WO2022111659A1 - Warning method, apparatus and device, and storage medium - Google Patents

Abstract

A warning method, apparatus and device, and a storage medium. The method comprises: determining a root warning in the current warning according to a warning type of the current warning and an association rule corresponding to the warning type (110), wherein the association rule is determined according to a frequent pattern tree, and the frequent pattern tree is obtained by scanning historical warnings.

Description

Alarm method, device, equipment and storage medium

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is based on the Chinese patent application with the application number of 202011384572.6 and the filing date of November 30, 2020, and claims the priority of the Chinese patent application. The entire content of the Chinese patent application is incorporated herein by reference.

technical field

The present application relates to the technical field of network operation and maintenance, and in particular, to an alarm method, apparatus, device and storage medium.

Background technique

In a communication network, if an alarm occurs on a communication node, the associated alarms of upstream and downstream can often be derived, and the device will report all alarms to the Element Management System (EMS). Derivative alarms will affect users to locate fault points and occupy a large amount of network bandwidth. At present, in the network element management system, the following two methods are often used to deal with the massive alarms related to the relationship: 1) Filter the alarms according to the prior knowledge such as the alarm rule table and the whitelist, and obtain the root alarm that needs to be uploaded; 2) Extract historical alarms as a sample data set to determine credible alarm association rules, and determine root alarms that need to be uploaded through the alarm association rules. However, prior knowledge such as alarm rule table and whitelist needs to be obtained by experts who are proficient in related services and technologies based on general knowledge and experience. In the face of complex multi-architecture, various device types, and complex alarm types and relationships, it is difficult to Form a priori rules with complete coverage, high accuracy and good dynamic adaptability; while forming alarm correlation rules through historical alarms as sample data sets, it is necessary to scan the sample data sets multiple times, resulting in a large input/output (Input/Output) load, and may generate huge candidate sets at the same time, and the number of candidate sets increases exponentially, which seriously affects the generation efficiency of alarm association rules.

SUMMARY OF THE INVENTION

Embodiments of the present application provide an alarm method, apparatus, device, and storage medium.

An embodiment of the present application provides an alarm method, including: determining a root alarm in the current alarm according to an alarm type of a current alarm and an association rule corresponding to the alarm type; wherein the association rule is based on a frequent pattern tree It is determined that the frequent pattern tree is obtained by scanning historical alarms.

An embodiment of the present application provides an alarm device, including: a root alarm determination module configured to determine a root alarm in the current alarm according to an alarm type of the current alarm and an association rule corresponding to the alarm type; wherein, the The association rules are determined according to a frequent pattern tree obtained by scanning historical alarms.

An embodiment of the present application provides an alarm device, including: one or more processors; a storage device configured to store one or more programs; when the one or more programs are executed by the one or more processors , so that the one or more processors implement the above-mentioned alarm method.

Embodiments of the present application further provide a storage medium for computer-executable instructions, where the computer-executable instructions are used to execute the above-mentioned alarm method when executed by a computer processor.

With regard to the above embodiments and other aspects of the present application, as well as implementations thereof, further explanation is provided in the Brief Description of the Drawings, the Detailed Description and the Claims.

Description of drawings

FIG. 1 is a flowchart of an alarm method provided by an embodiment;

FIG. 2 is a flowchart of another alarm method provided by an embodiment;

3 is an exemplary flowchart of generating a data set according to a time sequence of historical alarms and feature items extracted from historical alarms provided by an embodiment;

4 is an exemplary flowchart of a method for determining a first frequent itemset provided by an embodiment;

5 is an exemplary flowchart of a method for constructing a frequent pattern tree provided by an embodiment;

6 is an exemplary diagram of a structure of a frequent pattern tree provided by an embodiment;

7 is an exemplary flowchart of a method for determining a maximum frequent itemset corresponding to a feature item in an item header table according to an embodiment;

8 is an exemplary flowchart of a method for determining a target association rule provided by an embodiment;

FIG. 9 is a schematic structural diagram of an alarm device according to an embodiment;

FIG. 10 is a schematic structural diagram of an alarm device according to an embodiment.

Detailed ways

The present application will be described below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, but not to limit the present application. It should be noted that, in the case of no conflict, the features in the embodiments of the present application may be combined with each other arbitrarily. In addition, it should be noted that, for the convenience of description, the drawings only show some but not all the structures related to the present application.

In the operation and maintenance work of the existing communication network, for the alarms that need to be reported to the network element management system EMS, the alarm rule table and whitelist generated based on prior knowledge are often used to filter the alarms, or the association rule algorithm APRIORI is used to select the alarms from history. The association rules are mined in the alarms to filter the above-mentioned alarms, so as to remove the derivative alarms in the above-mentioned alarms, and then determine the root alarm sent by the faulty communication node, so as to reduce the workload of operation and maintenance. However, since the alarm rule table and whitelist depend on the generation of prior knowledge, in the face of complex multi-architecture, diverse device types, and complex alarm types and relationships, the screening rules generated by livable prior knowledge are difficult to deal with, and rely on The rules generated by prior knowledge have narrow coverage and low accuracy, and it is difficult to dynamically adapt to changes according to different application environments; while the APRIORI algorithm is used to determine the association rules, it is necessary to scan the data set generated according to historical alarms for many times, and A huge number of candidate sets will be generated, and the number of candidate sets will increase exponentially with the size of the data set, which will generate a large load and cause a large waste of resources, which will increase the amount of data to be processed for operation and maintenance work. It is difficult to reduce the complexity of alarm operation and maintenance. In the alarm method of this embodiment, the root alarm in the current alarm is determined through the association rule corresponding to the alarm type of the current alarm determined according to the frequent pattern tree, which improves the accuracy of determining the root alarm and reduces the alarm at the same time. Resource requirements and complexity of operations work.

FIG. 1 is a flowchart of an alarm method provided by an embodiment. As shown in FIG. 1 , the alarm method provided by this embodiment includes step 110 .

