WO2020215505A1 - Multi-dimensional correlation generation method and system for network alarm rules - Google Patents

Abstract

A multi-dimensional correlation generation method and system for network alarm rules, which relate to the field of artificial intelligence and communication, wherein the method comprises: collecting historical alarms and clustering and grouping, and generating an ordered alarm pair comprising a pilot alarm and a subsequent alarm according to the alarms in each group (S1); calculating the correlation strength of each alarm pair, and importing a multi-dimensional correlation model to construct an alarm multi-dimensional correlation model AMCM; each dimension of the AMCM represents one index of the correlation strength (S2); extracting all the alarm pairs, derived from the pilot alarms, of the subsequent alarms from the AMCM, adding them into an alarm pair database to generate a hierarchical directed acyclic graph, and extracting root alarms (S3). The AMCM can accurately and clearly display the correlation strength between each ordered alarm pair, quickly generate effective correlation rules, and then form the alarm pair database, generate the hierarchical directed acyclic graph, and obtain the alarm rules of all the alarms.

Description

Method and system for generating multi-dimensional association of network alarm rules Technical field

The invention relates to the field of artificial intelligence and communication technology, in particular to a method and system for generating network alarm rules in a multi-dimensional association.

Background technique

In the existing communication network, with the increasingly complex mobile communication network topology, a large number of alarms will be generated during the operation of each network type, and it has the characteristics of fast real-time refresh rate. When network equipment generates a large amount of alarm information in an instant, it is difficult to locate the root cause alarm quickly and accurately. In the current increasingly complex network environment, the existing alarm rule analysis and the alarm analysis model based on the expert system are obviously insufficient in handling massive alarms.

The existing network alarm rule association generation method cannot realize the efficient mining of the alarm rule, which results in the inability to quickly and effectively locate the root cause alarm when a network failure occurs, and is not suitable for the subsequent sorting of the alarm rule association.

Summary of the invention

In view of the defects in the prior art, the purpose of the present invention is to provide a method and system for generating a multi-dimensional association of network alarm rules, which can quickly generate effective association rules.

The present invention provides a multi-dimensional association generation method of network alarm rules, which includes the steps:

Collect historical alarms and group them into clusters, and generate an orderly alarm pair including pilot alarms and subsequent alarms according to the alarms in each group;

Calculate the correlation strength of each alarm pair, and import the multi-dimensional correlation model to build the alarm multi-dimensional correlation model AMCM; each dimension of AMCM represents an indicator of the correlation strength;

Extract all the alarm pairs derived from the pilot alarm from the AMCM and add them to the alarm pair database to generate a hierarchical directed acyclic graph and extract the root cause alarm.

On the basis of the above technical solution, the sequence of the alarm pair is determined according to the alarm start time, and when the start time is the same, the sequence is determined according to the sequence of alarm collection.

On the basis of the above technical solution, the indicators of correlation strength include support and antecedent confidence. For any pair of alarms in an alarm group:

Support is the probability that an alarm pair appears in the alarm group to which it belongs;

Antecedent confidence is the ratio of alarm pairs in alarm pairs with the same leading alarm.

On the basis of the above technical solution, the basis for judging that the subsequent alarms in the alarm pair are derived from the pilot alarm is:

Both the support degree and the predecessor confidence degree of the alarm pair are greater than the minimum threshold set by each.

On the basis of the above technical solution, the correlation strength indicator also includes the subsequent confidence, which is the proportion of alarm pairs in the alarm pairs with the same subsequent alarm;

The basis for judging that the subsequent alarms in the alarm pair are derived from the pilot alarms is: the confidence of the antecedent of the alarm pair is greater than the confidence of the subsequent.

On the basis of the above technical solution, the correlation strength indicators also include the antecedent derived strength and the subsequent derived strength. For any pair of alarms in a group, if there is another pair of alarms in reverse order with the same data but in reverse order:

The antecedent derived strength is the ratio of the antecedent confidence of the alarm pair to the antecedent confidence of the reverse alarm pair;

The subsequent derivative strength is the ratio of the subsequent confidence of the alarm pair to the subsequent confidence of the reverse alarm pair.

On the basis of the above technical solution, the basis for judging that the subsequent alarms in the alarm pair are derived from the pilot alarm is:

The antecedent derivative strength of the alarm pair is greater than 1, and the subsequent derivative strength of the alarm pair is less than 1.

