WO2022262725A1 - Event analysis method and apparatus thereof - Google Patents

Abstract

The present application belongs to the technical field of correlation analysis. Disclosed are an event analysis method and an apparatus thereof. The method comprises: acquiring a query message of a first event, wherein the query message is used for querying target information of a second event, the second event is generated by the triggering of the first event, the first event is an event that has occurred at a first time, the second event is a predicted event that does not occur at the first time, and the first time is less than or equal to the time in which the query message is acquired; and obtaining the target information on the basis of the query message, wherein the target information comprises an event identifier, the probability of being triggered and/or a predicted occurrence time of the second event. By means of the present application, the diverse analysis of a correlation between events is realized, and analysis functions for events having a correlation are enriched.

Description

A method and device for event analysis

This application claims the priority of the Chinese patent application with the application number 202110680951.8 and the title of the invention "A method and device for event analysis" submitted on June 18, 2021, the entire contents of which are incorporated in this disclosure by reference.

technical field

The present application relates to the technical field of correlation analysis, in particular to an event analysis method and device thereof.

Background technique

With the rapid expansion and growth of the operator's network scale, the network topology and topology logic of the operator's network are becoming more and more complex, and network faults are also more frequent, which requires the operation and maintenance personnel to locate faults in the network and determine the relationship between faults. Relevance creates enormous stress.

In related technologies, a clustering method may be used to determine the correlation between faults. For example, feature extraction can be performed on multiple faults that have occurred, and multiple faults can be clustered according to the extracted feature information, and the faults classified into one category are considered to be related.

However, this clustering method can only determine whether there is correlation between faults, and its function is relatively single.

Contents of the invention

The present application provides an event analysis method and its device. The event analysis results obtained by the method include the trigger probability and/or predicted occurrence time of the triggered event, and the analysis results intuitively reflect the analysis results of related events. The analysis function for related events is enriched. The technical scheme that this application provides is as follows:

In a first aspect, the present application provides an event analysis method, which is applied to a communication device, and the method includes: acquiring a query message of a first event, the query message is used to query target information of a second event, and the second event is Triggered by the first event, the first event is an event that has occurred at the first time, the second event is a predicted event that has not occurred at the first time, and the first time is less than or equal to the time when the query message is obtained; based on the query message , to obtain target information, where the target information includes the event identifier, trigger probability and/or predicted occurrence time of the second event.

In the event analysis method provided by the present application, since the method can predict the second event that is triggered by the first event and has not occurred, and predict at least one of the trigger probability and the predicted occurrence time of the second event , compared with related technologies, it is not only able to analyze whether there is correlation between events, but also to analyze at least one of the trigger probability and predicted occurrence time of triggered events among correlated events. The analysis results intuitively reflect the The analysis results of related events are highly interpretable, which realizes the diversity analysis of the correlation between events and enriches the analysis function of related events.

Optionally, the query message includes a filter condition, and the query message including the filter condition is used to query target information satisfying the filter condition, and the filter condition includes one or more of the following: time condition, probability condition, and device condition. By setting filter conditions, you can perform more targeted queries based on the filter conditions.

Wherein, the device condition includes one or more of the following device attributes: device identifier, the area where the device is located, the device type, the network topology where the device is located, the manufacturer of the device, and the user of the device. A device with an association occurs.

As a possible implementation, the query message is obtained based on the query parameters input by the user on the query interface, or based on the interface components selected by the user on the query interface, or obtained from a third-party system through the application programming interface.

Optionally, before obtaining the target information based on the query message, the event analysis method further includes: obtaining first historical data of events that have occurred at the first time in the events managed by the communication device, the first historical data includes: The identification of the event and the occurrence time of the event that has occurred. The first historical data includes the historical data of the first event and the historical data of the third event. The third event is an event that has occurred at the first time and has the same identification as the second event event. Correspondingly, obtaining the target information includes: analyzing the first historical data to obtain the target information.

It can be seen that this method is actually based on the historical data of the event, counting the law of one event causing another event, and analyzing the correlation between events according to the law, compared with the rules obtained from expert experience. Related technologies for correlation analysis can analyze the correlation between events in more situations, ensuring the scope of application of the method without injecting expert experience. And because this method is not based on the rules obtained by expert experience, it does not need to synchronize the rules according to the expansion of the network, which will not affect the efficiency of development and operation and maintenance, and will not cause the increase of implementation cost and bit error rate.

Moreover, the necessary information in the first historical data is the identification of the event that has occurred and the time of occurrence of the event that has occurred. Compared with other related technologies that analyze the correlation between events, the requirements for the data referred to in the analysis are reduced, and the data can be improved. The generalization ability of the analysis.

Wherein, analyzing the first historical data to obtain target information includes: obtaining target information based on the first historical data and an analysis model. Optionally, the analysis model may belong to an artificial intelligence model.

Further, analyzing the first historical data to obtain target information includes: obtaining target information based on the first historical data, analysis indication information, and analysis model, where the analysis indication information is used to indicate that the first event is used as a trigger for the second event to occur preceding events.

It should be noted that when the analysis model is used for analysis, the analysis instruction information may not be input into the analysis model. At this time, the content indicated by the analysis instruction information can be obtained by analyzing the first historical data by the analysis model.

Optionally, the second event associated with the first event includes one or more, and obtaining target information based on the first historical data, analysis indication information, and analysis model includes: pre-screening the first historical data to obtain The historical data of the first event and the historical data of any third event, any third event is an event that has the same identification as any second event among the events that have occurred at the first time; the indication information, the first event will be analyzed The historical data of the event and the historical data of any third event are input into the analysis model, and the target information of any second event output by the analysis model is obtained.

By pre-screening the first historical data in advance and providing the pre-screened data to the analysis model, the amount of data to be processed by the analysis model can be reduced, and the analysis speed of the analysis model can be ensured.

Further, after the communication device pre-screens the first historical data, it may also perform statistics on the first historical data, and provide the statistically obtained data to the analysis model, so that the analysis model performs analysis according to the statistically obtained data, so as to reduce The amount of data that needs to be processed for analysis by a small analytical model.

In a practicable manner, the implementation process of performing statistics on the first historical data may include: recording the occurrence moment of the third event according to the historical data of the third event, and using the historical data of the first event to The occurrence time of each of the three events is taken as the starting point, along the direction of time regression, count the occurrence time of the first event before the third event, and obtain the corresponding time difference between the third event and the first event, and The total number of occurrences of different time differences are counted separately. Moreover, in order to ensure the validity of the data, when performing statistics, the time of occurrence of the first event within a specified time window before the occurrence of the third event can also be limited and counted. For example, the occurrence time of the first event within one minute before the occurrence of the third event may be limited each time.

It should be noted that the analysis model may be a pre-trained model, and the pre-trained model can obtain any event corresponding to the first event triggering the third event based on the historical data of the first event and the historical data of the third event. Target information of a second event. Therefore, before using the analysis model to obtain target information, the analysis model needs to be trained. In a practicable manner, before obtaining the target information based on the first historical data, analyzing the indication information and the analysis model, the event analysis method further includes: based on the historical data of the first event and the history of any third event Data, to obtain the reference data of the probability of the first event triggering any third event over time, the second event associated with the first event includes one or more, and any third event has occurred at the first time Among the events, the event with the same identity as any second event; obtain the initialization data of the probability that the first event triggers any third event over time, and the initialization data is based on the occurrence probability of the first event and any third event It is obtained by initialization; based on the reference data and initialization data, the analysis model is trained.

Optionally, obtaining the initialization data of the probability of the first event triggering any third event over time includes: based on the historical data of the first event and the historical data of any third event, counting any third event at The total number of occurrences of an event after a specified time period; based on the total number of time feature points, the first historical data indicates that the probability of the first event triggering any third event at the time feature point is greater than or equal to the reference probability threshold; at the time feature point The first initialization is performed on the probability that the first event triggers any third event; the second initialization is performed on the probability that the first event and any third event occur within a specified time period respectively; based on the result of the first initialization and the second As a result of the initialization, the initialization data of the probability that the first event triggers any third event occurring over time is obtained.

It should be noted that when the historical data of the first event and the historical data of the third event reflect that the third event has a delay probability, a third initialization of the delay probability is also required in the process of obtaining the initialization data. Correspondingly, the The initialization data also needs to reflect the result of the third initialization. In an implementable manner, the delay probability may be initialized randomly.

When the third event is determined to have a delay probability according to the historical data, by performing a third initialization on the delay probability, the probability of the first event triggering the third event obtained according to the initialization data can be better simulated when the probability of the third event is triggered by the initialization data. Combined with the fact that the probability of the first event triggering the third event obtained from historical data changes with time, the training result of the analysis model is better, and the performance of the analysis model is guaranteed.

There are many ways to realize the acquisition of time feature points. This application uses the following three ways of realization as examples to describe the way of realization.