In step 110, the root alarm in the current alarm is determined according to the alarm type of the current alarm and the association rule corresponding to the alarm type.

The association rules are determined according to the frequent pattern tree, and the frequent pattern tree is obtained by scanning historical alarms.

In one embodiment, the current alarm can be understood as multiple pieces of alarm information uploaded by the device to the network element management system EMS, and the current alarm includes the alarm of the faulty node in the communication network, and the upstream and downstream alarms derived from the above-mentioned alarms. Correlation alarms, wherein the alarms of the faulty node can be understood as the root alarms in the current alarms, and the upstream and downstream associated alarms derived from the root alarms can be understood as the derived alarms in the current alarms. The alarm type can be understood as the type of fault in the alarm. In some examples, the alarm type can be signal loss, output optical power exceeding the limit, laser bias current too small, module internal temperature exceeding the limit, input optical power exceeding the limit and tunnel. Maintenance point connectivity loss, etc. Association rules can be understood as an implication in the form of X→Y, where X can be called the predecessor (Antecedent or left-hand-side, LHS) of the association rule, and Y can be called the successor (Consequent or right of the association rule). -hand-side, RHS), the association relationship is used to represent the causal relationship between X and Y, that is, for the association relationship with high support and trust, Y is more likely to appear when X appears. Frequent Pattern Tree (FP-Tree) can be understood as a data structure that compresses the database that provides frequent itemsets according to the association analysis algorithm (FP-Growth) and retains the association information between itemsets. The tree consists of a root node (value is null), a frequent item header table and multiple descendant nodes. History Alarm can be understood as the alarm that occurred before the current alarm, and the historical alarm can be saved in the historical alarm database for statistical query.

In this embodiment, the current alarm containing multiple pieces of alarm information sent by the device at the current moment is obtained, and according to the alarm type corresponding to each alarm information in the current alarm, the association rule corresponding to the alarm type is obtained from the association rule base, and then The alarm type corresponding to the fault scenario in the current alarm is determined through the association rule, and the alarm information with the alarm type is determined as the root alarm in the current alarm. Among them, the attribute features can be extracted by scanning historical alarms and a data set can be constructed, a frequent pattern tree can be constructed according to the frequent item sets in the data set, and the association rules corresponding to each alarm type can be determined by the correlation information between the sets of the frequent pattern tree. .

In the embodiment of the present application, since the association rules are obtained by mining the association information among the item sets in the frequent pattern tree, only two scans of historical alarms are required when constructing the frequent pattern tree, thus reducing the generation of association rules. required data load. At the same time, since the root alarm in the current alarm is determined through the association rule corresponding to the alarm type of each alarm information in the current alarm, only the determined root alarm is sent to the network element management system EMS via the Northbound Interface (NBI) ) to the Network Management System (NMS), which reduces the data traffic of the northbound interface, enables the NMS to perform more accurate fault diagnosis on the faulty node that generates the alarm, and improves the simplicity of alarm operation and maintenance. and accuracy.

In the alarm method provided by this embodiment, the root alarm in the current alarm is determined according to the alarm type of the current alarm and the association rule corresponding to the alarm type; wherein, the association rule is determined according to the frequent pattern tree, and the Frequent pattern trees are obtained by scanning historical alarms. The frequent pattern tree is constructed by scanning historical alarms, the association rules corresponding to the alarm types are determined according to the frequent pattern tree structure, and the root alarms in the current alarms are determined according to the association rules corresponding to the alarm types of the current alarms, so that the current alarms Derivative alarms that affect fault location can be filtered, and only the root alarms determined are uploaded. At the same time, it solves the problem that the construction of alarm correlation rules depends on prior knowledge and requires multiple scanning of historical alarms, and improves the accuracy, reliability and dynamic adaptability of the generated correlation rules for determining the root alarm correlation rules in current alarms , which reduces the amount of data required to generate association rules and reduces the complexity of alarm operation and maintenance.

FIG. 2 is a flowchart of another alarm method provided by an embodiment. As shown in FIG. 2 , the method includes steps 210 to 260 .

In step 210, historical alarms within a preset time are acquired, and a data set is generated according to the time sequence of the historical alarms and the feature items extracted from the historical alarms.

The feature item includes attribute features extracted from historical alarms.

In one embodiment, the feature item can be understood as alarm information determined according to the attribute feature extracted from the historical alarm, the attribute feature includes the system ID and the alarm type, and the feature item, the alarm type and the system ID have a corresponding relationship.

In this embodiment, when the association rule is generated, the historical alarms corresponding to the preset time are obtained from the historical alarm database, and the obtained historical alarms are arranged in chronological order. Since there is an association relationship between adjacent historical alarms The possibility is high, so the historical alarms can be grouped according to the time sequence, so that the same group contains only one root alarm and the derivative alarms corresponding to the root alarm as much as possible, and at the same time attribute the historical alarms in each group after the grouping. Feature extraction, determine the historical alarms with different system IDs and alarm types in each group, and determine the above-mentioned historical alarms with different system IDs and alarm types as the feature items corresponding to the group, and then according to the grouping and the corresponding Feature items generate datasets for association rule determination.

In one embodiment, the number of historical alarms used to generate the frequent pattern tree can be adjusted by adjusting the size of the preset time, and then the complexity of the frequent pattern tree can be adjusted by adjusting the size of the preset time. The size may be determined according to the actual situation, which is not limited in this embodiment of the present application.

FIG. 3 is an exemplary flowchart of generating a data set according to a time sequence of historical alarms and feature items extracted from historical alarms provided by an embodiment, as shown in FIG. 3 , which specifically includes the following steps:

Step 2101: Divide the historical alarms into at least two alarm sets in a chronological order at a preset time interval.

In one embodiment, an alarm set may be understood as a set of historical alarms within a preset time interval, and each alarm in the same alarm set is likely to have an associated relationship, that is, the same alarm set.

