WO2023045417A1 - Fault knowledge graph construction method and apparatus - Google Patents

Abstract

Provided are a fault knowledge graph construction method and apparatus. The method comprises: performing entity and relationship extraction on a rule base, so as to obtain a first candidate set that comprises an alarm relationship instance and a work order distribution instance (S202); performing entity and relationship extraction on real-time data, so as to obtain a second candidate set of an alarm association relationship and a work order distribution relationship (S204); performing conflict detection according to the first candidate set and the second candidate set, so as to obtain a target candidate set that comprises a valid alarm association relationship and work order distribution knowledge (S206); and fusing the target candidate set into a fault knowledge graph that is constructed according to the rule base, so as to obtain an updated fault knowledge graph (S208). The problem in the related art of it being impossible to quickly adapt to new services and new scenarios when relying on the mapping conversion between a rule base and a knowledge base can be solved; and by means of combining the entity and relationship extraction of real-time data and the rule base, a fault knowledge graph is updated, such that the fault knowledge graph can quickly adapt to new services and new scenarios.

Description

A method and device for constructing a fault knowledge map

Cross References to Related Applications

This disclosure is based on the Chinese patent application CN202111123124.5 filed on September 24, 2021 with the title of "a method and device for constructing a fault knowledge map", and claims the priority of this patent application, and the disclosed content is incorporated by reference All are incorporated into this disclosure.

technical field

Embodiments of the present disclosure relate to the communication field, and in particular, to a method and device for constructing a fault knowledge graph.

Background technique

In the process of building a fault knowledge map, knowledge extraction is an essential process. It extracts knowledge from different data sources and data of different structures to form a data structure for fault knowledge map understanding, such as the Resource Description Framework (Resource Description Framework, Referred to as RDF) triples, and finally merged into the fault knowledge map.

For O&M support, it is not enough to extract knowledge from the rule base and knowledge base. Especially in 5G scenarios, the rules for many new services and scenarios have not yet been formed, and real-time O&M data, such as alarms, logs, and work orders, must be obtained. Analyze the operation and maintenance data, use the experience of artificial experts to form rules, and inject them into the knowledge map of telecom operation and maintenance faults. Relying on the mapping and transformation of the rule base and knowledge base cannot quickly adapt to new business and new scenarios. Relying on manual knowledge extraction is not only relatively inefficient, but also cannot guarantee the quality.

Aiming at the problem that the related technology relies on the mapping transformation of the rule base and the knowledge base and cannot quickly adapt to new business and new scenarios, no solution has been proposed yet.

Contents of the invention

The embodiment of the present disclosure provides a method and device for constructing a fault knowledge map, to at least solve the problem of relying on the mapping conversion of the rule base and the knowledge base in related technologies, which cannot quickly adapt to new business and new scenarios, and relying on manual knowledge extraction is not only relatively inefficient , the quality cannot be guaranteed.

According to an embodiment of the present disclosure, a fault knowledge map construction method is provided, including:

Extract entities and relationships from the rule base to obtain the first candidate set including alarm relationship instances and work order dispatch instances;

Extract entities and relationships from real-time data to obtain the second candidate set of alarm association relationship and work order dispatch relationship;

Performing conflict detection according to the first candidate set and the second candidate set to obtain a target candidate set including effective alarm correlation and work order dispatch knowledge;

The target candidate set is integrated into the fault knowledge graph constructed according to the rule base to obtain an updated fault knowledge graph.

According to another embodiment of the present disclosure, a device for constructing a fault knowledge map is also provided, including:

The first extraction module is configured to extract entities and relationships from the rule base to obtain a first candidate set including alarm relationship instances and work order dispatch instances;

The second extraction module is configured to extract entities and relationships from real-time data to obtain a second candidate set of alarm association relationships and work order dispatch relationships;

The conflict detection module is configured to perform conflict detection according to the first candidate set and the second candidate set to obtain a target candidate set including effective alarm correlation and work order dispatch knowledge;

The update module is configured to integrate the target candidate set into the fault knowledge graph constructed according to the rule base to obtain an updated fault knowledge graph.

According to yet another embodiment of the present disclosure, there is also provided a computer-readable storage medium, where a computer program is stored in the storage medium, wherein the computer program is set to execute any one of the above method embodiments when running in the steps.

According to yet another embodiment of the present disclosure, there is also provided an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to perform any of the above Steps in the method examples.

In the embodiment of the present disclosure, the entity and relationship extraction is performed on the rule base to obtain the first candidate set including the alarm relationship instance and the work order dispatch instance; the entity and relationship extraction is performed on the real-time data to obtain the alarm association relationship and the work order dispatch relationship the second candidate set; perform conflict detection according to the first candidate set and the second candidate set, and obtain a target candidate set including effective alarm correlation and work order dispatch knowledge; integrate the target candidate set into the The fault knowledge graph constructed by the rule base can obtain an updated fault knowledge graph, which can solve the problem in related technologies that relies on the mapping conversion of the rule base and the knowledge base, and cannot quickly adapt to new business and new scenarios. Through real-time data and rule base The combination of entity and relationship extraction updates the fault knowledge graph, enabling the fault knowledge graph to quickly adapt to new business and new scenarios.