In the first practicable manner, time feature points may be obtained according to the total number of times and the change of the total number of times. For example, the total number of occurrences of the third event after the specified duration t1, t1+1, and t1-1 of the first event can be obtained respectively, and the total number of occurrences of the third event after the specified duration of t1-1 of the first event can be obtained Relative to the first change gradient of the total number of occurrences after the specified time length t1, and obtain the third event’s total number of occurrences after the first event occurs with the specified time length t1 relative to the total number of occurrences after the specified time length t1+1 Two change gradients, and the total number of occurrences of the third event after the specified time length t1 of the first event is greater than the total number of occurrences of the first event after the specified time length t1-1 and t1+1, and the first change gradient and the second change gradient are greater than the specified gradient threshold, the specified time length t1 is determined as the time feature point.

In the second practicable manner, the time feature points may be acquired in a sliding window manner during the generation time period of the historical data of the first event and the historical data of the third event. The implementation process includes: setting a time window with a certain duration, and the sliding step of the time window sliding in the generation time period, controlling the time window from the starting point of the time period along the development direction of the generation time period according to The sliding step is used to slide. When the time window slides to a position, in the sub-time period of the generation time period covered by the time window, the third event at all time points in the sub-time period is counted in the first event The first total number of occurrences after the specified time period occurs, and the second total number of occurrences of the third event at all time points in the generation time period after the specified time period of the first event occurs, when the first total number reaches the second When the percentage of the total times reaches the percentage threshold, the time center point of the sub-time period is determined as the time feature point.

In the third practicable way, first, according to the historical data of the first event and the historical data of the third event, determine the maximum value of the total number of occurrences of the third event after the specified time period of the first event, and set the maximum value, and then in the generation time period when the historical data of the first event and the historical data of the third event are generated, filter the jitter threshold where the total number of occurrences of the third event reaches the maximum value after the first event occurs for a specified time period Time points within the range, and the filtered time points are determined as time feature points.

In a second aspect, the present application provides an event analysis device, which includes: an interaction module, used to obtain a query message of a first event, the query message is used to query target information of a second event, and the second event is the first Generated by event triggering, the first event is an event that has occurred at the first time, the second event is a predicted event that has not occurred at the first time, and the first time is less than or equal to the time when the query message is obtained; the obtaining module is used to Based on the query message, target information is obtained, where the target information includes the event identifier, trigger probability and/or predicted occurrence time of the second event.

Optionally, the query message includes a filter condition, and the query message including the filter condition is used to query target information satisfying the filter condition, and the filter condition includes one or more of the following: time condition, probability condition, and device condition.

Wherein, the device condition includes one or more of the following device attributes: device identifier, the area where the device is located, the device type, the network topology where the device is located, the manufacturer of the device, and the user of the device. A device with an association occurs.

Optionally, the query message is obtained based on query parameters input by the user on the query interface, or based on interface components selected by the user on the query interface, or obtained from a third-party system through an application programming interface API.

Optionally, the obtaining module is further configured to: obtain first historical data of events that have occurred at the first time in the events managed by the device, where the first historical data includes: the identifier of the occurred event and the occurrence time of the occurred event, The first historical data includes the historical data of the first event and the historical data of the third event, and the third event is an event that has the same identifier as the second event among the events that have occurred at the first time; correspondingly, the obtaining module specifically uses In: analyzing the first historical data to obtain target information.

Optionally, the obtaining module is specifically configured to: obtain target information based on the first historical data and the analysis model. In one possible implementation, the analysis model is an artificial intelligence model.

Optionally, the obtaining module is specifically configured to: obtain target information based on the first historical data, analysis indication information, and analysis model, where the analysis indication information is used to indicate that the first event is used as a pre-event that triggers the occurrence of the second event.

Optionally, the second event associated with the first event includes one or more obtaining modules, specifically for: pre-screening the first historical data to obtain the historical data of the first event and any third event Any third event is an event that has the same identifier as any second event among the events that have occurred at the first time; the indication information, the historical data of the first event and the history of any third event will be analyzed The data is input into the analysis model, and the target information of any second event output by the analysis model is obtained.

Optionally, the device further includes: a training module, the training module is used to: based on the historical data of the first event and the historical data of any third event, obtain the probability of the first event triggering any third event as a function of time. Reference data, the second event associated with the first event includes one or more, any third event is an event that has the same identity as any second event among the events that have occurred at the first time; obtain the first The initialization data of the probability that the event triggers any third event changes with time, and the initialization data is obtained by initializing the occurrence probability of the first event and any third event; based on the reference data and the initialization data, the analysis model is trained.

Optionally, the training module is specifically used to: based on the historical data of the first event and the historical data of any third event, count the total number of occurrences of any third event after the first event occurs for a specified time period; obtain Time feature point, the first historical data indicates that the probability of the first event triggering any third event at the time feature point is greater than or equal to the reference probability threshold; the probability of the first event triggering any third event at the time feature point is the first Initialization; respectively perform second initialization on the probability of occurrence of the first event and any third event in a specified time period; based on the result of the first initialization and the result of the second initialization, it is obtained that the first event triggers the occurrence of any third event The probability of the initialization data varies over time.

In a third aspect, the present application provides an analysis device. The analysis device includes: a processor and a memory, and a computer program is stored in the memory; when the processor executes the computer program, the analysis device implements the first aspect of the application and any optional The method provided by the implementation. Optionally, the analysis device may be a computer device.

In a fourth aspect, the present application provides a non-transitory computer-readable storage medium. When the instructions in the computer-readable storage medium are executed by a processor, the first aspect of the present application and any optional implementation manner are realized provided method.

In a fifth aspect, the present application provides a computer program product including instructions, which, when the computer program product is run on a computer, cause the computer to execute the method provided in the first aspect of the present application and any optional implementation manner.

Description of drawings

FIG. 1 is a schematic diagram of an application scenario involved in an event analysis method provided in an embodiment of the present application;

FIG. 2 is a schematic diagram of an application scenario involved in another event analysis method provided by an embodiment of the present application;

FIG. 3 is a schematic diagram of an application scenario involved in another event analysis method provided by an embodiment of the present application;

FIG. 4 is a flow chart of a method for event analysis provided by an embodiment of the present application;

FIG. 5 is a schematic diagram of a graphical user interface for obtaining query messages provided by an embodiment of the present application;

FIG. 6 is a schematic diagram of another graphical user interface for obtaining query messages provided by the embodiment of the present application;

FIG. 7 is a waveform diagram of the trigger frequency of the second event at different times when the first event occurs according to the embodiment of the present application;

Fig. 8 is a schematic diagram of the comparison between the actual waveform diagram of the frequency of the second event occurring at different times and the simulation waveform diagram analyzed by the analysis model provided by the embodiment of the present application;

FIG. 9 is a flow chart of a training process of an analysis model provided by an embodiment of the present application;

Fig. 10 is a flow chart of obtaining initialization data of the probability that the first event triggers the third event varies with time provided by the embodiment of the present application;

FIG. 11 is a schematic structural diagram of an event analysis device provided in an embodiment of the present application;

Fig. 12 is a schematic structural diagram of another event analysis device provided in the embodiment of the present application;

FIG. 13 is a schematic structural diagram of a computer device provided by an embodiment of the present application.

detailed description

In order to make the purpose, technical solution and advantages of the present application clearer, the implementation manners of the present application will be further described in detail below in conjunction with the accompanying drawings.

An embodiment of the present application provides an event analysis method, which can obtain a query message of a first event, and obtain target information of a second event based on the query message. Wherein, the second event is an event that can be triggered by the first event but has not occurred, and the target information includes the event identifier, trigger probability and/or predicted occurrence time of the second event. Therefore, the method can predict the second event that is triggered by the first event and does not occur, and predict at least one of the trigger probability and the predicted occurrence time of the second event. Compared with related technologies, not only the event It can also analyze at least one of the trigger probability and predicted occurrence time of the triggered event among the related events. The analysis results intuitively reflect the analysis results of the related events and can be interpreted It is strong, realizes the diversity analysis of the correlation between events, and enriches the analysis function of related events. Among them, when the method can predict the trigger probability and the predicted occurrence time of the triggered event among the related events, it can enable the user to understand in more detail when and with what probability the triggered event will be triggered, and can facilitate the analysis of the triggered event. A more detailed understanding of the occurrence of triggering events.

FIG. 1 is a schematic diagram of an application scenario involved in an event analysis method provided by an embodiment of the present application. As shown in FIG. 1 , the application scenario includes: a first device 01 and a second device 02 . Wherein, a communication connection is established between the first device 01 and the second device 02 through a wired or wireless network. The second device 02 is used for providing historical data of events to the first device 01 . The first device 01 is configured to execute the event analysis method provided in the embodiment of the present application based on historical event data.

Optionally, the first device 01 may be a communication device with a computing function such as a computer or a server. Wherein, the server may be a server, or a server cluster composed of several servers, or a cloud computing service center. The second device 02 may be a computer, a server, a network device (such as a gateway device or a network element device), a personal computer, a cloud host, a portable mobile terminal, a multimedia player, an e-book reader or a wearable device, etc.

