641526B (zh) * 2021-09-01 2024-04-05 京东科技信息技术有限公司 告警根因定位方法、装置、电子设备及计算机存储介质
CN113708977B (zh) * 2021-09-27 2023-05-23 中国工商银行股份有限公司 获取根因告警信息的方法、装置、计算机设备和存储介质
CN113590451B (zh) * 2021-09-29 2022-02-01 阿里云计算有限公司 一种根因定位方法、运维服务器及存储介质
CN114389960B (zh) * 2022-01-04 2023-11-28 烽火通信科技股份有限公司 一种网络业务性能采集上报的方法和系统
CN115525803B (zh) * 2022-09-16 2024-02-23 深圳市海邻科信息技术有限公司 处警方法、系统、车载设备及计算机可读存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102928231A (zh) * 2012-11-13 2013-02-13 上海电力学院 一种基于d-s证据理论的设备故障诊断方法
CN103326874A (zh) * 2012-03-22 2013-09-25 西门子公司 告警管理系统及方法
CN104796273A (zh) * 2014-01-20 2015-07-22 中国移动通信集团山西有限公司 一种网络故障根源诊断的方法和装置
US20150280968A1 (en) * 2014-04-01 2015-10-01 Ca, Inc. Identifying alarms for a root cause of a problem in a data processing system
CN105471659A (zh) * 2015-12-25 2016-04-06 华为技术有限公司 一种故障根因分析方法和分析设备

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101247269B (zh) * 2008-03-05 2010-09-01 中兴通讯股份有限公司 一种自动发现判定冗余告警的关联规则的方法
CN101937447B (zh) * 2010-06-07 2012-05-23 华为技术有限公司 一种告警关联规则挖掘方法、规则挖掘引擎及系统
CN103916260A (zh) * 2013-01-08 2014-07-09 中国移动通信集团浙江有限公司 一种告警关联的装置及方法
US20150378805A1 (en) * 2013-11-29 2015-12-31 Hitachi, Ltd. Management system and method for supporting analysis of event root cause
CN103746831B (zh) * 2013-12-24 2017-08-18 华为技术有限公司 一种告警分析的方法、装置及系统
CN106209400B (zh) * 2015-04-30 2018-12-07 华为技术有限公司 一种定位故障的方法和设备
CN107181604B (zh) * 2016-03-09 2020-06-02 华为技术有限公司 一种告警关联规则的生成方法、告警压缩方法以及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103326874A (zh) * 2012-03-22 2013-09-25 西门子公司 告警管理系统及方法
CN102928231A (zh) * 2012-11-13 2013-02-13 上海电力学院 一种基于d-s证据理论的设备故障诊断方法
CN104796273A (zh) * 2014-01-20 2015-07-22 中国移动通信集团山西有限公司 一种网络故障根源诊断的方法和装置
US20150280968A1 (en) * 2014-04-01 2015-10-01 Ca, Inc. Identifying alarms for a root cause of a problem in a data processing system
CN105471659A (zh) * 2015-12-25 2016-04-06 华为技术有限公司 一种故障根因分析方法和分析设备

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220166660A1 (en) * 2020-11-23 2022-05-26 Capital One Services, Llc Identifying network issues in a cloud computing environment

Also Published As

Publication number Publication date
US20210014103A1 (en) 2021-01-14
CN109905270B (zh) 2021-09-14
CN109905270A (zh) 2019-06-18

Similar Documents

Publication Publication Date Title
WO2019184557A1 (zh) 定位根因告警的方法、装置和计算机可读存储介质
US8751417B2 (en) Trouble pattern creating program and trouble pattern creating apparatus
US10068176B2 (en) Defect prediction method and apparatus
US10679135B2 (en) Periodicity analysis on heterogeneous logs
US8861691B1 (en) Methods for managing telecommunication service and devices thereof
US11240125B2 (en) System and method for predicting and reducing subscriber churn
US11651375B2 (en) Below-the-line thresholds tuning with machine learning
CN109784636A (zh) 欺诈用户识别方法、装置、计算机设备及存储介质
CN111475680A (zh) 检测异常高密子图的方法、装置、设备及存储介质
CN114465874B (zh) 故障预测方法、装置、电子设备与存储介质
CN110502432B (zh) 智能测试方法、装置、设备及可读存储介质
CN113051308A (zh) 告警信息处理方法、设备、存储介质及装置
CN115544519A (zh) 对计量自动化系统威胁情报进行安全性关联分析的方法
US8543552B2 (en) Detecting statistical variation from unclassified process log
CN113497725A (zh) 告警监控方法、系统、计算机可读存储介质及电子设备
EP4169223A1 (en) Method and apparatus to detect scripted network traffic
CN110582091B (zh) 定位无线质量问题的方法和装置
CN113535458B (zh) 异常误报的处理方法及装置、存储介质、终端
CN112416800B (zh) 智能合约的测试方法、装置、设备及存储介质
US11539730B2 (en) Method, device, and computer program product for abnormality detection
CN114881112A (zh) 一种系统异常检测方法、装置、设备及介质
CN110472680B (zh) 目标分类方法、装置和计算机可读存储介质
KR102470364B1 (ko) 보안 이벤트 학습데이터 생성 방법 및 보안 이벤트 학습데이터 생성 장치
US20230099325A1 (en) Incident management system for enterprise operations and a method to operate the same
CN112560992B (zh) 优化图片分类模型的方法、装置、电子设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19777955

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19777955

Country of ref document: EP

Kind code of ref document: A1