Description of drawings

FIG. 1 is a block diagram of a hardware structure of a mobile terminal in a method for constructing a fault knowledge map according to an embodiment of the present disclosure;

FIG. 2 is a flow chart of a fault knowledge map construction method according to an embodiment of the present disclosure;

FIG. 3 is a schematic diagram of a fault knowledge graph RDF according to an embodiment of the present disclosure;

Fig. 4 is a schematic diagram of knowledge extraction in a fault knowledge map according to an embodiment of the present disclosure;

Fig. 5 is a schematic diagram of an alarm correlation rule according to an embodiment of the present disclosure;

Fig. 6 is a schematic diagram of work order dispatching rules according to an embodiment of the present disclosure;

7 is a schematic diagram (1) of real-time work order fault handling according to an embodiment of the present disclosure;

FIG. 8 is a schematic diagram (2) of real-time work order fault handling according to an embodiment of the present disclosure;

FIG. 9 is a schematic diagram (1) of knowledge entity vectorization according to an embodiment of the present disclosure;

Fig. 10 is a schematic diagram (2) of knowledge entity vectorization according to an embodiment of the present disclosure;

Fig. 11 is a flow chart of alarm correlation rule extraction according to an embodiment of the present disclosure;

FIG. 12 is a flowchart of real-time data extraction according to an embodiment of the present disclosure;

FIG. 13 is a flowchart of feature engineering according to an embodiment of the present disclosure;

FIG. 14 is a flowchart of conflict detection according to an embodiment of the present disclosure;

Fig. 15 is a block diagram of an apparatus for constructing a fault knowledge graph according to another embodiment of the present disclosure.

Detailed ways

Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings and in combination with the embodiments.

It should be noted that the terms "first" and "second" in the specification and claims of the present disclosure and the above drawings are used to distinguish similar objects, but not necessarily used to describe a specific sequence or sequence.

The method embodiments provided in the embodiments of the present disclosure may be executed in mobile terminals, computer terminals or similar computing devices. Taking running on a mobile terminal as an example, Fig. 1 is a block diagram of the hardware structure of the mobile terminal according to the fault knowledge map construction method of the embodiment of the present disclosure. As shown in Fig. 1, the mobile terminal may include one or more (only shown in Fig. 1 a) a processor 102 (the processor 102 may include but not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the above-mentioned mobile terminal may also include a memory for communication Functional transmission device 106 and input and output device 108 . Those skilled in the art can understand that the structure shown in FIG. 1 is only for illustration, and it does not limit the structure of the above mobile terminal. For example, the mobile terminal may also include more or fewer components than those shown in FIG. 1 , or have a different configuration from that shown in FIG. 1 .

The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the fault knowledge map construction method in the embodiment of the present disclosure, and the processor 102 runs the computer program stored in the memory 104, thereby Executing various functional applications and slicing processing of the service chain address pool is to realize the above-mentioned method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory that is remotely located relative to the processor 102, and these remote memories may be connected to the mobile terminal through a network. Examples of the aforementioned networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The transmission device 106 is used to receive or transmit data via a network. The specific example of the above network may include a wireless network provided by the communication provider of the mobile terminal. In one example, the transmission device 106 includes a network interface controller (NIC for short), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (Radio Frequency, referred to as RF) module, which is used to communicate with the Internet in a wireless manner.

In this embodiment, a fault knowledge map construction method running on the above-mentioned mobile terminal or network architecture is provided, which is applied to the terminal, and the terminal accesses the current master node of the source area through a dual connection (Dual Connection, referred to as DC) (Master Node, referred to as MN for short) cell and current secondary node (Secondary Node, referred to as SN for short) cell, Fig. 2 is the flow chart of the fault knowledge map construction method according to an embodiment of the present disclosure, as shown in Fig. 2, this process At least including but not limited to the following steps:

Step S202, extracting entities and relationships from the rule base to obtain a first candidate set including alarm relationship instances and work order dispatch instances;

Step S204, extracting entities and relationships from the real-time data to obtain a second candidate set of alarm association relationships and work order dispatch relationships;

Step S206, performing conflict detection according to the first candidate set and the second candidate set, to obtain a target candidate set including effective alarm correlation and work order dispatch knowledge;

Step S208, integrating the target candidate set into the fault knowledge graph constructed according to the rule base to obtain an updated fault knowledge graph.

Through the above steps S202 to S208, it is possible to solve the problem of relying on the mapping conversion of the rule base and the knowledge base in related technologies, which cannot quickly adapt to new business and new scenarios, and update the fault knowledge map through the combination of real-time data and entity and relationship extraction of the rule base , so that the fault knowledge map can quickly adapt to new business and new scenarios.

In the embodiment of the present disclosure, the above step S202 may specifically include:

For the alarm association rules in the rule base, the association relationship between different alarms is extracted through key fields to form the alarm relationship instance. Specifically, parent-child alarms and rule description content are extracted according to the first key field; according to the first key field Two key fields carry out left and right participle to described rule description content, obtain left participle and right participle; Described left participle, described right participle and parent-child alarm are carried out category matching respectively, to form described alarm correlation instance;

For the work order dispatching rules in the rule base, the relationship between different alarms in the order dispatching conditions is extracted through key fields to form the work order dispatching instance.

In an optional embodiment, before the above step S202, the semi-structured data in the rule base is converted into structured data.

In the embodiment of the present disclosure, the above step S204 may specifically include: performing correlation mining on the alarm data in the real-time data to obtain a correlation alarm; extracting the alarm content according to the key field from the work order data in the real-time data and fault handling content, wherein, the fault handling content includes at least the fault handling situation, the preliminary judgment of the cause of the fault, and the fault handling opinion; word segmentation processing is performed on the alarm content and the fault handling content to obtain one or more cause alarms; Determine the alarm vectors of the one or more cause alarms according to the similarity; match the alarm vectors with the correlation alarms to obtain the alarm association relationship and the work order dispatch relationship.