The application scenario may include one or more second devices 02 . In the first application scenario, the application scenario includes a second device 02 that can collect historical data of all events managed by the first device 01 and provide the historical data to the first device 01 . At this time, as shown in FIG. 1 , the application scenario may further include multiple third devices 03 , and a communication connection is established between each third device 02 and the second device 02 through a wired or wireless network. Each third device 03 is configured to provide the second device 02 with historical data of events associated with the third device 03 . Optionally, the third device 03 may be a computer, a server, a network device (such as a gateway device or a network element device), a personal computer, a cloud host, a portable mobile terminal, a multimedia player, an e-book reader or a wearable device, etc. .

For example, assuming that the event requiring correlation analysis is a network fault in the network, the first application scenario may include: a first device 01 , a second device 02 and multiple third devices 03 . Both the first device 01 and the second device 02 may be servers for operation and maintenance management, and the third device 03 may be a network device for data transmission in the network. The third device 03 is used to determine whether there is a network fault in the network according to the data transmission situation during the data transmission process, and report the network fault and related data to the second device 02 when it is determined that there is a network fault, such as through an alarm The method reports network faults and related data to the second device 02. The second device 02 is configured to receive network faults and related data reported by the third device 03 , obtain historical data of network faults, and send the historical data to the first device 01 .

In the second application scenario, as shown in FIG. 2 , the application scenario may include a plurality of second devices 02, and each second device 02 is used to provide the first device 01 with information associated with the second device 02. Historical data for events. That is, in the second application scenario, it can be considered that the functions of the second device 02 include the functions of the second device 02 and the third device 03 in the aforementioned first application scenario. Wherein, the events associated with the second device 02 include events sensed by the second device 02 .

For example, assuming that the event requiring correlation analysis is a network fault in the network, the second application scenario may include: one first device 01 and multiple second devices 02 . The first device 01 may be a server for operation and maintenance management. The second device 02 may be a network device, configured to perform data transmission in the network. Moreover, during the process of data transmission, the second device 02 can determine whether there is a network fault in the network according to the data transmission situation, and obtain relevant data of the network fault when it is determined that there is a fault, obtain historical data of the network fault device, and send the data to the second device 02. A device 01 reports the historical data. Wherein, the historical data reported by the second device 02 is the historical data of network faults associated with the second device 02, and the correlation between the network fault and the second device 02 means that the network fault is sensed by the second device 02 .

There are many implementation forms of the event analysis method provided by the embodiment of the present application, and the following two implementation forms are taken as examples to illustrate them:

In a first implementable manner, the first device 01 may be a device owned by a user. The first device 01 can use the event analysis method provided in the embodiment of the present application to analyze correlations between events for which the user has management authority. The first device 01 can obtain a related function package (such as a program installation package) required for analyzing related events, and provide the user with a function of analyzing related events by running the function package. Among them, the relevant function package required for analyzing related events can be provided by the service provider for analyzing related events, and after the user obtains the right to use the function package from the service provider, he can use the Obtain the function package from the service provider.

For example, the user may download on the first device 01 a program installation package required for analyzing related events, and install the program installation package in the first device 01, and the first device 01 receives the first event After querying the message, the program for analyzing related events can be run, and the program can be used to obtain target information such as event identification, trigger probability and/or predicted occurrence time of the second event triggered by the first event.

In a second possible implementation manner, the first device 01 may be a device owned by a service provider that analyzes events with relevance. The user can send a query message to the first device 01 through the platform provided by the service provider, and the first device 01 can provide the user with a service of analyzing related events according to the query message.

In an implementable manner, the first device 01 may be implemented through resources in a cloud platform. The basic resources owned by the cloud service provider are deployed in the cloud platform. For example: computing resources, storage resources, and network resources are deployed in the cloud platform, and the computing resources can be a large number of computer devices (such as servers), so the first device 01 can be realized by computing resources in the cloud platform. At this time, as shown in FIG. 3 , the event analysis method provided by the embodiment of the present application can be abstracted into an analysis cloud service by the cloud service provider on the cloud platform and provided to the user. After the user purchases the analysis cloud service on the cloud platform, the cloud platform can use the computing resources in the cloud platform to provide the user with the analysis cloud service.

Optionally, in this embodiment of the application, the cloud platform may be a cloud platform of a central cloud or a cloud platform of an edge cloud. Moreover, when the first device 01 is deployed in a distributed deployment manner, the cloud platform may also be a cloud platform including a central cloud and an edge cloud. At this time, the first device 01 may be partially deployed on the cloud platform of the edge cloud Among them, some are deployed on the cloud platform of the central cloud, which is not specifically limited in this embodiment of the present application. In addition, the first device 01, the second device 02, and the third device 03 above may be independent devices, or a device cluster composed of independent devices, and the implementation form of each computer device may be determined according to application requirements. The example does not specifically limit it.

It should be understood that the above content is an exemplary description of the application scenario of the event analysis method provided by the embodiment of the present application, and does not constitute a limitation on the application scenario of the event analysis method. Those of ordinary skill in the art know that as business As requirements change, the application scenarios can be adjusted according to the application requirements, and the embodiments of this application do not list them one by one.

The implementation process of an event analysis method provided by the embodiment of the present application will be described below. As shown in Figure 4, the implementation process may include the following steps:

In step 401, the first device obtains a query message of a first event, and the query message is used to query target information of a second event.

Wherein, the second event is triggered and generated by the first event. The first event is an event that has occurred at the first time. The second event is a predicted event that did not occur at the first time. The first time is less than or equal to the time when the query message is obtained, that is, the first time is no later than the time when the query message is obtained. It can be seen that the query message is used to query the target information of the second event that can be triggered by the first event and has not yet occurred.

The target information includes an event identifier, a trigger probability (trigger probability) and/or a predicted occurrence time (also called a trigger time (tirrger time)) of the second event. When the target information includes the event identifier of the second event, the target information is used to indicate a specific event that can be triggered by the first time and has not yet occurred. In addition, the event identifier may indicate the event itself, for example, an Ethernet loss failure with the name ETH_APS_LOST_0_Opt indicating the event. Alternatively, the event identifier may indicate the type of the event, for example, indicating that the event is a network disconnection fault, a packet loss fault, or a clock alarm. The trigger probability of the second event refers to the probability that the second event is triggered by the first event. The predicted occurrence time of the second event refers to the expected occurrence time of the second event triggered by the first event.

In addition, in order to have a more comprehensive understanding of the situation that the first event triggers the second event, the target information may also include one or more of the following information: the total number of times the second event is triggered by the first event, the first event and the second event The probability distribution of the probability of natural occurrence of the two events over time, and the probability of the delayed occurrence of the second event after the first event triggers the second event (ie, the delay probability). Among them, the probability of any event occurring naturally refers to the probability of the event occurring without being affected by other events. In this embodiment of the present application, the probability distribution of the probability of an event occurring naturally may be a Poisson distribution, a normal distribution, or the like.

Among them, the expression of Poisson distribution is:

Then the event probability distribution satisfying the Poisson distribution can be expressed by the parameter λ in this expression. The expression for the normal distribution is:

Then the event probability distribution satisfying the normal distribution can be expressed by the parameters σ and μ in the expression.

Optionally, the query message may also include a filter condition, and the query message including the filter condition is used to query target information satisfying the filter condition. In some implementations, the filter conditions include one or more of the following: time conditions, probability conditions, and equipment conditions. The equipment condition is used to indicate the equipment associated with the occurrence of the second event.

Wherein, the query message including the time condition is used to query the target information of the second event whose occurrence time satisfies the time condition. For example, the query message including the time condition is used to query the target information of the second event triggered by the first event and triggered within one hour after the occurrence of the first event.

The query message including the probability condition is used to query the target information of the second event whose trigger probability triggered by the first event satisfies the probability condition. For example, a query message including a probability condition is used to query target information of a second event that is triggered by a first event and whose trigger probability is greater than or equal to a specified probability threshold (eg, 50%).

The query message including the device condition is used to query the target information of the second event caused by the device meeting the device condition. In a practicable manner, the device condition includes one or more of the following device attributes: a device identifier, a region where the device is located, a device type, a network topology where the device is located, a manufacturer of the device, and a user of the device. When the device condition is used to indicate the device identifier, the query message is used to query the target information of the second event triggered by the first event and caused by the device indicated by the device identifier. When the equipment condition is used to indicate the area where the equipment is located, the query message is used to query the target information of the second event triggered by the first event and caused by the equipment deployed in the area where the equipment is located. When the device condition is used to indicate the device type, the query message is used to query the target information of the second event triggered by the first event and caused by the device belonging to the device type. When the device condition is used to indicate the network topology where the device is located, the query message is used to query the target information of the second event triggered by the first event and caused by the device deployed in the network topology. When the device condition is used to indicate the manufacturer of the device, the query message is used to query the target information of the second event triggered by the first event and caused by the device produced by the manufacturer. When the device condition is used to indicate the user of the device, the query message is used to query the target information of the second event triggered by the first event and caused by the device used by the user.

As an implementation of the query message, the query message can be obtained based on the query parameters input by the user on the query interface, or based on the interface components selected by the user on the query interface, or obtained from a third party through an application programming interface (application program interface, API) system gets.