In this embodiment, the acquired historical alarms are arranged in chronological order from first to last, starting from the historical alarm with the first chronological order and backward, grouping the historical alarms at preset time intervals, and grouping the historical alarms belonging to the same It is assumed that the collection of historical alarms within the time interval is determined as an alarm set. In some examples, assuming that the time corresponding to the historical alarm with the first time sequence is 16:31:00 and the preset time interval is one minute, the alarm time is set to be within the range of 16:31:00-16:31:59. The historical alarms are determined as one alarm set, and further, the historical alarms within 16:32:00-16:32:59 are determined as another alarm set.

In some examples, when determining the preset time interval, the congestion situation of the network in the network element management system EMS and the alarm receiving and processing mechanism of the network element management system EMS can be comprehensively considered, and it can be determined from the triggering of the associated alarm on the device to The network element management system EMS receives the processing interval, and determines the above interval as the preset time interval. If it is considered that there is a correlation between the two alarms, the above two alarms should be respectively sent by the device to the network element within the preset time interval. In the management system EMS. The specific set value of the preset time interval is not limited in this embodiment of the present application.

Step 2102: Perform attribute feature extraction on each alarm set, and determine the feature item corresponding to each alarm set according to the alarm type in the extracted attribute feature.

In this embodiment, attribute feature extraction is performed on the historical alarms in each alarm set to determine the alarm type corresponding to each historical alarm in the alarm set, and then several types of alarms that appear in each alarm set are determined. The alarm type determines the corresponding feature item in the alarm set.

In some examples, the alarm type may further include system type information. For more concise and intuitive expression, it may be mapped by the alarm key value, and the corresponding feature item in the alarm set may be represented by the alarm key value. Table 1 below is an alarm key-value mapping table provided by an embodiment, as shown in Table 1 below:

Table 1

system type	Alert Type	Alarm key value (Item)
OTN	signal loss	I1
OTN	The output optical power exceeds the limit	I2

OTN	Laser bias current is too small	I3
OTN	The internal temperature of the module exceeds the limit	I4
OTN	The input optical power exceeds the limit	I5
PTN	Tunnel maintenance point connectivity lost	I6

That is, if there are two alarm types of input optical power exceeding limit and output optical power exceeding limit in an alarm set, the characteristic items and representations corresponding to the alarm set are I2 and I5.

Step 2103: Generate a data set according to each alarm set and feature items corresponding to each alarm set.

In some examples, if the acquired historical alarm is between 16:31:00-18:15:59, the preset time interval is one minute, the alarm set has been determined according to the preset time interval, and it is determined that each alarm set contains corresponding feature items. Table 2 below is an example of a data set provided by an embodiment, as shown in Table 2 below:

Table 2

Tid	Time		Items
1	16:31:00-16:31:59	I1,I2,I5
2	16:32:00-16:32:59	I2,I4
3	16:33:00-16:33:59	I2,I3
4	16:34:00-16:34:59	I1,I2,I4
5	16:35:00-16:35:59	I1,I3
6	16:36:00-16:36:59	I2,I3
7	16:37:00-16:37:59	I1,I3
8	16:38:00-16:38:59	I1,I2,I3,I5
9	16:39:00-16:39:59	I1,I2,I3
10	18:14:00-18:14:59	I6

Step 220: Scan the data set, and count the occurrences of the feature items in the data set to determine the first frequent item set.

In one embodiment, an itemset can be understood as a set of several items; a frequent itemset can be understood as a set of items whose support is greater than or equal to the minimum support. The support degree can be understood as the support degree, and in the association analysis of data mining, it can represent the frequency of the former item and the latter item appearing in a data set at the same time.

In this embodiment, the data set is scanned, and the number of occurrences of each feature item appearing in the data set is counted. Since the same feature item can only appear once in the same alarm set, the frequency of occurrence of each feature item and the alarm set are calculated according to the number of occurrences of each feature item. The number determines the support degree of each feature item in the data set, and the set of feature items whose support degree satisfies the minimum support degree judgment condition is determined as the first frequent item set.

FIG. 4 is an exemplary flowchart of a method for determining a first frequent itemset provided by an embodiment, as shown in FIG. 4 , which specifically includes the following steps:

Step 2201: Scan the data set, and count the occurrences of the feature items corresponding to each alarm type.

In some examples, the data set shown in Table 2 is scanned, and the number of occurrences of the feature items corresponding to each alarm type is counted. Taking the feature item I2 as an example, the number of occurrences in the data set is 7 times. , then the number of occurrences of the feature item I2 can be recorded as 7.

Step 2202: Determine the support degree of the feature item corresponding to each alarm type according to the occurrence times and the number of alarm sets.

In this embodiment, since the feature items corresponding to the same alarm type appear only once in the same alarm set, the maximum number of times the feature items corresponding to each alarm type appear in the data set is the number of alarm sets. The ratio of the number of occurrences of the feature item to the number of alarm sets is determined as the support degree of the feature item corresponding to each alarm type.

In one embodiment, it is assumed that the frequency of the itemset X∪Y in the data set is σ(X∪Y), that is, the number of times X and Y appear simultaneously in the data set is σ(X∪Y), and T is the data set. The number of groups, then the support of the itemset X∪Y in the dataset can be expressed as:

Support(X→Y)=σ(X∪Y)/T

In some examples, taking the data set shown in Table 2 as an example, where the number of occurrences of the feature item I2 is 7 and the number of alarm sets is 10, the support degree of the feature item I2 can be expressed as Support(I2)=7 /10=70%.

Step 2203: Determine the set of feature items corresponding to the alarm types with each support greater than or equal to the preset support threshold as the first frequent item set.