In the embodiment of the present disclosure, the above step S208 may specifically include: performing the following operations on each alarm association relationship and each work order dispatching relationship in the second candidate set to obtain valid alarm association relations and work order dispatching knowledge The target candidate set formed, wherein, the ongoing alarm association relationship and work order dispatch relationship is called the current alarm association relationship and the current work order dispatch relationship: judging whether the current alarm association relationship exists in the first A candidate set; if the judgment result is no, determine that the current alarm association relationship is valid through machine learning; if the judgment result is yes, when the current alarm association relationship and the alarm in the first candidate set When the relationship instance does not match and there is no conflict, determine whether the data frequency of the current alarm association relationship is less than a preset threshold, and if the determination result is no, determine that the current alarm association relationship is the effective Alarm association relationship; judging whether the current work order dispatch relationship exists in the work order dispatch instance of the first candidate set; if the judgment result is no, correlating the current work order dispatch relationship with Alerts are merged into the ticket dispatch knowledge.

In another optional embodiment, before the above step S208, the alarm association relationship in the target candidate set is summarized according to the correlation; the work order dispatch relationship in the target candidate set is summarized according to the dispatch order.

In the embodiment of the present disclosure, the above step S208 may specifically include: using a key to represent an alarm, and using ontology mapping and entity mapping to establish the effective alarm association relationship of the target candidate set and the work order assignment in the fault knowledge graph. single knowledge to find the corresponding node; when the corresponding node is found, content conflict detection is carried out to obtain the detection result; when the detection result is that there is no content conflict, the effective alarm association relationship is sent to The single knowledge is hung on the corresponding node; if the corresponding node is not in the fault knowledge graph, a new parent node is created in the fault knowledge graph, and the effective alarm association relationship with the working The single-dispatch knowledge is hung on the newly-created parent node.

Fig. 3 is a schematic diagram of fault knowledge map RDF according to an embodiment of the present disclosure. As shown in Fig. 3, for a fault knowledge map such as operation and maintenance in the telecom industry, simple RDF triples cannot assist effective intelligent operation and maintenance , the RDF of the base station-generated-alarm and base station-activated-cell service part is only a brief description of the occurrence of the alarm, and there is no effective guidance on how to deal with the alarm after it occurs, but it is necessary to establish the RDF of the A alarm-cause-B alarm part , indicating the alarm association relationship, so as to effectively guide the operation and maintenance.

In this embodiment, the RDF of the fault knowledge graph is represented by triples. The knowledge in the fault knowledge map is expressed as RDF triples, which can be represented by SPO (subject-verb-object). Taking the root cause correlation relationship between alarms in the fault knowledge map as an example, such as a correlation root cause rule, the same computer room A alarms within 5 minutes The trigger B alarm is generated, where A is the S of SPO, the trigger is P of SPO, and B is 0 of SPO. The location is the same as the computer room and the time is 5 minutes.

Therefore, the knowledge extraction of the fault knowledge map mainly includes:

Entity extraction, also known as named entity recognition, extracts entities from the rule base, knowledge base, alarm data, and work order data, such as alarm ID (Identify Document, identity), title, network element in the computer room where the alarm occurred, etc. Occurrence level;

Relationship extraction, such as alarm A causes alarm B to occur, that is, the relationship between alarm A and alarm B, and alarm B is an important alarm that needs to be dispatched, that is, the relationship between the alarm and the work order;

Event extraction extracts the alarm data and work order data at runtime, and can obtain events, such as the time and location of the alarm, such as the handler of the work order, the processing time, and the processing result suggestion, to form relevant operation and maintenance knowledge.

In this embodiment, knowledge is extracted from the rule base, knowledge base, and fault descriptions of operators and equipment manufacturers in the operation and maintenance guarantee, as well as the real-time alarm information and work order information of operators and equipment manufacturers, and the extracted results are integrated into operation and maintenance faults. Knowledge graph. Among them, the rule base and the knowledge base are fault operation and maintenance knowledge, and most fault solutions of the fault description are also written into the rule base and the knowledge base. For the convenience of explanation, they are collectively referred to as the rule base in this disclosure.

Fig. 4 is a schematic diagram of knowledge extraction in a fault knowledge map according to an embodiment of the present disclosure. As shown in Fig. 4, it is divided into a design domain and an execution domain, wherein:

Step S401 , in the design domain, perform related design of knowledge extraction, including rule base extraction design, semi-structured template design, real-time data extraction design, vectorization design, machine learning design and threshold design. Specifically include:

1) Rule base extraction design;

Generally speaking, the data in the rule base is structured data and partially semi-structured data. FIG. 5 is a schematic diagram of the alarm association rules according to this embodiment. The alarm association rules shown in FIG. 5 include rule names, association methods, Rule description, associated location, time window, parent alarm and child alarm.

The extraction of rules, whether it is entity extraction or relationship extraction, mainly adopts the method of mapping, that is, it mainly needs to define key operation and maintenance fields.

The following uses an example of alarm correlation rules for illustration.