Wherein, the query interface may be a graphical user interface (graphical user interface, GUI) of an application program that provides a user with an analysis of related events. As shown in Figure 5, the GUI is provided with an input box for query objects, and the user can input the name of the first event to be queried (such as the preceding event in Figure 5) in the input box to indicate the event to be queried . In addition, the graphical user interface is also provided with an input box for filtering conditions. When the user needs to query target information satisfying the filtering conditions, he can input filtering conditions in the input box of the filtering conditions, such as inputting time conditions and probability conditions. In addition, buttons for adding and deleting filter conditions are provided in the graphical user interface for users to add or delete filter conditions according to query requirements.

Alternatively, an interface component for selecting query objects may be set in the graphical user interface. For example, as shown in Figure 6, a selection list (a drop-down selection list as shown in Figure 6) for selecting the query object can be provided at the input box of the query object, and the input box can be expanded by clicking the triangle at the input box. A drop-down selection list, the selection list includes a plurality of interface components, after the user selects any interface component in the plurality of interface components, the user can instruct to query the event indicated by the interface component. And the graphical user interface can also be provided with an interface component for selecting a filter condition, for example, a selection list for selecting a filter condition is provided at the input box of the filter condition, and the selection list includes a plurality of interface components, and the user selects After any interface component in the plurality of interface components, it can instruct to query the events satisfying the indication filter condition of the interface component. In addition, buttons for adding and deleting filter conditions are also provided in the graphical user interface for users to add or delete filter conditions according to query requirements.

In addition, information such as query objects and filtering conditions indicated by the query message may also be obtained by a third-party system, and at this time, the first device may obtain information such as query objects and filtering conditions from the third-party system through an application programming interface. In one possible way, the third-party system can provide users with a query interface for setting information such as query objects and filter conditions. After the user sets information such as query objects and filter conditions in the query interface, the third-party system will immediately Information such as the query object and filter conditions can be obtained. Wherein, the implementation method of setting information such as query objects and filter conditions in the third-party system can refer to the implementation method of setting information such as query objects and filter conditions in the graphical user interface of an application program that analyzes related events , which will not be repeated here.

In step 402, the first device obtains first historical data of events that have occurred at a first time among the events managed by the first device.

The first device can analyze the historical data of the events that have occurred, obtain the time-series connection between different events that have occurred, and predict the correlation between different events according to the time-series connection, so as to realize the related Analysis of events. Therefore, before the first device obtains the target information of the second event based on the query message, it needs to first obtain the first historical data of events that have occurred at the first time among the events managed by the first device.

Moreover, since the first time is less than or equal to the time when the query message is obtained, the step of obtaining the first historical data can be performed before or after the query message is obtained, and the execution sequence can be determined according to application requirements. For example, when it is specified (such as artificially specified) that whenever the query message is obtained, the target information is obtained according to the first historical data of events that have occurred at a fixed first time, the step of obtaining the first historical data can be performed when receiving the query message Execute before or after. For another example, when it is specified that when the query message is obtained, the target information needs to be obtained according to all historical data of events that have occurred in the events managed by the first device before the query message is obtained, then the first time may be equal to the time when the query message is obtained , and the step of obtaining the first historical data needs to be performed after obtaining the query message.

In addition, when the first historical data is all historical data of events that have occurred before the query message is acquired in the events managed by the first device, due to the accuracy of the relationship between the acquired events and the history used for analysis The amount of data is positively correlated. The more historical data, the more comprehensively it can reflect the connection between different events that have occurred, and it can effectively ensure the accuracy of the connection between different events that have occurred. The accuracy of the time correlation analysis.

Wherein, the first historical data includes: the identifier of the occurred event and the occurrence time of the occurred event. And, since the query message is used to query the target information of the second event triggered by the first event, the first historical data needs to include the historical data of the first event and the historical data of the third event, so as to obtain the first event and the second event. connection between events. The third event is an event that has the same identifier as the second event among the events that have occurred at the first time. That is, the third event and the second event are actually the same event, but the third event has occurred at the first time, and the second event has not occurred at the first time. For example, the second event and the third event are network disconnection faults at the same network location, but the third event has occurred at the first time, and the second event has not occurred at the first time.

Optionally, the first historical data may further include: optional information such as the area to which the device belongs, the type of the device, and the network topology to which the device belongs, which are related to the occurrence of the event. When the first historical data further includes the above optional information, more reference information can be provided for analyzing the connection between events that have occurred, and the accuracy of the connection between events acquired by the first device can be further improved.

It can be seen from the above that in the method of event analysis provided by the embodiment of the present application, the necessary information in the first historical data is the identification of the event that has occurred and the time of occurrence of the event that has occurred. Compared with the correlation between other analysis events Technology, which reduces the requirements for the data referenced by the analysis, can improve the generalization ability of the analysis.

In addition, the obtaining operation in step 402 may include the process of obtaining the first historical data from other devices (such as from the second device), and reading the first historical data into the memory of the first device, or may include converting The process of reading the first historical data from the persistent storage medium of the first device into the internal memory is not specifically limited in the embodiment of the present application, as long as the result of the acquisition operation enables the first device to perform Just analyze.

Step 403, the first device analyzes the first historical data based on the query message to obtain target information.

After receiving the query message, the first device can analyze the first historical data based on the query message to obtain target information. Optionally, the process of analyzing the first historical data may be implemented through an analysis model. That is, the implementation process of step 403 includes: obtaining target information based on the first historical data and the analysis model. Moreover, since the second event is triggered by the first event, when using the analysis model to obtain the target information, analysis instruction information can also be input into the analysis model to indicate the relationship between the first event and the second event, such as indicating that the first event As a pre-event that triggers the occurrence of the second event. That is, the implementation process includes: obtaining target information based on the first historical data, the analysis instruction information and the analysis model. It should be noted that when the analysis model is used for analysis, the analysis instruction information may not be input into the analysis model. At this time, the content indicated by the analysis instruction information can be obtained by analyzing the first historical data by the analysis model.

Also, the second event associated with the first event may include one or more. In this case, the target information to be acquired includes target information at each second time in the one or more second events. Correspondingly, when analyzing, the analysis may be performed on the first event and any second event among the one or more second events, so as to obtain the target information of any second event. The implementation process of step 403 is described below by taking a second event as an example. As an achievable way, its implementation process includes:

Step 4031. The first device pre-screens the first historical data to obtain the historical data of the first event and any third event. Any third event is an event that has occurred at the first time, and any The second event has the same ID as the event.

When analyzing the events related to the first event, the first event and any second event can be analyzed separately, and the first historical data is that the events managed by the first device have occurred at the first time Therefore, before analysis, the first historical data can be pre-screened to obtain the historical data of the first event and the historical data of any third event. Then, analysis is performed according to the historical data of the first event and the historical data of any third event to obtain target information of a second event having the same identifier as any third event. To improve the readability of the embodiment, any third event is referred to as a third event in the description of the following steps.

It should be noted that the pre-screening process can be executed in the first device, but is not limited to being executed in the first device. The execution subject of the pre-screening process can be adjusted according to the application requirements, and this embodiment of the present application does not specifically describe it. limited. For example, a device that provides historical data to the first device (such as the second device in Figure 1) can also filter the historical data first, and then provide the filtered historical data to the first device, which can reduce the cost of the first device. load.

In addition, when actually analyzing related events, the first historical data may not be pre-screened, for example, the first historical data may be directly input into the analysis model. However, pre-screening the first historical data and providing the pre-screened data to the analysis model can reduce the amount of data that the analysis model needs to process and ensure the analysis speed of the analysis model.

Further, after pre-screening the first historical data, the first device may also perform statistics on the first historical data, and provide the statistically obtained data to the analysis model, so that the analysis model performs analysis according to the statistically obtained data, to Reduce the amount of data that needs to be processed by the analysis model for analysis. Moreover, when the process of pre-screening the first historical data is performed on other devices, the statistical process may be performed on the first device or other devices, which is not specifically limited in this embodiment of the present application. In a practicable manner, the implementation process of performing statistics on the first historical data may include: recording the occurrence moment of the third event according to the historical data of the third event, and using the historical data of the first event to The occurrence time of each of the three events is taken as the starting point, along the direction of time regression, count the occurrence time of the first event before the third event, and obtain the corresponding time difference between the third event and the first event, and The total number of occurrences of different time differences are counted separately. Moreover, in order to ensure the validity of the data, when performing statistics, the time of occurrence of the first event within a specified time window before the occurrence of the third event can also be limited and counted. For example, the occurrence time of the first event within one minute before the occurrence of the third event may be limited each time.

Step 4032, the first device inputs the historical data of the first event and the historical data of any third event into the analysis model, and obtains the target of any second event corresponding to any third event triggered by the first event output by the analysis model information.

The analysis model can analyze the rule that the first event causes the occurrence of the third event based on the historical data of the first event and the historical data of the third event, and then obtain the target information that the first event triggers any second event according to the rule . Optionally, when the relationship between the first event and the second event needs to be indicated to the analysis model, analysis indication information also needs to be input into the analysis model.