On the basis of the above technical solution, collecting historical alarms and performing clustering and grouping includes:

Record the attributes of each historical alarm; attributes include address information and board number, alarm type, alarm start time, alarm end time and alarm serial number;

Perform clustering processing according to the attributes of historical alarms to obtain multiple groups.

On the basis of the above technical solution, when a new alarm is obtained, clustering of the new alarm is performed to obtain the corresponding ordered alarm pair and its correlation strength;

Import the correlation strength of the corresponding alarm pair and update the AMCM, quickly update the generated effective association rules, and update the alarm pair database and directed acyclic graph accordingly; the effective association rules are the alarm pairs derived from the subsequent alarms from the leading alarm;

According to the directed acyclic graph, the root cause alarm and/or derivative alarm of the new alarm are extracted in real time.

The present invention also provides a network alarm rule multi-dimensional association generation system for realizing the above method, which includes:

Data processing module, which is used to collect historical alarms and perform clustering and grouping, and generate an orderly alarm pair including a leading alarm and a subsequent alarm according to the alarms in each group;

Modeling module, which is used to calculate the correlation strength of each alarm pair and import the multi-dimensional correlation model to construct the alarm multi-dimensional correlation model AMCM; each dimension of AMCM represents an indicator of the correlation strength;

The rule mining module is used to extract all the alarm pairs derived from the lead alarm from the subsequent alarms from the AMCM, add it to the alarm pair database, generate a hierarchical directed acyclic graph based on this, and extract the root cause alarm.

Compared with the prior art, the advantages of the present invention are:

(1) The multi-dimensional correlation generation method of network alarm rules of the present invention can accurately and clearly display the correlation strength between each ordered alarm pair through AMCM, and quickly and effectively extract all alarm pairs derived from the pilot alarm for subsequent alarms, that is, rapid generation and effective And then form the alarm pair database, and then generate a hierarchical directed acyclic graph to get all alarm rules.

(2) The multi-dimensional association generation method of network alarm rules of the present invention can quickly and effectively locate the root cause alarm through the hierarchical directed acyclic graph.

Description of the drawings

FIG. 1 is a flowchart of a method for generating a multi-dimensional association of network alarm rules according to Embodiment 1 of the present invention;

Fig. 2 is a flowchart of extracting effective association rules according to Embodiment 3 of the present invention.

Detailed ways

The present invention will be further described in detail below in conjunction with the drawings and embodiments.

Example 1

As shown in Fig. 1, an embodiment of the present invention provides a method for generating a multi-dimensional association of network alarm rules, which includes the following steps:

S1. Collect historical alarms and perform clustering and grouping, and generate an orderly alarm pair including pilot alarms and subsequent alarms according to the alarms in each group;

S2. Calculate the correlation strength of each alarm pair, and import a multi-dimensional correlation model to build an alarm multi-dimension correlation model AMCM (Alarm Multi-dimension Correlation Model); each dimension of AMCM represents an indicator of correlation strength;

S3. Extract all the alarm pairs derived from the lead alarm from the AMCM and add them to the alarm pair database to generate a hierarchical directed acyclic graph and extract the root cause alarm.

Preferably, the sequence of the ordered alarm pair is determined according to the alarm start time, and when the start time is the same, the sequence is determined according to the sequence of alarm collection.

In the embodiment of the present invention, an alarm with an earlier alarm start time in the same group is regarded as a leading alarm a, and an alarm with a later start time is regarded as a subsequent alarm b, that is, an alarm pair a → b is formed, assuming that it is a derived alarm from alarm a b. However, due to the limited accuracy of network equipment, the alarm time can only be accurate to the second, so there will be a large number of alarms generated within the same second. Within the same second, the alarms are arranged according to the order in which they are imported, that is, the first imported alarm is regarded as the leading alarm, and the later imported alarm is regarded as the subsequent alarm.

Therefore, the expression form of the association rule between two alarms in this embodiment is a binary orderly alarm pair X→Y, where the alarm X and the alarm Y are respectively called the leading alarm and the subsequent alarm of the association rule. Assuming that after calculation, it is concluded that alarm X is derived from alarm Y, indicating that the association rule X→Y is a valid association rule; assuming that the conclusion is that alarm X is derived from alarm Y, that is, alarm Y is derived from alarm X, indicating the association rule X→Y Is an invalid association rule. All valid association rules are collectively called alarm rules.