For alarm correlation rules, the key fields are correlation rule name, correlation method, specialty, and correlation location. Time window, parent alarm, child alarm. For field values, the name of the association rule is the entire content; the association method is three values, including primary and secondary associations, frequency associations, and threshold associations; the professional value is wireless/transmission/power supply/core network, or cross-professional; the association position , that is, the same network element association, the same computer room, or the same link; the time window indicates the time difference range of parent and child alarms; the value of the parent alarm is the detailed description of each alarm, the alarm title, alarm ID and alarm level, and the child alarm same.

Similarly, for dispatch order rules, the corresponding key fields and value extraction methods can also be designed. These key fields are saved as dictionaries.

All key fields in this embodiment can be designed, so there is no such situation, such as the field is "association method", and other literals such as "association method" just bypass this patent. The following key fields are all within this range.

2) Semi-structured template design;

Semi-structured data is shown in Figure 3. The rule description and dispatch rules can be seen from the figure that structured data is easy to extract, but semi-structured data definition templates can also be extracted.

Therefore, rule extraction templates are mainly definitions, fields and values of structured data, and fields and templates of semi-structured data.

As shown in Figure 5, the rule description can see that the template can be designed as follows:

XX is caused by (optional) XX;

The relevant associated information can be easily extracted.

Fig. 6 is a schematic diagram of a work order dispatching rule according to an embodiment of the present disclosure. As shown in Fig. 6, it includes the name, whether to enable it, the rule type, and dispatching conditions. Among the dispatching conditions, you can design:

Alarm project status = XX or XX, alarm object device type = XX, alarm level = XX, alarm ID = XX;

Among them, "caused by", "caused by", "alarm project status", "alarm object device type", "alarm level" and "alarm ID" are the key fields of the template. After this design, the semi-structured data has been converted into structured data.

3) Real-time data extraction design;

For real-time operation data, work orders and alarms, FIG. 7 is a schematic diagram (1) of real-time work order fault handling according to an embodiment of the present disclosure. As shown in FIG. Service college entrance examination, among which: [Dynamic Ring]: Verify that the network management has an AC input power failure alarm; [Wireless]: Verify that the network management has a base station out of service alarm; [Transmission]: No relevant alarms have been queried; The status of the NE is normal; [Preliminary Judgment of Fault Cause]: It can be monitored, and the status of the NE is normal; [The network level of the faulty NE]: ENODEB; ;[Troubleshooting advice]: Check the power outage in the area or check the dynamic ring power supply; [Troubleshooting time]: xx, xx, xx, xx: xx: xx; [Troubleshooter]: xxx; [Troubleshooting status]: The fault has been cleared at xx:xx:xx on xx month xx xxxx.

Define the fields that need to be extracted, such as "preliminary judgment of fault cause", that is, the operation and maintenance guarantee field, including work order subject, alarm title, network element name, faulty device model, faulty city, alarm level, alarm ID, alarm occurrence time, Fields such as alarm dispatch time, fault handling situation, fault cause, fault processing time, fault handler, etc., note that these fields may have different names but the same meaning in different operators, so it needs to be designed and defined as a dictionary mode, and when extracting Dynamically parse the content corresponding to these fields.

The content of the preliminary judgment of the cause of the fault and the opinions on troubleshooting are unstructured data, which requires machine learning to learn in detail.

4) Vectorized design;

In the extraction process, the analysis of unstructured data in the content, such as the description of fault handling, requires the use of word segmentation and vectorized representation for similarity learning, and machine learning for possible parent-child relationships (root cause relationships) , then you need to design model algorithms and evaluation indicators, and for supervised learning, you need to define labels.

To segment the non-structural description information, the word segmentation model adopts the standard Jieba (stuttered word segmentation). For the content of the field "Preliminary Judgment of Fault Cause" in Figure 7, "preliminary judgment is caused by equipment power failure or AC input power failure", the words are divided into three words "equipment power failure", "AC input power failure" and "caused". The two words are directly matched with the alarm title. FIG. 8 is a schematic diagram (2) of real-time work order fault handling according to an embodiment of the present disclosure, as shown in FIG. Through communication and analysis with R & D, there is no abnormality in the 5G cell. It is judged that the AAU version is a single-mode version. There is no problem with "abnormal AAU version" and "abnormal RRU", but others such as "abnormal 5G cell", "out of service in 4G cell", and standard spelling, "abnormal in CU/DU cell" and "out of service in LTE cell" are Not the same, even varies from person to person, some people will write "withdrawal", others will write "exit service", so it needs to be vectorized after word segmentation and then similarity learning, so that they can represent other The algorithm for uniqueness and similarity learning can choose the standard NLP (Natural Language Processing) TFIDF or LSI model for similarity learning.

It should be noted here that the "LTE cell" or RRU are not separately reflected in the fault knowledge map, they exist in the resource knowledge map, and the fault knowledge map is based on alarms such as "LTE cell decommissioning" and related associations, as well as corresponding These methods of work order dispatching rules exist.

5) Machine learning design;

For example, whether "AAU version abnormality" leads to "RRU abnormality" does not exist in the rule base, and machine learning is also required to determine its correlation, while "RRU abnormality" causes "LTE cell decommissioning" and "AC input power failure" causes "base station failure". "Retirement" is in the rule base, and there is no conflict, so you don't need to learn it.

Machine learning uses classification models, and you can choose algorithms such as logistic regression (sigmoid)/decision tree and support vector machine (SVM).

The learned labels can be learned as defined in the rule base.

At the same time, the definition of the evaluation of the learning effect is required. Classification learning is defined according to the standard accuracy (Accuracy)/precision (Precision)/recall (Recall). Here, specific values are defined. For example, the classification can be obtained if the accuracy rate reaches more than 80%. model, if it is less than 80%, it needs to be relearned.