In this embodiment, when the support degree of the characteristic item corresponding to the alarm type is greater than or equal to the preset support degree threshold, it can be considered that the characteristic item has a high probability of the alarm type appearing in all alarm sets, and belongs to the frequently-occurring item , there is a high possibility of an association relationship. Determine all the feature items with the support degree greater than or equal to the preset support degree threshold among the feature items corresponding to each alarm type, and determine the set of the above-mentioned feature items as the first frequent item set, and each feature in the first frequent item set It can be considered that there is an association relationship between items, and it can be used to build a frequent pattern tree to mine the association relationship. In some examples, the preset support threshold may be set to 20%, which is not limited in this embodiment of the present application.

In some examples, the first frequent itemset is determined for the data set shown in Table 2. Table 3 below is an example of a first frequent itemset that satisfies the minimum support threshold provided by an embodiment, as shown in the following table 3 shows:

table 3

I1	I2	I3	I4	I5
6	7	6	2	2

Step 230: Scan the data set again, and construct a frequent pattern tree according to the item header table generated by the first frequent itemset.

In one embodiment, the item header table can be understood as including all the feature items in the frequent pattern tree, and the feature items in the frequent pattern tree are sorted according to the support degree, and the feature item set of the frequent pattern tree is constructed according to the support degree.

In this embodiment, according to the support degrees corresponding to each feature item in the first frequent item set, the feature items are sorted in descending order of support degree to generate an item header table, the data set is scanned again, and the alarm set is sorted according to the features contained in it. The sorting of items in the item header table is rearranged again, and the rearranged alarm sets are inserted into the frequent pattern tree with null as the root node in turn to complete the construction of the frequent pattern tree. Among them, in the process of inserting each alarm set into the frequent pattern tree, the feature items with high support in the alarm set are preferentially inserted, that is, the feature items with high support are regarded as ancestor nodes, and other feature items are inserted in sequence according to the order of support as descendant node.

FIG. 5 is an exemplary flowchart of a method for constructing a frequent pattern tree provided by an embodiment, as shown in FIG. 5 , which specifically includes the following steps:

Step 2301: Arrange the feature items in the first frequent item set in descending order of support to generate an item header table, and delete the feature items in each alarm set that are not included in the first frequent item set to obtain an adjusted alarm set.

In this embodiment, the feature items in the first frequent item set are sorted according to the support degree, and the feature items are put into the list in order of the support degree from high to low to generate the item header table. Since they are not included in the first frequent item The feature items in the set will not be used to generate the frequent pattern tree, so the generated data set is scanned again, and the feature items that are not included in the first frequent item set in each alarm set in the data set are deleted. According to the arrangement order of the feature items in the middle, the alarm set is adjusted and rearranged, so that the alarm set containing the feature items with high support is adjusted to the front position in the arrangement order.

In some examples, Table 4 is an example of an item header table provided by an embodiment, as shown in Table 4 below:

Table 4

Item	Head
I2	7
I1	6
I3	6
I4	2
I5	2

Table 5 below is an example of an adjusted alarm set provided by an embodiment, as shown in Table 5 below:

table 5

Tid	Time		Items
1	16:31:00-16:31:59	I1,I2,I5
2	16:32:00-16:32:59	I2,I4
3	16:33:00-16:33:59	I2,I3
4	16:34:00-16:34:59	I1,I2,I4
6	16:36:00-16:36:59	I2,I3
8	16:38:00-16:38:59	I1,I2,I3,I5
9	16:39:00-16:39:59	I1,I2,I3
5	16:35:00-16:35:59	I1,I3
7	16:37:00-16:37:59	I1,I3

Since the feature item I2 has the highest support degree, the order of the alarm set including the feature item I2 is adjusted to the first position.

Step 2302: Construct a frequent pattern tree according to the feature items in the adjusted alarm set and the item header table.

The feature items in the same alarm set are located in the same branch in the frequent pattern tree, and the feature items in the same alarm set are inserted into the frequent pattern tree in descending order of support.

In this embodiment, there is no data in the initially constructed frequent pattern tree. First, an empty root node null is established in the frequent pattern tree, and null is used as the ancestor node, and then the adjusted alarm set is read in the sorted order, and the Insert into the frequent pattern tree, so that the feature items in the same alarm set are inserted into the same branch in the frequent pattern tree. At the same time, when inserting the feature items in an alarm set, the feature items are inserted in sequence according to the descending order of support, and the order will be sorted. The node corresponding to the front feature item is the second-level node under the ancestor node, and the node corresponding to the back feature item is the descendant node. If there is a common superior node, the count of the corresponding common superior node is incremented by one, and after insertion, if a new node appears, the corresponding node will be linked to the new node through the node linked list according to the item header table, until After all feature items in the alarm set are inserted into the frequent pattern tree, the construction of the frequent pattern tree is considered complete. Among them, there may be multiple parallel second-level nodes under the ancestor node. In some examples, if the item header table shows A(5), B(4), C(2), where AB appears 0 times, AC If it appears once and BC appears once, the root node null is used as the ancestor node, A and B are both second-level nodes, and C is a third-level node. In some examples, taking the data set shown in Table 2 as an example, FIG. 6 is an example diagram of a structure of a frequent pattern tree provided by an embodiment.

Step 240: Determine the conditional pattern base corresponding to the feature item in the item header table according to the frequent pattern tree, and determine the maximum frequent item set corresponding to the feature item according to the conditional pattern base.

In one embodiment, the conditional pattern base can be understood as a set of paths in the frequent pattern tree ending with the search item, that is, all content between the search item and the root node of the frequent pattern tree. The maximum frequent itemset can be understood as the frequent itemsets that meet the condition of no superset in multiple frequent itemsets, that is, the frequent itemsets that contain the most qualified feature items. A superset can be understood as if every element in a set S2 is in the set S1, and the combination S1 may contain elements that are not in S2, then S1 is a superset of S2.

In this embodiment, the bottom items of the item header table are dug up sequentially, that is, starting from the feature item located at the bottom of the item header table, each feature item in the item header table is sequentially used as the search item to determine the conditional pattern base. According to the determined support degree corresponding to each node in the conditional pattern base, reconstruct the data set corresponding to the search item, and determine a plurality of frequent item sets ending with the search item according to the data set, and select each frequent item set. The frequent itemset containing the most feature items is used as the maximum frequent itemset corresponding to the search item, and in the same way, the maximum frequent itemset corresponding to each feature item in the item header table can be obtained.