The method in this embodiment can effectively extract all the alarm pairs derived from the pilot alarm in the subsequent alarms, that is, quickly generate effective association rules to form an alarm pair database, and then generate a hierarchical directed acyclic graph based on the alarm pair database , Get all alarm rules.

Example 2

On the basis of Example 1, the indicators of the correlation strength include support and antecedent confidence. For any alarm pair in an alarm group:

The support degree is the probability that an alarm pair appears in the alarm group to which it belongs, and is used to measure whether the alarm pair appears frequently.

The antecedent confidence is the proportion of an alarm pair in the alarm pairs that have the same leading alarm. The higher the antecedent confidence, the greater the correlation between the two alarms of the alarm pair.

For example, the orderly alarm pair a→b generated by the leading alarm a and the subsequent alarm b has the following support:

Among them, N is the total number of all alarm pairs in the alarm group to which alarm a and alarm b belong, and N(a→b) is the total number of alarm pairs a→b appearing in the above alarm group.

The antecedent confidence of the above warning to a→b is:

Among them, N(a) is the total number of alarm pairs where the pilot alarm in the above alarm group is alarm a.

In this embodiment, the basis for judging that the subsequent alarms in the alarm pair are derived from the pilot alarm is:

Both the support degree and the predecessor confidence degree of the alarm pair are greater than the minimum threshold set by each.

The above-mentioned minimum threshold of support and minimum threshold of confidence are to eliminate alarm pairs with a small number of occurrences and false alarm pairs due to data accuracy, so as to avoid generating too many ordered alarm pairs.

According to the observation and analysis of historical alarms, it is found that in the alarm information in the same group, the number of occurrences of root-cause alarms is much less than the number of occurrences of derivative alarms, that is, one root-cause alarm may cause multiple identical derivative alarms. Therefore, when selecting the minimum threshold of support, it needs to be as small as possible within the allowable range of the number of alarm pairs. Assuming that the minimum threshold of support is set to not less than 2%, some alarm pairs related to root alarms may be screened out by the program. Alarm pairs with a minimum confidence threshold of less than 10% are mostly false rules due to data accuracy, so they may not be considered.

As shown in some examples given in Table 1 below, the ordered alarm pair generated in each group of alarms is an association rule with a chain length of 2, chain item 1 is the leading alarm of the ordered alarm pair, and chain item 2 is the subsequent alarm. Experiments have found that setting the minimum support threshold support-min to 1% and the minimum confidence threshold confidence-min to 15% can get better rule mining results when orderly alarm pair filtering, that is, a more reasonable alarm pair .

Table 1

Example 3

On the basis of Embodiment 2, referring to Figure 2, the index of correlation strength also includes the subsequent confidence. For any pair of alarms in an alarm group:

The subsequent confidence is the ratio of the alarm pair in the alarm pairs with the same subsequent alarm. The higher the subsequent confidence, the greater the correlation between the two alarms of the alarm pair.

For example, the orderly alarm pair a→b generated by the leading alarm a and the subsequent alarm b, the subsequent confidence of the alarm pair a→b is:

Among them, N(b) is the total number of alarm pairs whose subsequent alarms in the above alarm group are alarm b.

The basis for judging that the subsequent alarms in an alarm pair are derived from the leading alarms is: the predecessor confidence level of the alarm pair is greater than the subsequent one.

When the support and the confidence of the antecedents of the alarm pair are both greater than the minimum thresholds set respectively, then the antecedent confidence and the confidence of the antecedents of the alarm pair are compared. When the confidence of the current item is greater than the confidence of the subsequent item, the ordered alarm pair may be a valid ordered alarm pair; when the current item confidence is less than the subsequent item confidence, the ordered alarm pair may be an invalid ordered alarm pair .

The above-mentioned correlation strength indicators also include the antecedent-derived intensity and the consequent-derived intensity. For any pair of alarms in a group, if there is another pair of alarms in reverse order with the same data but in the opposite order:

The antecedent derived strength is the ratio of the antecedent confidence of the alarm pair to the antecedent confidence of the inverse alarm pair, and is used to measure the probability of the existence of the alarm pair relative to the inverse alarm pair.

The subsequent derivative strength is the ratio of the subsequent confidence of the alarm pair to the subsequent confidence of the reverse alarm pair, and is also used to measure the probability of the alarm pair relative to the reverse alarm pair.

For the orderly alarm pair a→b generated by alarm a and alarm b and its reverse order alarm pair b→a,

The antecedent derivation intensity of the above warning to a→b is:

Among them, conf(a→b) is the antecedent confidence of the alarm to a→b, and conf(b→a) is the antecedent confidence of the alarm to b→a.