Wherein, the probability distribution of the trigger probability, the predicted occurrence time, and the natural occurrence probability of the first event and the second event in the target information over time can be obtained by analyzing historical data through an analysis model. The total number of times that the second event in the target information is triggered by the first event can be obtained statistically according to the analysis result of the analysis model. For example, when the target information includes 5 predicted occurrence times, it may be determined that the total number of times the second event is triggered by the first event is 5. The delay probability in the target information can be obtained according to the delay probability of the third event after the first event triggers the third event reflected in the historical data. For example, according to historical data, the delay probability that the third event occurs with a delay of 1 second is 0.8, and the delay probability that occurs with a delay of 2 seconds is 0.8×0.8=0.64, then the delay probability that the second event occurs with a delay of 1 second is 0.8, and the delay The probability of a delay occurring at 2 seconds is 0.8 x 0.8 = 0.64. When the waveform diagram is used to represent the trigger probability of the third event when the first event occurs, the influence of the delay probability on the waveform diagram is as follows: the descending slope of the waveform diagram near the local peak is slowed down, It is no longer a peak with a steeper ascent and descent.

It should be noted that the analysis model may include an artificial intelligence (artificial intelligence, AI) model or other types of models. And the analysis model can be a pre-trained model, and the pre-trained model can obtain any second event corresponding to the first event triggered by the third event based on the historical data of the first event and the historical data of the third event. The target information for the event. Therefore, before using the analysis model to obtain target information, the analysis model needs to be trained. In order to improve the readability of the embodiment, the process of training the analysis model is described in steps 901 to 903 below. In addition, the target information obtained by analyzing the historical data of the first event and the historical data of the third event can also be used to train the analysis model, so as to further improve the model performance of the analysis model.

Step 404, the first device presents target information to the user.

After the first device acquires the target information based on the query message, it may display the target information to the user. According to the foregoing description, it can be seen that the target information includes one or more pieces of information, and part or all of the one or more pieces of information may be displayed to the user during presentation. Wherein, the presentation manner may include a manner of displaying through text information, or may include a manner of presenting to the user a waveform graph showing the probability of the second event being triggered by the first event changing over time. Moreover, when displaying the target information, information such as the maximum trigger probability, minimum trigger probability, average value of the trigger probability, and the identification of the first event of the second event triggered by the first event can also be displayed, so that the user can trigger the second event for the first event have a more comprehensive understanding of the situation. Among them, the maximum trigger probability, the minimum trigger probability, and the average value of the trigger probability of the second event being triggered by the first event can be obtained through statistics based on the analysis results of the analysis model, such as the probability that the second event is triggered by the first event output by the analysis model Waveform diagrams over time are obtained statistically.

Exemplarily, it is assumed that the query message includes a time condition, and the time condition indicates to obtain target information of a second event within four minutes after the query message is acquired. FIG. 7 is a waveform diagram of the trigger frequency of the second event at different times when the first event occurs according to an embodiment of the present application. The horizontal axis of the waveform diagram represents time in seconds, and the vertical axis of the waveform diagram represents the trigger probability of the second event when the first event occurs. As shown in FIG. 7 , when the first event occurs, the trigger probability of the second event has four larger values within the time period limited by the time condition. The four larger values appeared in the 7th second (ie 007"), 48th second (ie 048"), 1 minute 55 seconds (ie 155") and 2 minute 45 seconds ( That is, at 245"), that is, the predicted occurrence time of the second event is respectively the 7th second, the 48th second, the 1st minute 55th second and the 2nd minute 45th second after the query message is acquired. The four larger values are 49%, 65%, 86% and 27% respectively, that is, the trigger probabilities of the second event at the above four predicted occurrence times are 49%, 65%, 86% and 27% respectively.

Table 1 is a target information displayed in the form of text information provided by the embodiment of the present application, and on the basis of the waveform diagram shown in Figure 7, this Table 1 also shows the maximum value of the second event triggered by the first event Trigger probability, minimum trigger probability, mean trigger probability, and identification of the first event. According to this table 1, it can be known that: the first event's identification indicates that its name is ETH_LOS_0_Opt, and its identification number (ID) is 1, and the second event's identification indicates that its name is ETH_APS_LOST_0_Opt, and its identification number (ID) is 34, and the second event is identified by the first The maximum trigger probability, minimum trigger probability and average trigger probability of event triggering are 86%, 1% and 28% respectively, the total number of higher probability values is 4, and the occurrence times of these 4 higher probability values are 007", 048 respectively ", 155" and 245", the four larger probabilities are 49%, 65%, 86% and 27% respectively. Loose distribution, and the parameters λ are 0.1 and 0.005, respectively.

It can be seen from the above that, in the event analysis method provided by the embodiment of the present application, since the method can predict the second event that is triggered by the first event and has not occurred, and the trigger probability and predicted occurrence time of the second event Compared with related technologies, it is not only possible to analyze whether there is correlation between events, but also to analyze at least one of the trigger probability and predicted occurrence time of triggered events among correlated events. The analysis results intuitively reflect the analysis results of related events, and are highly interpretable. It realizes the diversity analysis of the correlation between events and enriches the analysis function of related events.

Table 1

Moreover, this method is actually based on the historical data of event occurrences, counting the law of one event causing another event to occur, and analyzing the correlation between events according to this law, and correlating events with the rules obtained from expert experience. The related technology of sex analysis can analyze the correlation between events in more situations, which ensures the scope of application of the method and does not need to inject expert experience. And because this method is not based on the rules obtained by expert experience, it does not need to synchronize the rules according to the expansion of the network, which will not affect the efficiency of development and operation and maintenance, and will not cause the increase of implementation cost and bit error rate.

In addition, since this method does not require feature extraction based on historical data, and the necessary information in historical data is the identification of events that have occurred and the time of occurrence of events that have occurred, compared with other related technologies that analyze the correlation between events, it reduces the The requirements for the data used for analysis can improve the generalization ability of the analysis and improve the stability of the analysis results.

Among them, in order to prove the effectiveness of the event analysis method provided by the embodiment of the present application, the embodiment of the present application also provides the actual waveform diagram and analysis model of the frequency of the second event occurring at different times when the first event occurs Schematic diagram of the comparison of the simulated waveforms obtained from the analysis. As shown in FIG. 8 , curve 1 in FIG. 8 is an actual waveform diagram obtained based on historical data, and curve 2 in FIG. 8 is a simulated waveform diagram obtained based on historical data analysis. According to this figure 8, it can be seen that the variation trend of the simulation waveform diagram in Fig. 8 can better fit the variation tendency of the actual waveform diagram, therefore, it can be determined that the method provided by the embodiment of the present application can effectively control the relevant Events are analyzed.

It should be noted that although the above description takes the prediction of the correlation between network faults as an example to illustrate the event analysis method provided by the embodiment of the present application, it does not limit that this method can only be used to predict network faults. predict the relationship between them. Moreover, since this method analyzes the connection between events in time series according to the historical data of events, and predicts the correlation between different events according to the connection in time series, this method can be applied to all events in time series Prediction scenarios between correlated events.

The process of training the analysis model is described below. According to the previous description, due to the different correlations between different events, the analysis model used to analyze the correlation of two events needs to use the historical data of the two events for training. The following uses the first event and The historical data of a third event (ie, the third event hereinafter) is used as an example to train the analysis model, and the training process of the analysis model will be described. As shown in Figure 9, the training process of the analysis model includes:

Step 901, based on the historical data of the first event and the historical data of the third event, obtain reference data of the probability that the first event triggers the third event over time.

The implementation process of step 901 is actually based on the first event and the historical data of any third time, using a statistical method to calculate that after each first event occurs, the second event is triggered by the first event at different times The probability. The calculated result is the reference data of the probability of the first event triggering the third event over time. For example, based on historical data, the first total number of occurrences and the second total number of non-occurrences of the third event after a specified time period after the occurrence of the first event can be counted, and according to the first total number and the second total number of times, it is obtained The conditional probability that the third event occurs after a specified time period after the first event occurs, and so on, obtains the reference data of the probability that the first event triggers the third event over time. Wherein, the reference data may be represented by a waveform diagram, the horizontal axis of the waveform diagram represents time in seconds, and the vertical axis of the waveform diagram represents the probability of the third event occurring when the first event occurs.

Step 902. Acquire initialization data of the probability that the first event triggers the third event over time.

The initialization data can be obtained by initializing the occurrence probabilities of the first event and the third event. In an implementable manner, as shown in FIG. 10, the implementation process of step 902 includes:

Step 9021: Based on the historical data of the first event and the historical data of the third event, count the total number of occurrences of the third event after the specified time period of the first event.

In a practicable manner, the occurrence moment of the third event can be recorded according to the historical data of the third event, and in the historical data of the first event, starting from each occurrence moment of the third event, along the In the backward direction of time, count the occurrence time of the first event before the third event each time, obtain the time difference between the corresponding third event and the occurrence time of the first event, and count the total times of occurrences of different time differences. In the description of "the third event occurs after the specified duration of the first event", the specified duration is equal to the time difference, and when the first event occurs before the third event with multiple time differences, the first event can be respectively obtained The total number of occurrences of the three events after the occurrence of the first event for a plurality of specified time periods, and the multiple time differences correspond to the multiple specified time periods one by one. For example, assuming that the statistical results show that the total number of occurrences of the first event 10 seconds before the occurrence of the third event is 100, and the total number of occurrences of the first event 13 seconds before the occurrence of the third event is 150, then the corresponding 10 seconds Time difference, the total number of times the third event occurs 10 seconds after the first event occurs is 100 times, corresponding to a time difference of 13 seconds, the total number of times the third event occurs 13 seconds after the first event occurs is 150 times. Moreover, in order to ensure the validity of the data, when performing statistics, the time of occurrence of the first event within a specified time window before the occurrence of the third event can also be limited and counted. For example, the occurrence time of the first event within one minute before the occurrence of the third event may be limited each time.