The characteristics of machine learning are as follows:

Traits are defined as follows:

--Topological association degree of associated alarms, network element/board/port;

--The degree of business relationship associated with the alarm, such as the associated cell under the base station;

--The importance of the associated alarm, such as the alarm level;

--Professional relationships associated with alarms, such as the mutual influence between dynamic ring-wireless-transmission;

--Support/confidence of associated alarms;

--Whether the alarm or fault is clear (the content of "fault recovery situation" in the fault handling situation).

6) Threshold design.

Including the frequency of data mining and the number of occurrences of associated alarms analyzed in work order processing.

The frequency of these data should not be too low. For example, the real-time data of only one month only has a single-digit frequency, and the number of samples is too small to be meaningful.

The above is the content of the design domain.

Step S402, the rule extraction module extracts knowledge about the operation and maintenance rules.

The rules are extracted according to the dictionary defined in step S401 above.

For alarm rules, extract alarms and alarm relationships, and form an alarm correlation rule through RDF triples. Take the following rules as an example:

Alarm 1: base station out of service alarm (secondary alarm, ID: 100-1111);

Alarm 2: AC input power failure alarm (three-level alarm, 500-0003);

RDF: Alarm 2 causes alarm 1 (same time window of the computer room);

Alarms and their associated relationships will be integrated into the alarm relationship instance of the fault knowledge graph shown in Figure 3.

For work order dispatch rules, the alarms in the dispatch conditions can be extracted and integrated into the work order instances in the fault knowledge map.

In this step, both entities and relationships are extracted.

For alarm correlation, the entity is alarm 1 and alarm 2, and the relationship is that alarm 2 will trigger alarm 1;

For work order dispatch, the work order dispatch is dispatched with alarm 1 and the reason is alarm 2.

Step S403, the real-time extraction module extracts real-time alarm and work order data.

Extracting real-time data, such as alarm data and work order data, can help discover knowledge that is not in the rule base. The following is an example of A alarm-cause-B alarm in Figure 3.

The existing rules are generally mature knowledge. For example, in a 4G equipment room in a traditional network, there are dynamic ring (dynamic environment) network elements, wireless network elements, and transmission network elements. If the dynamic ring network elements fail, such as municipal power outages Power failure or power alarm may cause the base station in the same computer room to be out of service, and then cause the 4G cell to be out of service (LTE cell out of service).

According to this prior knowledge, after the 5G network is built, there will be similar situations. A 5G equipment room has dynamic ring (dynamic environment) network elements, wireless network elements and transmission network elements. If the dynamic ring network element fails, If the municipal power outage causes a power failure or a power alarm, it may cause the 5G base station in the same computer room to be out of service, and then the 5G cell (CU/DU cell out of service).

In this case, even if the rule base has no corresponding knowledge, when there are similar alarms and work orders, the operation and maintenance personnel can easily handle the fault based on the prior knowledge of the 4G network rule base, and import this 5G operation and maintenance knowledge into the knowledge library.

When most end users have not yet upgraded to 5G mobile phones, there are 5G base stations that activate 4G in reverse to provide 4G cell services. It supports 4G cells, that is, dual-mode mode (if it only supports 5G cells, it is single-mode mode), but there may be software bugs or software upgrade time differences, and it is still in single-mode mode. If the RRU communication with the 4G network element fails, the RRU will have Abnormal, resulting in the decommissioning of the 4G cell, that is, the relationship corresponding to the dotted line in Figure 3, and at this time, the 5G cell it serves is normal.

As shown in Figure 8, unless they have very rich R&D knowledge, it is not easy for operation and maintenance personnel to define rules in advance or find out the cause of failures in real time. , and similar problems also need to be reasoned through the fusion of fault knowledge graphs. Therefore, it is necessary to learn real-time operation and maintenance data and extract knowledge to discover operation and maintenance related knowledge more quickly and accurately.

The alarm correlation has certain conditions, such as the correlation location and time window, so it is necessary to obtain the possibility of correlation through data mining first. Note that frequent set mining is not used, because they do not occur frequently, and correlation is used. Sex mining, such as Pearson coefficient, just get the correlation.

Then extract the following information based on the work order data:

The alarm of the work order dispatch, including the location of the occurrence, this is structured data;

In the fault handling situation, the "preliminary judgment of fault cause" is similar to the field content, which may be unstructured data;

The field content similar to "Troubleshooting Opinion" in the troubleshooting situation, this content may be unstructured data;

The "fault recovery situation" in the fault handling situation is similar to the content of the field. This content can be hard-coded whether there are words such as "clear" or "recovery", which can assist the label indicating whether the fault handling and cause judgment are correct.

After the extraction is complete, use the excavated correlation alarms to match the above information, and if there are one or more, save the extracted original information.

These raw information, such as the above two places, are unstructured data, which need to be segmented and vectorized through NLP (Natural Language Processing).

Fig. 9 is a schematic diagram (1) of knowledge entity vectorization according to an embodiment of the present disclosure. As shown in Fig. 9, since there are not many words, the vectorization uses one-hot model encoding, that is, the position of the word in the vector is 1, and other positions are 0.

Carry out similarity learning after vectorization, use the standard LSI or TFIDF model to learn, that is, get the uniqueness, that is, "LTE cell decommissioning" and "4G cell decommissioning" and "LTE cell decommissioning service" are one entity, then go to Refetch unique values.