The derivative strength of the above-mentioned warning to a→b is:

Among them, bconf(a→b) is the subsequent confidence level of the alarm to a→b, and bconf(b→a) is the subsequent confidence level of the alarm to b→a.

In this embodiment, the basis for judging that the subsequent alarm in the alarm pair is derived from the pilot alarm is: the antecedent derived intensity of the alarm pair is greater than 1, and the subsequent derived intensity of the alarm pair is less than 1.

Table 2

RULE	SUPPORT	CONF
VP_LOC==>VC_LOC	33.47	80.45
RCONTE==>PK_LOS	13.39	46.59
CONTEX==>PK_LOS	9.89	45.07
PPI_LO ==> PK_LOS	8.86	39.63
CES_PK ==> PK_LOS	7.93	77
RCONTE==>VC_LOC	6.59	22.94
VC_LOC==>PK_LOS	6.39	13.51
RCONTE==>VP_LOC	5.97	20.79
VP_LOC==>PK_LOS	5.66	13.61
VP_LOC ==> RCONTE	5.56	13.37
E1_AIS ==> PK_LOS	5.46	33.76
CONTEX ==> RCONTE	4.94	22.54
RCONTE==>PPI_LO	4.84	16.85
LINK_L==>PK_LOS	3.91	42.22
PPI_LO ==> VC_LOC	3.91	17.51
CONTEX ==> PPI_LOC	3.81	17.37
CONTEX==>VC_LOC	3.6	16.43
CONTEX==>VP_LOC	3.6	16.43
E1_AIS ==> CONTEX	2.99	18.47
E1_AIS ==> RCONTE	2.78	17.2
TEMP_O ==> PK_LOS	2.57	46.3
E1_AIS ==>VC_LOC	2.37	14.65
E1_AIS ==> PPI_LO	2.27	14.01
OOCR ==> PK_LOS	1.96	35.85
E1_AIS ==>VP_LOC	1.75	10.83
CES_PK ==> RCONTE	1.54	15
LINK_L ==> RCONTE	1.54	16.67
LINK_L==>VC_LOC	1.54	16.67
LINK_L==>VP_LOC	1.54	16.67

The antecedent-derived strength and the consequent-derived strength are based on the assumption: alarms cannot be inferred from each other. That is, if there is an alarm pair a→b, there is no alarm pair b→a. If the derived intensity of the antecedent is greater than 1, and the derived intensity of the subsequent is less than 1, then a→b is considered to be more credible than b→a, that is, alarm b is derived from alarm a.

As shown in Table 2 above, when extracting the alarm pair derived from the leading alarm in the subsequent alarm, adding the judgment of the antecedent derived strength and the subsequent derived strength of the alarm pair can greatly reduce the ringing phenomenon in the association rules. , And at the same time, you can delete obvious invalid rules, such as a→a, to get an optimized and simplified alarm pair.

Therefore, in the grouping, when there is an orderly alarm pair a→b generated by alarm a and alarm b, and due to different services, or the coexistence of alarm a and alarm b in the same second, the generated alarm pair b→a, That is, when a→b and b→a coexist, it is impossible to accurately distinguish whether it is an alarm b derived from alarm a or an alarm b derived from alarm a. Then the subsequent confidence, the derived strength of the antecedent and the derived strength of the subsequent article are introduced, and manual judgment is used To distinguish the alarm pair derived from the pilot alarm and the subsequent alarm, and delete the other alarm pair that appears less unreasonable, as shown in Table 3 below, the alarm pairs PPI_LO ==>PK_LOS and CES_PK ==>PK_LOS are valid The orderly warning pair.

table 3

In this embodiment, the indicators of the correlation strength of each alarm pair include support, antecedent confidence, subsequent confidence, antecedent derivation strength, and subsequent derivation strength. According to the calculation formula of the five indicators, the alarm pair correlation strength is completed. Calculate statistics, build AMCM. Each expansion surface of AMCM is an M×M two-dimensional matrix, where M represents the number of alarm categories. Each dimension of AMCM represents an indicator, and each side represents a measurement of an indicator. From each expanded surface of AMCM, an indicator value of the correlation strength of any alarm pair can be accurately obtained, which can intuitively show the comparison of various indicators. result. Search the multi-dimensional space of the correlation model along each dimension, extract effective correlation rules, that is, all alarm pairs derived from the pilot alarm for subsequent alarms, and mark the correlation strength of the alarm pairs to generate the alarm pair database, and through hierarchical directed The acyclic graph shows up.