Step 9022. Acquire time feature points based on the total number of times. The first historical data indicates that the probability of the first event triggering the third event at the time feature point is greater than or equal to the reference probability threshold.

After the total number of times is counted, the time feature points that reflect the occurrence time of the first event and the third event with greater connection can be obtained according to the total number of times. And in order to ensure the accuracy of the connection between the acquired first event and the third event in terms of occurrence time, some acquisition principles may be set for time feature points. For example, the acquisition principle needs to ensure that the probability that the first event triggers the third event at the time feature point is greater than or equal to the reference probability threshold. When the probability of the first event triggering the third event at the time feature point is greater than or equal to the reference probability threshold, the occurrence of the first event can effectively trigger the third event. The reference probability threshold may be determined according to application requirements. For example, the reference probability threshold may be set to 50%, which is not specifically limited in this embodiment of the present application.

There are multiple implementations for acquiring time feature points, and the embodiment of the present application uses the following three implementations as examples to describe the implementations.

In the first practicable manner, time feature points may be obtained according to the total number of times and the change of the total number of times. For example, the total number of occurrences of the third event after the specified duration t1, t1+1, and t1-1 of the first event can be obtained respectively, and the total number of occurrences of the third event after the specified duration of t1-1 of the first event can be obtained Relative to the first change gradient of the total number of occurrences after the specified time length t1, and obtain the third event’s total number of occurrences after the first event occurs with the specified time length t1 relative to the total number of occurrences after the specified time length t1+1 Two change gradients, and the total number of occurrences of the third event after the specified time length t1 of the first event is greater than the total number of occurrences of the first event after the specified time length t1-1 and t1+1, and the first change gradient and the second change gradient are greater than the specified gradient threshold, the specified time length t1 is determined as the time feature point. Wherein, when the time feature points are obtained in this way, when the first event occurs, in the waveform diagram of the probability of the third event occurring at different times, the probability of the third event occurring at the time feature point shows is a local peak, that is, at this time feature point, the occurrence of the third event has a greater relationship with the occurrence of the first event.

In the second practicable manner, the time feature points may be acquired in a sliding window manner during the generation time period of the historical data of the first event and the historical data of the third event. The implementation process includes: setting a time window with a certain duration, and the sliding step of the time window sliding in the generation time period, controlling the time window from the starting point of the time period along the development direction of the generation time period according to The sliding step is used to slide. When the time window slides to a position, in the sub-time period of the generation time period covered by the time window, the third event at all time points in the sub-time period is counted in the first event The first total number of occurrences after the specified time period occurs, and the second total number of occurrences of the third event at all time points in the generation time period after the specified time period of the first event occurs, when the first total number reaches the second When the percentage of the total times reaches the percentage threshold, the time center point of the sub-time period is determined as the time feature point.

In the third practicable way, first, according to the historical data of the first event and the historical data of the third event, determine the maximum value of the total number of occurrences of the third event after the specified time period of the first event, and set the maximum value, and then in the generation time period when the historical data of the first event and the historical data of the third event are generated, filter the jitter threshold where the total number of occurrences of the third event reaches the maximum value after the first event occurs for a specified time period Time points within the range, and the filtered time points are determined as time feature points.

Step 9023: Perform first initialization on the probability that the first event triggers the third event at the time feature point.

The essence of the first initialization process is to initialize the conditional probability that the third event occurs after the duration indicated by the time feature point when the first event occurs. In addition, the conditional probability may be initialized randomly, for example, the conditional probability may be initialized as 0 or 0.5.

Step 9024: Carry out second initialization on the probabilities of the first event and the third event occurring within a specified time period respectively.

The essence of the second initialization process is to initialize the probability distributions of the natural occurrence probabilities of the first event and the third event over time. For example, it may be assumed that the probability distributions of the first event and the third event are both Poisson distributions, and the parameter λ of the Poisson distribution of the first event is λ1, and the parameter λ of the Poisson distribution of the third event is λ2. Moreover, the second initialization may also be performed on the probability distributions of the first event and the third event randomly, and the probability distributions of the first event and the third event may be initialized in any distribution manner.

Step 9025: Based on the results of the first initialization and the results of the second initialization, the initialization data of the probability that the first event triggers the third event changes with time is obtained.

After the first initialization and the second initialization, the time-varying data of the probability that the first event triggers the third event may be determined according to the result of the first initialization and the result of the second initialization. Wherein, at any time feature point, the probability that the first event triggers the third event may be based on the probability that the third event occurs naturally, and the third event occurs after the time period indicated by the time feature point after the first event occurs. The conditional probability of occurrence is obtained. At any time point that is not a time feature point, the probability that the third event occurs at the time point can be obtained according to the probability that the third event occurs naturally. Moreover, the probability of the third event occurring naturally can be obtained according to the probability distribution of the third event, and the conditional probability of the third event occurring after the duration indicated by the time feature point after the occurrence of the first event can be obtained according to the probability distribution of the third event The probability distribution and the probability distribution of the first event are obtained.

It should be noted that, when the historical data of the first event and the historical data of the third event reflect that the third event has a delay probability, a third initialization of the delay probability is also required in step 902, and correspondingly, the initialization data It is also necessary to reflect the results of this third initialization. In an implementable manner, the delay probability may be initialized randomly. For example, the delay probability may be initialized to 0.7 or 0.8 and so on. When the third event is determined to have a delay probability according to the historical data, by performing a third initialization on the delay probability, the probability of the first event triggering the third event obtained according to the initialization data can be better simulated when the probability of the third event is triggered by the initialization data. Combined with the fact that the probability of the first event triggering the third event obtained from historical data changes with time, the training result of the analysis model is better, and the performance of the analysis model is guaranteed.

Step 903: Train the analysis model based on the reference data and initialization data.

The process of training the analysis model is to iteratively adjust the parameters of the analysis model according to the reference data and different initialization data until the training cut-off condition is reached. Wherein, in different initialization processes, when at least one of the result of the first initialization and the result of the second initialization this time changes compared to the result of the first initialization and the result of the second initialization in the previous initialization process , it can be considered that the initialization data obtained this time has changed compared with the initialization data obtained last time. Moreover, the first initialization result that makes the training process reach the training cut-off condition can be regarded as the optimal conditional probability that the first event triggers the third event, and the achieved second initialization result can be regarded as the natural occurrence of the first event and the third event The optimal probability distribution for probabilities. When the initialization data is also obtained according to the third initialization, the third initialization result that makes the training process reach the training cut-off condition can be regarded as the optimal delay probability of the third event.

The process of training the analysis model according to the reference data and a set of initialization data is described below as an example. The set of initialization data is the initialization data obtained by performing the first initialization once and the second initialization once. Since both the reference data and the initialization data are data that the probability of the first event triggering the third event changes with time, the similarity between the reference data and the initialization data can be obtained, and then the parameters of the analysis model can be adjusted according to the similarity The referenced loss function, and then obtain the gradient for adjusting the parameters of the analysis model according to the loss function, then adjust the parameters of the analysis model according to the gradient, and judge whether to complete the training process according to whether the training cut-off condition is reached.

Wherein, both reference data and initialization data can be represented by waveforms. The implementation process of obtaining the similarity between the reference data and the initialization data may include: according to the first waveform used to represent the reference data and the second waveform used to represent the initialization data, respectively determine the first waveform and the second waveform in each The amplitude difference at the time point, and then according to the amplitude difference between the first waveform and the second waveform at different time points, determine the waveform similarity between the first waveform and the second waveform, and the waveform similarity is Similarity between reference data and initialization data. Optionally, according to the implementation principle of obtaining the waveform similarity of the first waveform and the second waveform according to the difference in amplitude, reference may be made to mean square error (mean square error, MSE), cosine similarity, dynamic time normalization (dynamic Time warping, DTW) distance and absolute mean percentage error (mean absolute percentage error, MAPE) and other technical principles, will not be repeated here.

The loss function referenced for adjusting the parameters of the analysis model can be a function of similarity. After obtaining the similarity, the similarity can be brought into the function expression of the loss function to obtain the value of the loss function, and then The gradient for adjusting the parameters of the analysis model is determined according to the value of the loss function.

In the embodiment of the present application, the analysis model may be an artificial intelligence model or other types of models, which are not specifically limited in the embodiment of the present application. Moreover, when the analysis model is an AI model, it may specifically be a neural network model, and at this time, parameters of the analysis model may be parameters such as weights of neurons in the neural network.