The extracted data is used as alarm correlation candidates and dispatch rule candidates.

Step S404, the conflict detection module performs conflict detection on the knowledge.

After the rule base extraction and real-time data extraction are completed, conflict detection needs to be performed as follows:

If the real-time data extraction and the rule base completely match in terms of alarms and correlations, choose one;

If the real-time data extraction and the rule base match the alarm, but the correlation conflicts, then judge whether the number of occurrences of the work order-related processing field and the reason field of the alarm is greater than the threshold. If it is greater than the threshold, use the machine learning algorithm model to judge, otherwise adopt the rule library;

If the real-time data extraction is not in the rule base at all, the real-time data extraction information is taken, and the machine learning algorithm model is used to judge and obtain the correlation.

Conflict detection is not only detected in the alarm correlation rule base, but also in the work order dispatch rule base. Because a new alarm correlation may be found, if there is no previous dispatch rule base, then a new related knowledge may be added.

After the extraction is completed, prepare for subsequent integration into the fault knowledge map.

In steps S403 and S404, entities are extracted, relationships are also extracted, and alarm work order events are also extracted, so that there is more information for fault knowledge map fusion.

Step S405, the summary module summarizes according to the knowledge correlation.

In order to integrate into the fault knowledge map more conveniently, it is necessary to summarize these knowledge.

The summary is not simply queued up, but divided into two parts:

Summarize according to the correlation, and summarize according to the main alarm. The main alarm is the key, and the set of all related alarms is the value, which is aggregated and summarized through hash;

According to the summary of the dispatch order, according to the dispatch order alarm as the key, the collection of dispatch order rules is the value summary.

This summary makes it easier to integrate into the fault knowledge graph later.

Step S406, merging into the fault knowledge map.

When a summary is obtained, it needs to be integrated into the fault knowledge map. For an alarm represented by a key, find a node in the fault knowledge graph through ontology mapping and entity mapping. Create a new parent node.

In this embodiment, through the extraction of rule base and real-time operation and maintenance data, when alarms of new types, new services and new topologies are generated, they can be easily integrated into the fault knowledge map; through the prior judgment of extraction and conflict detection, it is possible to Incorporating the accuracy of the fault knowledge map is of great help; it is a good reference for the alarm root cause model of complex networks and services in 5G slices.

The data preparation in this embodiment refers to the rule base and real-time data, including operation and maintenance data such as work orders and alarms and the corresponding rule base.

First extract the rule base, which is mainly structured data, which is relatively easy.

Then extract real-time alarms and real-time work orders, and use data mining in the middle.

During the extraction process, word segmentation and vectorization are used, and similarity learning makes the extracted knowledge unique.

After learning, perform conflict detection. In conflict detection, the classification module may be required to use machine learning to judge the newly extracted relationship.

Finally, the summary module summarizes the extracted knowledge in order to prepare for the fusion of fault knowledge graphs.

This is the operation process of the whole system, as shown in Figure 4.

Fig. 10 is a schematic diagram (2) of knowledge entity vectorization according to an embodiment of the present disclosure. As shown in Fig. 10 , entity alarms are vectorized with one-hot encoding, and all possible associated alarms are vectorized, using one-hot One-hot encoding, that is, in an n-dimensional vector, only itself is 1, and the others are 0. Although one-hot encoding is sparse, there are not many types of alarms, so you don't need to think too much about memory consumption.

Extract entities and relations from the rule base, and analyze the rule base after preparing the rule base and keyword dictionary. The following uses the alarm correlation rule base as an example to illustrate. Fig. 11 is a flow chart of alarm correlation rule extraction according to an embodiment of the present disclosure, as shown in Fig. 11 , including:

Step S1101, preparing an alarm association rule base and a keyword dictionary;

Step S1102, obtaining alarm association rules;

Step S1103, acquiring the content of the keywords "association" and "professional";

Step S1104, obtaining the content of keywords "associated position" and "time window";

Step S1105, obtaining the content of keywords "parent alarm" and "child alarm";

Step S1106, obtaining the content of the keyword "rule description";

Step S1107, perform left and right word segmentation on the "rule description content" with the keyword "cause";

Step S1108, use the left word to perform category matching with the parent-child alarm;

Step S1109, use the right word to match parent and child alarms;

Step S1110, forming an alarm related RDF;

Step S1111, extracting this article ends and proceeds to the next rule.

First obtain relevant content through keywords, that is, column names, such as association methods and majors. Their content is only extracted and will be used in the subsequent fusion of fault knowledge graphs.

The associated location and time window are extracted, which will not only be used for subsequent fault knowledge map fusion, but may also be used for real-time data mining verification during the extraction process.

Then take out the parent-child alarm, here is the alarm entity, but the relationship that requires the main parent-child relationship does not necessarily clarify the root cause, that is, the parent does not necessarily cause the child, nor does the child cause the parent. Taking father and son, in addition to alarm merging, in the process of dispatching, often important "parent alarms" and "child alarms" are of reference value as possible reasons in work order dispatching.

Therefore, the father and son cannot be described by the root cause RDF, and the rule description needs to be parsed.

After the rule content is taken out, use the keyword "cause" to segment the word (note that the keyword "cause" here is only an example, and the keyword can also be other defined words, such as "cause", etc.), and the word on the left of "cause" is the root cause, and the word on the right is the triggered alarm.