FIG. 7 is an exemplary flowchart of a method for determining a maximum frequent itemset corresponding to a feature item in an item header table provided by an embodiment. As shown in FIG. 7 , the method specifically includes the following steps:

Step 2401: Determine the node chain in the frequent pattern tree that ends with the feature item in the item header table.

In some examples, taking the bottom item I5 in the item header table in the frequent pattern tree shown in FIG. 6 as an example, there are two node chains ending with I5 in the frequent pattern tree, which are <(I2:7) ,(I1:4),(I3:2),(I5:1)> and <(I2:7),(I1:4),(I5:1)>.

Step 2402: Determine the support degree of each node in the node chain, update the support degree of the feature item corresponding to each node, and determine the combination of the feature item corresponding to the node chain as the conditional pattern base corresponding to the feature item in the item header table. .

Following the above example, scan and update the node support in the node chain ending with the bottom item I5, it can be determined that the conditional pattern base of the corresponding I5 node is <(I2:1), (I1:1), (I3: 1),(I5:1)> and <(I2:1),(I1:1),(I5:1)>.

Step 2403: Generate a second data set according to the conditional pattern base, and determine the maximum frequent item set corresponding to the feature item in the item header table according to the support degree of each feature item in the second data set.

Following the above example, each conditional pattern base corresponding to I5 is used as a new alarm set to generate a second data set, that is, each row in the second data set stores a feature item corresponding to an I5 conditional pattern base, and then generates a second data set corresponding to the conditional pattern base of I5. Set the corresponding item header table, and construct the frequent pattern subtree corresponding to the feature item I5. Since the feature item I3 only appears once in the second data set, its support degree is less than the preset support degree threshold. Therefore, it can be obtained with I5 as the end The frequent itemsets are (I5:2), (I1, I5:2), (I2, I5:2), (I1, I2, I5:2), since the itemsets (I1, I2, I5:2) are All frequent itemsets meet the frequent itemsets without superset condition, so the itemsets (I1, I2, I5:2) are determined as the maximum frequent itemsets corresponding to the feature item I5.

If the frequent pattern subtree corresponding to the feature item I5 is single-branched, there is no need to recurse the subtree, and the set of feature items corresponding to the I5 conditional pattern base can be directly determined as the maximum frequent item set corresponding to the feature item I5.

Step 250: Determine the target association rule corresponding to the feature item according to the maximum frequent item set, the data set and the preset reliability threshold, and store the target association rule in the association rule base.

In one embodiment, the confidence level can be understood as the degree of credibility of the association relationship, that is, the probability of the occurrence of event Y based on the occurrence of event X, indicating the strength of the association or the reliability of the rule, that is, both X and Y are included. % of transactions that contain X. Assuming that the frequency of the itemset X∪Y in the data set is σ(X∪Y), and the frequency of the itemset X in the data set is σ(X), then the confidence that the itemset X∪Y occurs on the basis of the itemset X is Degree can be expressed as:

Conf(X→Y)=σ(X∪Y)/σ(X)

In this embodiment, recursive splitting is performed on the maximum frequent itemset, multiple association rules are generated, the confidence level of each association rule in the data set is determined, and the confidence level is compared with the preset confidence level threshold, and the confidence level is considered as the confidence level. The association rules greater than the preset reliability threshold are credible, that is, strong association rules, the determined association rules are determined as the target association rules corresponding to the feature items, and the target association rules are stored in the association rule database for Provides root alert determination.

FIG. 8 is an exemplary flowchart of a method for determining a target association rule provided by an embodiment, as shown in FIG. 8 , which specifically includes the following steps:

Step 2501: Recursively split the maximum frequent itemset to obtain a first itemset and a second itemset, where the second itemset is the complement of the first itemset to the maximum frequent itemset.

In this embodiment, the first item set and the second item set are obtained by recursively splitting the largest frequent item set, in order to determine the causal relationship between the corresponding feature items in the first item set and the second item set, that is, The relationship between the feature items in the first item set and the feature items in the second item set can be called the relationship between the feature items in the first item set and the feature items in the second item set. connection relation.

In some examples, taking the largest frequent itemset (I1, I2, I5:2) corresponding to the feature item I5 as an example, the association rules that can be split out may include: (I2, I1, I5→{}), ( I2,I1→I5), (I1→I2,I5), (I2,I5→I1), (I2→I1,I5), (I1,I5→I2), and (I5→I2,I1). Taking (I5→I2, I1) as an example, the correlation can be expressed as I2 and I1 will appear when I5 appears, that is, there is a causal relationship between I5 and I2 and I1, and I2 and I1 are derived alarms of I5.

Step 2502: According to the maximum frequent itemset, the first item set and the data set, determine the first number of times that the maximum frequent itemset belongs to the same alarm set in the data set, and the second time that the first item set belongs to the same alarm set in the data set. frequency.

In an embodiment, the first number of times can be understood as the number of times that the alarms corresponding to the feature items in the maximum frequent item set occur simultaneously in one alarm set, that is, there are several alarm sets in the data set that have feature items in the maximum frequent item set at the same time. ; The second number of times can be understood as the number of times that the alarms corresponding to the feature items in the first item set appear simultaneously in an alarm set, that is, there are several alarm sets in the data set that have the feature items in the first item set at the same time.

In some examples, taking the dataset shown in Table 2 as an example, the first number of times corresponding to the association rule (I5→I2, I1) is the number of times the feature item combinations I1, I2 and I5 appear in the dataset, and also That is, the first time is 2, and the second time is the number of times the feature item I5 appears in the data set, that is, the second time is 2.