It should be noted that the sequence of steps in the event analysis method provided in the embodiment of the present application can be adjusted appropriately, and the steps can also be increased or decreased according to the situation. Any person skilled in the art within the technical scope disclosed in this application can easily think of changes, which should be covered within the scope of protection of this application, and thus will not be repeated here.

The embodiment of the present application also provides a program debugging device. Please refer to FIG. 11 for a structural diagram of the program debugging device. As shown in FIG. 11 , the event analysis device 110 includes:

The interaction module 1101 is used to obtain the query message of the first event, the query message is used to query the target information of the second event, the second event is triggered by the first event, and the first event is an event that has occurred at the first time, The second event is a predicted event that does not occur at the first time, and the first time is less than or equal to the time when the query message is obtained.

The obtaining module 1102 is configured to obtain target information based on the query message, where the target information includes the event identifier, trigger probability and/or predicted occurrence time of the second event.

Optionally, the query message includes a filter condition, and the query message including the filter condition is used to query target information satisfying the filter condition, and the filter condition includes one or more of the following: time condition, probability condition, and device condition.

Wherein, the device condition includes one or more of the following device attributes: device identifier, the area where the device is located, the device type, the network topology where the device is located, the manufacturer of the device, and the user of the device. A device with an association occurs.

Optionally, the query message is obtained based on query parameters input by the user on the query interface, or based on interface components selected by the user on the query interface, or obtained from a third-party system through an application programming interface.

Optionally, the obtaining module 1102 is further configured to: obtain the first historical data of events that have occurred at the first time in the events managed by the event analysis device 110, the first historical data includes: the identifier of the event that has occurred and the event that has occurred The first historical data includes historical data of the first event and historical data of the third event, and the third event is an event that has the same identifier as the second event among the events that have occurred at the first time.

Correspondingly, the obtaining module 1102 is specifically configured to: analyze the first historical data to obtain target information.

Optionally, the obtaining module 1102 is specifically configured to: obtain target information based on the first historical data and an analysis model, where the analysis model belongs to an artificial intelligence model.

Optionally, the obtaining module 1102 is specifically configured to: obtain target information based on the first historical data, analysis indication information, and analysis model, where the analysis indication information is used to indicate that the first event is used as a pre-event that triggers the occurrence of the second event.

Optionally, the second event associated with the first event includes one or more, and the obtaining module 1102 is specifically configured to: pre-screen the first historical data, obtain the historical data of the first event and any third The historical data of the event, any third event is an event that has the same identifier as any second event among the events that have occurred at the first time; the indicator information, the historical data of the first event and the data of any third event will be analyzed The historical data is input into the analysis model, and the target information of any second event output by the analysis model is obtained.

Optionally, as shown in FIG. 12 , the device 110 further includes: a training module 1103, and the training module 1103 is configured to: based on the historical data of the first event and the historical data of any third event, acquire any The reference data of the probability of the third event changing over time, the second event associated with the first event includes one or more, any third event is an event that has occurred at the first time, and any second event Events with the same identifier; obtain the initialization data of the probability that the first event triggers any third event over time, and the initialization data is obtained by initializing the occurrence probability of the first event and any third event; based on the reference data and the initialization data to train the analysis model.

Optionally, the training module 1103 is specifically configured to: based on the historical data of the first event and the historical data of any third event, count the total number of occurrences of any third event after the first event occurs for a specified period of time; Acquiring time feature points, the first historical data indicates that the probability of the first event triggering any third event at the time feature point is greater than or equal to the reference probability threshold; at the time feature point, the probability of the first event triggering any third event is calculated One initialization; the second initialization is performed on the probability of occurrence of the first event and any third event in a specified time period respectively; based on the result of the first initialization and the result of the second initialization, the first event triggers any third event The probability of occurrence varies with time to initialize the data.

To sum up, in the event analysis device provided by the embodiment of the present application, since the acquisition module can predict the second event that is triggered by the first event and has not occurred, and the trigger probability and predicted occurrence of the second event At least one of the times is predicted. Compared with related technologies, it is not only possible to analyze whether there is correlation between events, but also to analyze at least one of the trigger probability of the triggered event and the predicted occurrence time of the correlated events. The analysis results intuitively reflect the analysis results of related events, and are highly interpretable. It realizes the diversity analysis of the correlation between events and enriches the analysis function of related events.

Moreover, the device actually counts the law of one event causing another event based on the historical data of the event, and analyzes the correlation between the events according to the law, and correlates the events with respect to the rules obtained from expert experience. The relevant technology of sex analysis can analyze the correlation between events in more situations, which ensures the scope of application of the device, and does not need to inject expert experience. And because the device does not analyze according to the rules obtained by expert experience, it does not need to synchronize the rules according to the expansion of the network, which will not affect the efficiency of development and operation and maintenance, and will not cause the increase of implementation cost and bit error rate.

In addition, since the device does not need to perform feature extraction based on historical data, and the necessary information in historical data is the identification of events that have occurred and the time of occurrence of events that have occurred, compared with other related technologies that determine the correlation between events, it reduces the The requirements for the data used for analysis can improve the generalization ability of the analysis and improve the stability of the analysis results.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described devices and modules can refer to the corresponding content in the foregoing method embodiments, and details are not repeated here.

Fig. 13 is a schematic structural diagram of an analysis device provided by an embodiment of the present application. The analysis device may be the first device 01 described above in FIG. 1 and FIG. 2 , and specifically, the analysis device may be a computer device. When the analysis device is a computer device, as shown in FIG. 13 , the computer device 130 includes a memory 1301 , a processor 1302 , a communication interface 1303 and a bus 1304 . Wherein, the memory 1301 , the processor 1302 , and the communication interface 1303 are connected to each other through a bus 1304 . Moreover, the computer device 130 may include multiple processors 1302, so that different processors may be used to realize the functions of the above-mentioned different functional modules.

The memory 1301 may be a read only memory (read only memory, ROM), a static storage device, a dynamic storage device or a random access memory (random access memory, RAM). The memory 1301 may store an executable code sequence. When the executable code stored in the memory 1301 is executed by the processor 1302, the processor 1302 and the communication interface 1303 are used to execute the event analysis method provided by the embodiment of the present application. The memory 1301 may also include software modules and data required by other running processes such as an operating system. And the operating system can be LINUX ^TM , UNIX ^TM , WINDOWS ^TM and so on.

The processor 1302 may be a general-purpose central processing unit (central processing unit, CPU), a microprocessor, an application specific integrated circuit (application specific integrated circuit, ASIC), a graphics processing unit (graphics processing unit, GPU) or one or more integrated circuit.

The processor 1302 may also be an integrated circuit chip with signal processing capabilities. During implementation, part or all of the functions of the event analysis method of the present application may be implemented by an integrated logic circuit of hardware in the processor 1302 or instructions in the form of software. The above-mentioned processor 1302 can also be a general-purpose processor, a digital signal processor (digital signal processing, DSP), an application-specific integrated circuit (ASIC), a ready-made programmable gate array (field programmable gate array, FPGA) or other programmable logic devices , discrete gate or transistor logic devices, discrete hardware components. Various methods, steps, and logic block diagrams disclosed in the embodiments of the present application may be implemented or executed. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like. The steps of the method disclosed in connection with the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register. The storage medium is located in the memory 1301, and the processor 1302 reads the information in the memory 1301, and combines its hardware to complete the event analysis method of the embodiment of the present application.

The communication interface 1303 uses a transceiver module such as but not limited to a transceiver to implement communication between the computer device 130 and other devices or communication networks. For example, the communication interface 1303 may be any one or any combination of the following devices: a network interface (such as an Ethernet interface), a wireless network card and other devices with network access functions.

Bus 1304 may include pathways for transferring information between various components of computer device 130 (eg, memory 1301 , processor 1302 , communication interface 1303 ).

It should be noted that, when the computer device is a terminal, the computer device further includes a display screen for displaying a graphical user interface of the program development platform.

A communication path is established between each of the above-mentioned computer devices 130 through a communication network. Each computer device 130 is configured to realize some functions of the event analysis method provided by the embodiment of the present application. Any computer device 130 may be a computer device (for example: a server) in a cloud data center, or a computer device in an edge data center, or the like.

The descriptions of the processes corresponding to the above-mentioned figures have their own emphasis. For the parts not described in detail in a certain process, you can refer to the relevant descriptions of other processes.

In the above embodiments, all or part of them may be implemented by software, hardware, firmware or any combination thereof. When implemented using software, it may be implemented in whole or in part in the form of a computer program product. The computer program product that provides the program development platform includes one or more computer instructions. When these computer program instructions are loaded and executed on the computer device, the process or function of the event analysis method provided by the embodiment of the present application is fully or partially realized.

The computer equipment can be a general purpose computer, special purpose computer, a computer network, or other programmable apparatus. Computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, e.g. Coaxial cable, optical fiber, digital subscriber line or wireless (such as infrared, wireless, microwave, etc.) transmission to another website site, computer, server or data center.Computer-readable storage medium stores a computer program that provides a program development platform instruction.

The embodiment of the present application also provides a storage medium, which is a non-volatile computer-readable storage medium. When the instructions in the storage medium are executed by the processor, the event analysis method provided by the embodiment of the present application is implemented. .