Example 4

On the basis of embodiment 1, collecting historical alarms and performing clustering in step S1 specifically includes:

Record the attributes of each historical alarm; attributes include address information and board number, alarm type, alarm start time, alarm end time and alarm serial number;

Perform clustering processing according to the attributes of historical alarms to obtain multiple groups.

In the embodiment of the present invention, it is first necessary to obtain a large number of network alarms from the existing communication network, record the attributes of each historical alarm, and then perform online analysis and processing, intelligence retrieval, machine learning, expert system, pattern recognition and many other methods. Historical file splicing, validity check, invalid alarm removal, and effective alarm coding processing, extract effective alarm information, and use artificial intelligence technologies such as data mining and big data analysis to analyze the correlation of alarms, and perform effective alarms based on the principle of information similarity Complete the clustering process to obtain multiple groups with high accuracy.

Among them, the alarm start time and end time of each alarm can be quantified into a coordinate vector, so that the alarms in each group can quickly generate an orderly alarm pair according to the time coordinate. For example, a root cause alarm of LINK_LOS type may derive OSPF alarm (OSPF Alarm) or ISIS alarm (ISIS Alarm).

Example 5

On the basis of Embodiment 1, when a new alarm is obtained, clustering of the new alarm is performed to obtain the corresponding ordered alarm pair and its correlation strength. At this time, the above-mentioned new alarm can be either a pilot alarm or Follow-up warning.

Import the correlation strength of the corresponding alarm pair and update the AMCM, that is, update the M×M two-dimensional matrix of each expanded surface of AMCM, and then quickly update the generated effective association rules, and update the alarm pair database accordingly, and A hierarchical directed acyclic graph is generated for the database through alarms; the effective association rule is the alarm pair derived from the pilot alarm for the subsequent alarm.

According to the directed acyclic graph, the root cause alarms and derivative alarms can be clearly and clearly displayed, and the root cause alarms and/or derivative alarms of new alarms can be extracted in real time, so that in the existing network, the system can automatically and quickly when equipment failure alarms occur Find the alarm pair associated with the new alarm.

When a new alarm is a root cause alarm, its derivative alarm can be quickly determined; when a new alarm is a derivative alarm, its root cause alarm can be quickly determined, and whether there is a derivative alarm of the new alarm is displayed.

In this embodiment, for a new alarm, an indicator of a specific dimension can be calculated according to actual conditions. Assuming that only the confidence and support can be calculated to determine the root cause of the new alarm and/or derived alarms, in order to be able to quickly correlate, there is no need to calculate other correlation strength indicators, so as to quickly update the generated alarm pairs. database.

Example 6

The embodiment of the present invention provides a multi-dimensional association generation system for network alarm rules. The system of this embodiment includes a data processing module, a modeling module, and a rule mining module.

The data processing module is used to collect historical alarms and perform clustering and grouping, and generate an orderly alarm pair including a leading alarm and a subsequent alarm according to the alarms in each group.

The modeling module is used to calculate the correlation strength of each alarm pair and import the multi-dimensional correlation model to construct the alarm multi-dimensional correlation model AMCM. Each dimension of AMCM represents an indicator of the strength of the association. The indicators of the correlation strength of each alarm pair include the degree of support, the confidence of the antecedent, the confidence of the subsequent, the derivative strength of the antecedent, and the derivative strength of the subsequent.

The rule mining module is used to extract all the alarm pairs derived from the lead alarm from the subsequent alarms from the AMCM, add them to the alarm pair database, generate hierarchical directed acyclic graphs based on this, and extract the root cause alarms.

The network alarm rule multi-dimensional association generation system of the embodiment of the present invention is applicable to the above methods, can accurately and clearly display the correlation strength between each ordered alarm pair through AMCM, and effectively extract all the alarm pairs derived from the pilot alarm in subsequent alarms, An alarm pair database is formed, and a hierarchical directed acyclic graph is generated according to the alarm pair database to obtain the alarm rules for all alarms, and at the same time, it can quickly and effectively locate the root cause of the alarm.

The present invention is not limited to the above-mentioned embodiments. For those of ordinary skill in the art, without departing from the principle of the present invention, several improvements and modifications can be made, and these improvements and modifications are also regarded as the protection of the present invention. Within range. The content not described in detail in this specification belongs to the prior art known to those skilled in the art.