Step 2503: When the ratio of the first time to the second time is greater than or equal to the preset reliability threshold, determine the causal relationship between the feature item corresponding to the first item set and the feature item corresponding to the second item set. is the target association rule of the corresponding feature item in the first item set.

In this embodiment, the ratio of the first count to the second count can be understood as the confidence level of the association rule formed by the first item set and the second item set. When the above confidence level is greater than or equal to the preset confidence threshold , it can be considered that the causal relationship corresponding to the above-mentioned association rules is strong, and belongs to strong association rules, which can be stored and applied as the target association rules of the corresponding feature items in the first item set.

Following the above example, for the association rule (I5→I2, I1), its confidence=first time/second time=1, when the preset reliability threshold is 80%, the association rule is a strong association rule, so It can be used as the target association rule corresponding to the feature item I5. For the association rule (I2, I1→I5), the corresponding first time is the number of times the feature item combination I1, I2 and I5 appear in the data set, that is, the first time is 2, and the second time is the feature item. The number of times I2 and I1 appear simultaneously in the alarm set, that is, the second time is 4, then the confidence of the above association rule is 50%, which is less than the preset confidence threshold, so the above association rule cannot be used as the target corresponding to the feature items I2 and I1 Association rules.

In some examples, when storing the target association rule into the association rule base, it includes:

If the target association rule is not included in the association rule base, the target association rule is stored in the association rule base.

When the target association rule is included in the association rule base and is a subset of the association rule to be updated in the association rule base, the target association rule is not stored in the association rule base.

When the target association rule is included in the association rule base and is a superset of the association rule to be updated in the association rule base, the to-be-updated association rule is replaced with the target association rule.

The association rule to be updated is an association rule corresponding to the target association rule in the association rule base.

In some examples, if the target association rule is (I5→I2, I1), and the association rule to be updated corresponding to the target association rule in the association rule base is (I5→I2), the target association rule is considered to be the association rule to be updated At this time, the target association rule is not stored in the association rule base; and when the association rule to be updated is (I5→I2, I1, I3), the target association rule is considered to be the superset of the association rule to be updated. At this time, the target association rule to be updated is replaced by the association rule to be updated, and stored in the association rule base.

Step 260: Determine the root alarm in the current alarm according to the alarm type of the current alarm and the association rule corresponding to the alarm type.

In the alarm method provided in this embodiment, the data set generated by the historical alarms is scanned twice, and the alarm sets divided according to preset time intervals in the data set are compressed and stored in the frequent pattern tree in descending order according to the support degree. In the process of relationship mining, there is no need to scan the data set again, which reduces the data load in the process of determining the association rules. At the same time, because the division of the alarm set can be dynamically adjusted according to the preset time interval, the alarm density and the alarm intensity in the alarm set can be adjusted. The number of alarm sets is adjusted to control the flourishing degree of frequent pattern tree generation, optimize the mining efficiency of association rules, and better adapt to performance problems in systems with large data volumes. When mining association rules, only the largest frequent itemset corresponding to the feature item is considered, and the number of words corresponding to the feature item is no longer recursively traversed, which improves the efficiency of association rule determination. The generated association rule is used to determine the root alarm of the current alarm, which improves the reliability of the determination of the root alarm and reduces the complexity of alarm operation and maintenance.

This embodiment also provides an alarm device. FIG. 9 is a schematic structural diagram of an alarm device according to an embodiment. As shown in FIG. 9 , the alarm device includes: a root alarm determination module 310 .

The root alarm determining module 310 is configured to determine the root alarm in the current alarm according to the alarm type of the current alarm and the association rule corresponding to the alarm type;

Wherein, the association rule is determined according to a frequent pattern tree, and the frequent pattern tree is obtained by scanning historical alarms.

In the alarm device of this embodiment, a frequent pattern tree is constructed by scanning historical alarms, an association rule corresponding to an alarm type is determined according to the frequent pattern tree structure, and a root alarm in the current alarm is detected according to the association rule corresponding to the alarm type of the current alarm. By determining, the derivative alarms affecting the fault point location in the current alarms can be filtered, and only the determined root alarms are uploaded, which reduces the amount of data required for the generation of association rules and reduces the complexity of alarm operation and maintenance.

In one embodiment, it also includes:

The association rule determination module is configured to generate a frequent pattern tree according to historical alarms, and determine an association rule according to the frequent pattern tree.

In one embodiment, the association rule determination module includes:

A data set generating unit, configured to obtain historical alarms within a preset time, and generate a data set according to the time sequence of the historical alarms and the feature items extracted from the historical alarms; wherein the feature items include the Attribute features extracted from historical alarms.

The first frequent itemset determining unit is configured to scan the data set and count the occurrences of the feature items in the data set to determine the first frequent itemset.

The frequent pattern tree construction unit is configured to scan the data set again, and construct a frequent pattern tree according to the item header table generated by the first frequent item set.

The maximum frequent itemset determining unit is configured to determine the conditional pattern base corresponding to the feature item in the item header table according to the frequent pattern tree, and determine the maximum frequent itemset corresponding to the feature item according to the conditional pattern base.

An association rule determination unit, configured to determine a target association rule corresponding to the feature item according to the maximum frequent item set, the data set and a preset reliability threshold, and store the target association rule into an association rule in the library.

In one embodiment, the data set generating unit is specifically configured to divide the historical alarms into at least two alarm sets in chronological order and at preset time intervals; perform attribute feature extraction on each of the alarm sets, and extract the alarm set according to the extracted data. The alarm type in the attribute feature of the attribute determines the feature item corresponding to each alarm set; a data set is generated according to each alarm set and the feature item corresponding to each alarm set. Wherein, the alarm types include at least two types.

In one embodiment, the first frequent item set determining unit is specifically configured to scan the data set, and count the occurrences of the feature items corresponding to each of the alarm types; The number of sets determines the support degree of the feature item corresponding to each alarm type; the set of feature items corresponding to each alarm type whose support degree is greater than or equal to the preset support degree threshold is determined as the first frequent item set.