The left and right words are then matched with the father and son alarms. The so-called category matching means that the parent-child alarm entity may be a subcategory of the left and right words. For example, base station decommissioning includes 4G base station decommissioning and 5G base station decommissioning. Power outages in the dynamic ring can include mains power outages, AC input power outage alarms, Low output voltage alarm, etc., so a large category of matching is required.

After matching, the root cause RDF can be formed, that is, the alarm on the left causes the alarm on the right.

Similarly, for the work order rule base, instances and relationships can also be extracted, as shown in Figure 6, by extracting the keywords "name" and "dispatch condition", and getting specific alarms, you can get the work order RDF, namely XX Alarm dispatch XX work order.

Generally speaking, the entities and relationships extracted from the rule base are relatively accurate and can be used as labels for learning.

In this embodiment, entities and relationships are extracted from real-time data, and after the alarm data and work order data are prepared, the real-time data needs to be analyzed. Fig. 12 is a flowchart of real-time data extraction according to an embodiment of the present disclosure, as shown in Fig. 12 , including:

Step S1201, preparing alarm and work order data;

Step S1202, performing correlation mining on the alarm;

Step S1203, extract the alarm-related content of the work order through key fields, including occurrence time, location, etc.;

Step S1204, extracting the content of the fault handling condition of the work order through the key field;

Step S1205, extracting "preliminary judgment of fault cause" and "fault handling opinion";

Step S1206, word segmentation, to obtain one or more cause alarms;

Step S1207, calculating the similarity to obtain a corresponding alarm vector;

Step S1208, matching with the excavated correlation alarm;

Step S1209, obtaining the alarm association relationship and the work order dispatch relationship.

Mining the alarms first through correlation mining algorithms, such as Pearson coefficient, etc., instead of using frequent set mining, is because the alarms may be important but occur infrequently, or the associated alarms may occur rarely, as shown in Figure 8 Condition.

After obtaining the alarm association relationship, save it first, and then extract the work order data.

According to key fields, such as alarm, alarm occurrence time, occurrence location, alarm ID, alarm level, etc., the alarm content in the work order data is obtained.

According to the work order dispatching principle, it may be that the related alarms that have been found in the early alarm processing have been combined to send a single alarm, or a single alarm. In either case, it is necessary to analyze whether there is any error in the work order dispatching process. True correlative root cause alerts.

Therefore, extract the "preliminary judgment of fault cause" and "troubleshooting opinions" in the key field "fault handling situation" to obtain related alarms, which may be root cause alarms, and there may be more than one.

Since this is filled in manually, it may not be an accurate language, so it is necessary to use NLP for word segmentation and similarity learning to obtain the unique identification of relevant alarms.

Then match with the relevant alarms excavated earlier. If the matching is successful, get preliminary RDF candidates, such as alarm correlation and work order dispatch RDF.

These candidate sets are to be checked for conflicts later.

Feature engineering processing, taking the above-mentioned features as an example, network element topology relationship/business relationship/professional relationship/alarm level/frequent set certainty/associated alarm occurrence interval/similarity of associated alarms between alarms, of course, Features are not limited to these features. Fig. 13 is a flowchart of feature engineering according to an embodiment of the present disclosure, as shown in Fig. 13 , including:

Step S1301, preparing an alarm association set;

Step S1302, obtaining the current pair of alarms;

Step S1303, obtaining the topological relationship of the devices where they occur;

Step S1304, obtaining the business relationship of the equipment where they occur;

Step S1305, obtain their professional relationship, optional six dimensions of wireless/data/transmission/core/dynamic ring/cross-network;

Step S1306, obtain their alarm levels, according to four levels of 1/2/3/4;

Step S1307, obtaining the content of "fault recovery status" of "fault handling status" in their work orders;

Step S1308, word segmentation, whether there is "alarm clearing" in the similarity calculation, and get the dimension value 1/0 according to whether there is;

In step S1309, all features are obtained through normalization processing.

It is necessary to normalize all the data except the alarm level, where the normalization is to process the data of each dimension into 1 and 0.

The alarm level is a dimension, and the value is filled in according to the alarm level. Generally speaking, the higher the alarm level, the more significant it is in the alarm root cause tree model.

Topological relationship. For example, a pair of alarms A and B occur in the BBU and the base station respectively. Then their topological relationship will have two dimensions. Topological relationship A is the parent of B, and topological relationship B is not the parent of A. Here, the first Fill in 0 for one dimension, and 1 for the second dimension. If there is no topology-subordinate relationship between the two, fill in 0 for both, and the feature of business relationship is handled in the same way.

Professional relationship is handled according to the six dimensions of wireless/data/transmission/core/dynamic ring/cross-network. For example, if it is wireless, then fill in 1 for the wireless dimension and 0 for other dimensions.

For the dimension of correlation data mining, the degree of certainty can be used.

Each work order has a corresponding "failure recovery situation" content, which is in the field "failure handling situation", which partly represents whether the reason judgment is correct (as shown in Figure 7 and Figure 8), but the content is non- Structured data, after word segmentation, whether similarity training is similar to "alarm clearing" or "alarm recovery", if similar, it is 1, otherwise it is 0. Note that this field cannot be used as the label of the root cause in the association, but it can be used as a feature for training.

The machine learning knowledge base obtains the SPO classification model, learns the SPO (subject and guest) classification model through machine learning, and obtains the weight values of all dimensions of the above-mentioned features. Using supervised learning classification learning algorithm, you can use logistic regression decision tree random forest etc. This process is not complicated and is relatively mature. For example, logistic regression has a mature model algorithm library.