Claims (10)

1. A method for generating multi-dimensional associations of network alarm rules is characterized in that it comprises the steps:

   Collect historical alarms and group them into clusters, and generate an orderly alarm pair including pilot alarms and subsequent alarms according to the alarms in each group;

   Calculate the correlation strength of each alarm pair, and import a multi-dimensional correlation model to construct an alarm multi-dimensional correlation model AMCM; each dimension of the AMCM represents an indicator of the correlation strength;

   All the alarm pairs derived from the pilot alarm are extracted from the AMCM, added to the alarm pair database, and a hierarchical directed acyclic graph is generated accordingly, and the root cause alarm is extracted.
2. The method for generating multi-dimensional association of network alarm rules according to claim 1, wherein:

   The sequence of the alarm pair is determined according to the alarm start time, and when the start time is the same, the sequence is determined according to the sequence of alarm collection.
3. The method for generating a multi-dimensional association of network alarm rules according to claim 2, wherein the indicators of the association strength include support and antecedent confidence, and for any pair of alarms in an alarm group:

   The degree of support is the probability that the alarm pair appears in the alarm group to which it belongs;

   The antecedent confidence is the proportion of the alarm pairs in the alarm pairs with the same pilot alarm.
4. The method for generating multi-dimensional association of network alarm rules according to claim 3, wherein the basis for judging that the subsequent alarms in the alarm pair are derived from the pilot alarms is:

   The support degree and the antecedent confidence degree of the alarm pair are both greater than the minimum threshold set respectively.
5. The method for generating a multi-dimensional association of network alarm rules according to claim 3, wherein the indicator of the association strength further includes a subsequent confidence, and the subsequent confidence is that the alarm pair has the same subsequent alarm. The ratio

   The basis for judging that the subsequent alarms in the alarm pair are derived from the pilot alarms is: the predecessor confidence of the alarm pair is greater than the subsequent confidence.
6. The method for generating a multi-dimensional association of network alarm rules according to claim 5, wherein the index of association strength also includes antecedent-derived strength and consequent-derived strength. For any pair of alarms in a group, if there is another A pair of reverse-order alarms with the same data and opposite order:

   The antecedent derivative strength is the ratio of the antecedent confidence of the alarm pair to the antecedent confidence of the reverse alarm pair;

   The subsequent derivative strength is the ratio of the subsequent confidence of the alarm pair to the subsequent confidence of the reverse alarm pair.
7. The method for generating multi-dimensional association of network alarm rules according to claim 6, characterized in that the basis for judging that the subsequent alarms in the alarm pair are derived from the pilot alarm is:

   The antecedent derived intensity of the alarm pair is greater than 1, and the consequent derived intensity of the alarm pair is less than 1.
8. The method for generating multi-dimensional association of network alarm rules according to claim 1, wherein said collecting historical alarms and performing clustering and grouping specifically comprises:

   Record the attributes of each historical alarm; the attributes include address information and board number, alarm type, alarm start time, alarm end time and alarm serial number;

   Perform clustering processing according to the attributes of the historical alarms to obtain multiple groups.
9. The method for generating multi-dimensional associations of network alarm rules according to claim 1, characterized in that: when a new alarm is acquired, clustering of the new alarm is performed to obtain the corresponding ordered alarm pair and its correlation strength;

   Import the correlation strength of the corresponding alarm pair and update the AMCM, quickly update the generated effective association rules, and update the alarm pair database and the directed acyclic graph accordingly; the effective association rule is that subsequent alarms are led by Alarm pair derived from alarm;

   According to the directed acyclic graph, the root cause alarm and/or the derivative alarm of the new alarm are extracted in real time.
10. A network alarm rule multi-dimensional association generation system for implementing the method of claim 1, characterized in that it comprises:

    Data processing module, which is used to collect historical alarms and perform clustering and grouping, and generate an orderly alarm pair including a leading alarm and a subsequent alarm according to the alarms in each group;

    Modeling module, which is used to calculate the correlation strength of each alarm pair and import the multi-dimensional correlation model to construct the alarm multi-dimensional correlation model AMCM; each dimension of the AMCM represents an index of the correlation strength;

    The rule mining module is used to extract all the alarm pairs derived from the leading alarm from the AMCM and add the alarm pair database to generate a hierarchical directed acyclic graph and extract the root cause alarm.

Images