In one embodiment, the frequent pattern tree construction unit is specifically configured to arrange the feature items in the first frequent item set in descending order of support to generate an item header table, and not include each of the alarm sets in the first frequent item set. The feature items in the frequent item set are deleted to obtain an adjusted alarm set; a frequent pattern tree is constructed according to the feature items in the adjusted alarm set and the item header table; wherein, the feature items in the same alarm set are located in the frequent The same branch in the pattern tree, and the feature items in the same alarm set are inserted into the frequent pattern tree in descending order of support, and the feature item with the highest support is the ancestor node.

In one embodiment, the maximum frequent itemset determination unit is specifically set to determine the node chain in the frequent pattern tree that ends with the feature item in the item header table; determine the support degree of each node in the node chain, and update the support degree of the feature items corresponding to each of the nodes, and determine the combination of the feature items corresponding to the node chain as the conditional pattern base corresponding to the feature item in the item header table; according to the conditional pattern base A second data set is generated, and the maximum frequent itemset corresponding to the feature items in the item header table is determined according to the support degree of each feature item in the second data set.

In one embodiment, the association rule determination unit is specifically set to recursively split the maximum frequent itemset to obtain a first itemset and a second itemset, and the second itemset is the first itemset With respect to the complement of the maximum frequent itemset; according to the maximum frequent itemset, the first item set and the data set, determine that the maximum frequent itemset belongs to the first item of the same alarm set in the data set. The number of times, and the second times that the first item set belongs to the same alarm set in the data set; the ratio of the first times to the second times is greater than or equal to the preset reliability threshold In the case of , the causal relationship between the feature item corresponding to the first item set and the feature item corresponding to the second item set is determined as the target association rule of the feature item corresponding to the first item set. If the target association rule is not included in the association rule base, store the target association rule in the association rule base; if the target association rule is included in the association rule base, and is the In the case of a subset of the association rules to be updated in the association rule base, the target association rules are not stored in the association rule base; in the case where the target association rules are included in the association rule base, and are all In the case of a superset of the association rules to be updated in the association rule base, the association rules to be updated are replaced with the target association rules; wherein the association rules to be updated are the association rules in the association rule base that are the same as the target association rules. The association rule corresponding to the association rule.

The alarm device proposed in this embodiment and the alarm method proposed in the above-mentioned embodiments belong to the same inventive concept. For the technical details described in detail in this embodiment, reference may be made to any of the above-mentioned embodiments, and this embodiment has the same beneficial effect of executing the alarm method. .

FIG. 10 is a schematic structural diagram of an alarm device provided by an embodiment. As shown in FIG. 10 , the alarm device includes a processor 410, a storage device 420, an input device 430, and an output device 440; the number of processors 410 in the alarm device There may be one or more, and one processor 410 is taken as an example in FIG. 10; the processor 410, the storage device 420, the input device 430, and the output device 440 in the alarm device can be connected by a bus or in other ways. Take bus connection as an example.

As a computer-readable storage medium, the storage device 420 may be used to store software programs, computer-executable programs, and modules, such as program instructions/modules corresponding to the alarm method in the embodiments of the present application. The processor 410 executes various functional applications and data processing of the alarm device by running the software programs, instructions and modules stored in the storage device 420 , that is, to implement the above-mentioned alarm method.

The storage device 420 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program required for at least one function; the storage data area may store data created according to the use of the terminal, and the like. Additionally, storage device 420 may include high-speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other non-volatile solid-state storage device. In some examples, storage device 420 may further include memory located remotely from processor 410, which may be connected to the device through a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

The input device 430 can be used to receive input numerical or character information, and generate signal input related to user settings and function control of the device, and can include a touch screen, a keyboard, a mouse, and the like. The output device 440 may include a display device such as a display screen.

Embodiments of the present application further provide a storage medium containing computer-executable instructions, where the computer-executable instructions are used to execute an alarm method when executed by a computer processor.

In this embodiment of the present application, the root alarm in the current alarm is determined according to the alarm type of the current alarm and the association rule corresponding to the alarm type; wherein, the association rule is determined according to the frequent pattern tree, and the frequent pattern tree passes Scan history alarms are obtained. A frequent pattern tree is constructed by scanning historical alarms, the association rules corresponding to the alarm types are determined according to the frequent pattern tree structure, and the root alarms in the current alarms are determined according to the association rules corresponding to the alarm types of the current alarms, so that the current alarms Derivative alarms that affect fault location can be filtered, and only the root alarms determined are uploaded. At the same time, it solves the problem that the construction of alarm correlation rules depends on prior knowledge and requires multiple scanning of historical alarms, and improves the accuracy, reliability and dynamic adaptability of the generated correlation rules for determining the root alarm correlation rules in current alarms , which reduces the amount of data required to generate association rules and reduces the complexity of alarm operation and maintenance.

From the above description of the embodiments, those skilled in the art can understand that the present application can be implemented by means of software and general hardware, and can also be implemented by hardware. Based on this understanding, the technical solution of the present application can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a floppy disk of a computer, a read-only memory (Read-Only Memory, ROM), Random access memory (Random Access Memory, RAM), flash memory (FLASH), hard disk or optical disk, etc., including multiple instructions to enable a computer device (which may be a personal computer, server, or network device, etc.) to execute any methods described in the examples.

The above descriptions are merely some embodiments of the present application, and are not intended to limit the protection scope of the present application.

The block diagrams of any logic flow in the figures of the present application may represent program steps, or may represent interconnected logic circuits, modules and functions, or may represent a combination of program steps and logic circuits, modules and functions. Computer programs can be stored on memory. The memory may be of any type suitable for the local technical environment and may be implemented using any suitable data storage technology, such as but not limited to read only memory (ROM), random access memory (RAM), optical memory devices and systems (Digital Versatile Discs). DVD or CD disc) etc. Computer-readable media may include non-transitory storage media. The data processor may be of any type suitable for the local technical environment, such as, but not limited to, a general purpose computer, special purpose computer, microprocessor, digital signal processor (DSP), application specific integrated circuit (ASIC), programmable logic device (FGPA) and processors based on multi-core processor architectures.