The embodiment of the present application also provides a computer program product containing instructions, and when the computer program product is run on the computer, the computer is made to execute the event analysis method provided in the embodiment of the present application.

Those of ordinary skill in the art can understand that all or part of the steps for implementing the above embodiments can be completed by hardware, and can also be completed by instructing related hardware through a program. The program can be stored in a computer-readable storage medium. The above-mentioned The storage medium mentioned may be a read-only memory, a magnetic disk or an optical disk, and the like.

In the embodiments of the present application, the terms "first", "second" and "third" are used for description purposes only, and cannot be understood as indicating or implying relative importance. The term "at least one" means one or more, and the term "plurality" means two or more, unless otherwise clearly defined.

The term "and/or" in this application is only an association relationship describing associated objects, which means that there may be three relationships, for example, A and/or B, which may mean: A exists alone, A and B exist simultaneously, and A and B exist alone. There are three cases of B. In addition, the character "/" in this article generally indicates that the contextual objects are an "or" relationship.

The above are only optional embodiments of the application, and are not intended to limit the application. Any modifications, equivalent replacements, improvements, etc. made within the concept and principles of the application shall be included in the protection of the application. within range.

Claims (21)

1. A method for event analysis, characterized in that the method is applied to a communication device, and the method includes:

   Obtain a query message of the first event, the query message is used to query the target information of the second event, the second event is triggered by the first event, and the first event has occurred at the first time event, the second event is a predicted event that did not occur at the first time, and the first time is less than or equal to the time when the query message is obtained;

   Based on the query message, the target information is obtained, where the target information includes the event identifier, trigger probability and/or predicted occurrence time of the second event.
2. The method according to claim 1, wherein the query message includes a filter condition, and the query message including the filter condition is used to query target information satisfying the filter condition, and the filter condition includes one or more of the following One: time condition, probability condition and equipment condition;

   The device condition includes one or more of the following device attributes: device identifier, the area where the device is located, the device type, the network topology where the device is located, the manufacturer of the device, and the user of the device. The above-mentioned second event occurrence is associated with the device.
3. The method according to claim 1 or 2, wherein the query message is obtained based on query parameters input by the user on the query interface, or obtained based on an interface component selected by the user on the query interface, or obtained by The application programming interface API is obtained from the third-party system.
4. The method according to any one of claims 1 to 3, wherein, before obtaining the target information based on the query message, the method further comprises:

   Acquiring first historical data of events that have occurred at the first time in the events managed by the communication device, where the first historical data includes: the identifier of the event that has occurred and the time of occurrence of the event that has occurred, the The first historical data includes historical data of the first event and historical data of a third event, the third event is an event that has the same identifier as the second event among the events that have occurred at the first time ;

   The obtaining of the target information includes:

   Analyzing the first historical data to obtain the target information.
5. The method according to claim 4, wherein the analyzing the first historical data to obtain the target information comprises:

   The target information is obtained based on the first historical data and an analysis model, where the analysis model belongs to an artificial intelligence model.
6. The method according to claim 5, wherein said obtaining said target information based on said first historical data and an analysis model comprises:

   The target information is obtained based on the first historical data, analysis indication information, and analysis model, where the analysis indication information is used to indicate that the first event is used as a pre-event that triggers the occurrence of the second event.
7. The method according to claim 6, wherein the second event associated with the first event includes one or more, and the obtained The target information includes:

   Pre-screening the first historical data to obtain historical data of the first event and historical data of any third event, where any third event is an event that has occurred at the first time, and any second event has the same identity as the event;

   inputting the analysis indication information, the historical data of the first event and the historical data of any third event into the analysis model, and obtaining the target of the any second event output by the analysis model information.
8. The method according to claim 6 or 7, wherein, before obtaining the target information based on the first historical data, analysis indication information and analysis model, the method further comprises:

   Based on the historical data of the first event and the historical data of any third event, obtain the reference data of the probability that the first event triggers any third event over time, which is associated with the first event The specific second event includes one or more, and any third event is an event that has the same identifier as any second event among the events that have occurred at the first time;

   Acquiring initialization data of the probability of the first event triggering the any third event changing over time, the initialization data is obtained by initializing the occurrence probabilities of the first event and the any third event;

   The analysis model is trained based on the reference data and the initialization data.
9. The method according to claim 8, wherein the acquiring the initialization data of the probability that the first event triggers any third event changes over time comprises:

   Based on the historical data of the first event and the historical data of any third event, counting the total number of occurrences of any third event after the first event occurs for a specified period of time;

   Acquiring time feature points based on the total number of times, the first historical data indicates that the probability of the first event triggering any third event at the time feature point is greater than or equal to a reference probability threshold;

   Performing a first initialization on the probability that the first event triggers any third event at the time feature point;

   performing a second initialization on the probabilities of occurrence of the first event and any third event within a specified time period, respectively;

   Based on the result of the first initialization and the result of the second initialization, the initialization data of the probability that the first event triggers the occurrence of any third event changing over time is obtained.
10. A device for event analysis, characterized in that the device comprises:

    An interaction module, configured to acquire a query message of a first event, the query message is used to query target information of a second event, the second event is triggered by the first event, and the first event is An event that has occurred at a time, the second event is a predicted event that has not occurred at the first time, and the first time is less than or equal to the time when the query message is obtained;

    An obtaining module, configured to obtain the target information based on the query message, where the target information includes the event identifier, trigger probability and/or predicted occurrence time of the second event.
11. The device according to claim 10, wherein the query message includes a filter condition, and the query message including the filter condition is used to query target information satisfying the filter condition, and the filter condition includes one or more of the following One: time condition, probability condition and equipment condition;

    The device condition includes one or more of the following device attributes: device identifier, the area where the device is located, the device type, the network topology where the device is located, the manufacturer of the device, and the user of the device. The above-mentioned second event occurrence is associated with the device.
12. The device according to claim 10 or 11, wherein the query message is obtained based on query parameters input by the user on the query interface, or obtained based on an interface component selected by the user on the query interface, or obtained by The application programming interface API is obtained from the third-party system.
13. The device according to any one of claims 10 to 12, wherein the obtaining module is further configured to: obtain the first historical data of events that have occurred at the first time in the events managed by the device, the The first historical data includes: the identification of the occurred event and the occurrence time of the occurred event, the first historical data includes the historical data of the first event and the historical data of the third event, and the first The third event is an event that has the same identifier as the second event among the events that have occurred at the first time;

    The obtaining module is specifically configured to: analyze the first historical data to obtain the target information.
14. The device according to claim 13, wherein the obtaining module is specifically used for:

    The target information is obtained based on the first historical data and an analysis model, where the analysis model belongs to an artificial intelligence model.
15. The device according to claim 14, wherein the obtaining module is specifically used for:

    The target information is obtained based on the first historical data, analysis indication information, and analysis model, where the analysis indication information is used to indicate that the first event is used as a pre-event that triggers the occurrence of the second event.
16. The device according to claim 15, wherein the second event associated with the first event includes one or more, and the obtaining module is specifically configured to:

    Pre-screening the first historical data to obtain historical data of the first event and historical data of any third event, where any third event is an event that has occurred at the first time, and any second event has the same identity as the event;

    inputting the analysis indication information, the historical data of the first event and the historical data of any third event into the analysis model, and obtaining the target of the any second event output by the analysis model information.
17. The device according to claim 15 or 16, wherein the device further comprises: a training module, the training module is used for:

    Based on the historical data of the first event and the historical data of any third event, obtain the reference data of the probability that the first event triggers any third event over time, which is associated with the first event The specific second event includes one or more, and any third event is an event that has the same identifier as any second event among the events that have occurred at the first time;

    Acquiring initialization data of the probability of the first event triggering the any third event changing over time, the initialization data is obtained by initializing the occurrence probabilities of the first event and the any third event;

    The analysis model is trained based on the reference data and the initialization data.
18. The device according to claim 17, wherein the training module is specifically used for:

    Based on the historical data of the first event and the historical data of any third event, counting the total number of occurrences of any third event after the first event occurs for a specified period of time;

    Acquiring time feature points based on the total number of times, the first historical data indicates that the probability of the first event triggering any third event at the time feature point is greater than or equal to a reference probability threshold;

    Performing a first initialization on the probability that the first event triggers any third event at the time feature point;

    performing a second initialization on the probabilities of occurrence of the first event and any third event within a specified time period, respectively;

    Based on the result of the first initialization and the result of the second initialization, the initialization data of the probability that the first event triggers the occurrence of any third event changing over time is obtained.
19. An analysis device, characterized in that the analysis device comprises: a processor and a memory, and a computer program is stored in the memory; when the processor executes the computer program, the analysis device realizes any one of claims 1 to 9 the method described.
20. A non-transitory computer-readable storage medium, characterized in that when the instructions in the computer-readable storage medium are executed by a processor, the processor executes the method according to any one of claims 1 to 9.
21. A computer program product containing instructions, characterized in that, when the instructions in the computer program product are run on a computer, the computer executes the method according to any one of claims 1 to 9.

Images