By way of non-limiting example, the foregoing has provided a detailed description of some embodiments of the present application. However, when considered in conjunction with the accompanying drawings and claims, various modifications and adjustments to the above embodiments will be apparent to those skilled in the art without departing from the scope of the present application. Accordingly, the proper scope of this application will be determined with reference to the claims.

Claims (11)

1. An alert method, including:

   Determine the root alarm in the current alarm according to the alarm type of the current alarm and the association rule corresponding to the alarm type;

   Wherein, the association rule is determined according to a frequent pattern tree, and the frequent pattern tree is obtained by scanning historical alarms.
2. The method according to claim 1, wherein before determining the root alarm in the current alarm according to the alarm type of the current alarm and the association rule corresponding to the alarm type, the method further comprises:

   Obtain historical alarms within a preset time, generate a data set according to the chronological order of the historical alarms, and according to the feature items extracted from the historical alarms; wherein, the feature items include the attribute features extracted from the historical alarms ;

   Scanning the data set, and counting the number of occurrences of feature items in the data set, to determine the first frequent item set;

   Scan the data set again, and construct a frequent pattern tree according to the item header table generated by the first frequent itemset;

   Determine the conditional pattern base corresponding to the characteristic item in the item header table according to the frequent pattern tree, and determine the maximum frequent item set corresponding to the characteristic item according to the conditional pattern base;

   According to the maximum frequent item set, the data set and the preset reliability threshold, a target association rule corresponding to the feature item is determined, and the target association rule is stored in an association rule base.
3. The method according to claim 2, wherein the generating a data set according to the time sequence of the historical alarms and the feature items extracted from the historical alarms comprises:

   Divide the historical alarms into at least two alarm sets at preset time intervals in chronological order;

   Perform attribute feature extraction on each of the alarm sets, and determine feature items corresponding to each of the alarm sets according to the alarm types in the extracted attribute features;

   A data set is generated according to each of the alarm sets and feature items corresponding to each of the alarm sets.
4. The method according to claim 3, wherein the alarm types include at least two types, the scanning the data set, and counting the occurrences of feature items in the data set, and determining the first frequent item set, comprising: :

   Scan the data set, and count the occurrences of the feature items corresponding to each of the alarm types;

   Determine the support degree of the feature item corresponding to each of the alarm types according to the number of occurrences and the number of the alarm sets;

   A set of feature items corresponding to each alarm type whose support degree is greater than or equal to a preset support degree threshold is determined as the first frequent item set.
5. The method according to claim 4, wherein the constructing the frequent pattern tree according to the item header table generated from the first frequent itemset comprises:

   The feature items in the first frequent item set are arranged in descending order of support to generate an item header table, and the feature items in each of the alarm sets that are not included in the first frequent item set are deleted to obtain an adjusted alarm set;

   A frequent pattern tree is constructed according to the feature items in the adjusted alarm set and the item header table; wherein, the feature items in the same alarm set are located in the same branch in the frequent pattern tree, and the features in the same alarm set are located in the same branch of the frequent pattern tree. Items are inserted into the frequent pattern tree in descending order of support.
6. The method according to claim 2, wherein the conditional pattern base corresponding to the feature item in the item header table is determined according to the frequent pattern tree, and the maximum frequency corresponding to the feature item is determined according to the conditional pattern base Itemset, including:

   Determine the node chain in the frequent pattern tree that ends with the feature item in the item header table;

   Determine the support degree of each node in the node chain, update the support degree of the feature item corresponding to each node, and determine the combination of the feature item corresponding to the node chain as the feature item in the item header table. the corresponding conditional pattern base;

   A second data set is generated according to the conditional pattern base, and the maximum frequent itemset corresponding to the feature items in the item header table is determined according to the support degree of each feature item in the second data set.
7. The method according to claim 3, wherein the determining the target association rule corresponding to the feature item according to the maximum frequent item set, the data set and a preset reliability threshold value comprises:

   The maximum frequent itemset is recursively split to obtain a first itemset and a second itemset, and the second itemset is the complement of the first itemset relative to the maximum frequent itemset;

   According to the maximum frequent itemset, the first item set and the data set, determine the first number of times that the maximum frequent itemset belongs to the same alarm set in the data set, and the first item set is in the same alarm set. the second number of times belonging to the same alarm set in the data set;

   In the case that the ratio of the first number of times to the second number of times is greater than or equal to the preset reliability threshold, compare the feature item corresponding to the first item set with the feature corresponding to the second item set The causal relationship between items is determined as the target association rule of the corresponding feature item in the first item set.
8. The method according to claim 2, wherein the storing the target association rule into an association rule base comprises:

   In the case that the target association rule is not included in the association rule base, storing the target association rule in the association rule base;

   When the target association rule is included in the association rule base and is a subset of the association rule to be updated in the association rule base, the target association rule is not stored in the association rule base;

   In the case that the target association rule is included in the association rule base and is a superset of the association rule to be updated in the association rule base, replace the to-be-updated association rule with the target association rule;

   The to-be-updated association rule is an association rule corresponding to the target association rule in the association rule base.
9. An alarm device, comprising:

   a root alarm determination module, configured to determine the root alarm in the current alarm according to the alarm type of the current alarm and the association rule corresponding to the alarm type;

   Wherein, the association rule is determined according to a frequent pattern tree, and the frequent pattern tree is obtained by scanning historical alarms.
10. An alarm device, comprising:

    one or more processors;

    storage means arranged to store one or more programs; wherein,

    When the one or more programs are executed by the one or more processors, the one or more processors implement the alarm method according to any one of claims 1-8.
11. A storage medium of computer-executable instructions, wherein the computer-executable instructions, when executed by a computer processor, are used to perform the alerting method according to any one of claims 1-8.

Images