Fig. 14 is a flow chart of conflict detection according to an embodiment of the present disclosure, as shown in Fig. 14 , including:

Step S1401, preparing a candidate set;

Step S1402, obtaining a current candidate RDF;

Step S1403, judging whether the candidate RDF is in the rule base, if the judging result is yes, go to step S1404, and if the judging result is no, go to step S1408;

Step S1404, matching with the rule base;

Step S1405, judging whether they match, if the judging result is yes, go to step S1402, and if the judging result is no, go to step S1406;

Step S1406, judging whether there is a conflict, if the judging result is yes, go to step S1407, and if the judging result is no, go to step S1402;

Step S1407, judging whether the candidate has a low frequency, if the judging result is yes, go to step S1402, and if the judging result is no, go to step S1408;

Step S1408, determine that the candidate is valid through machine learning;

Step S1409, all candidates are summed up and ready to be summed up.

For the newly extracted association relationship, whether it is a 5G alarm or an alarm generated by a 3G/4G/5G hybrid network, it will be compared with the rule base to see if there is any conflict.

First check whether the alarms in the candidate set exist. If not, use machine learning to judge the association relationship and obtain a new association relationship.

If the alarm exists, first check that it matches the rule base completely, and then continue to the next one.

If there is no conflict, continue to the next one. If there is a conflict, the rule base may not necessarily be correct. Although this situation is rare, it must be considered, such as possible changes in the network and link relationships.

First judge whether the number of occurrences is low and low frequency, then the low-probability events do not need to be considered, otherwise, use machine learning to re-judge.

Note that after matching, it is necessary to determine whether there is a conflict, because alarm correlation is a relatively complicated process, and there may be multiple layers of correlation.

Similarly, as with work orders, work order rules also need to be checked. Of course, it is relatively simpler, mainly to see if there is no dispatch rule library. If there are no relevant alarms merged into a work order, a new work order dispatch knowledge can be created.

After the conflict is detected, it can be summarized and then ready to be integrated into the fault knowledge map.

According to another embodiment of the present disclosure, a device for constructing a fault knowledge graph is also provided. FIG. 15 is a block diagram of a device for constructing a fault knowledge graph according to another embodiment of the present disclosure. As shown in FIG. 15 , it includes:

The first extraction module 152 is configured to extract entities and relationships from the rule base to obtain a first candidate set including alarm relationship instances and work order dispatch instances;

The second extraction module 154 is configured to extract entities and relationships from the real-time data to obtain a second candidate set of alarm association relationships and work order dispatch relationships;

The conflict detection module 156 is configured to perform conflict detection according to the first candidate set and the second candidate set, and obtain a target candidate set including effective alarm correlation and work order dispatch knowledge;

The update module 158 is configured to integrate the target candidate set into the fault knowledge graph constructed according to the rule base to obtain an updated fault knowledge graph.

In an exemplary embodiment, the first extraction module 152 includes:

The first extraction sub-module is configured to extract the association relationship between different alarms through key fields for the alarm association rules in the rule base to form the alarm relationship instance;

The second extraction sub-module is configured to extract the relationship between different alarms in the order dispatching conditions through the key fields of the work order dispatching rules in the rule base to form the work order dispatching instance.

In an exemplary embodiment, the first extraction sub-module is further set to

Extract parent-child alarm and rule description content according to the first key field;

According to the second key field, the left and right participle is performed on the description content of the rule to obtain the left participle and the right participle;

The left participle and the right participle are respectively matched with parent-child alarms to form the alarm association instance.

In an exemplary embodiment, the device also includes:

A conversion module, configured to convert the semi-structured data in the rule base into structured data.

In an exemplary embodiment, the second extraction module 154 is further configured to

Carrying out correlation mining on the alarm data in the real-time data to obtain a correlation alarm;

For the work order data in the real-time data, extract the alarm content and fault handling content according to the key fields, wherein the fault handling content includes at least the fault handling situation, the preliminary judgment of the fault cause, and the fault handling opinion;

Perform word segmentation processing on the alarm content and the fault handling content to obtain one or more cause alarms;

determining an alarm vector of the one or more cause alarms according to the similarity;

The alarm vector is matched with the correlation alarm to obtain the alarm correlation and the work order dispatching relationship.

In an exemplary embodiment, the conflict detection module 156 is further configured to

For each alarm association relationship and each work order dispatch relationship in the second candidate set, perform the following operations to obtain the target candidate set composed of effective alarm association relationships and work order dispatch knowledge, wherein, for the The alarm association relationship and work order dispatching relationship is called the current alarm association relationship and the current work order dispatching relationship:

Judging whether the current alarm association relationship exists in the first candidate set; if the judgment result is no, determine that the current alarm association relationship is valid through machine learning; if the judgment result is yes, when the When the current alarm association relationship does not match the alarm relationship instance in the first candidate set and there is no conflict, determine whether the data frequency of the current alarm association relationship is less than a preset threshold, and if the determination result is no, pass Machine learning determines that the current alarm association relationship is the effective alarm association relationship;

Judging whether the current work order dispatching relationship exists in the work order dispatching instance of the first candidate set; if the judgment result is no, merging the current work order dispatching relationship and related alarms into the Describe the work order dispatch knowledge.

In an exemplary embodiment, the device also includes:

The first summary module is configured to summarize the alarm correlations in the target candidate set according to the correlation;

The second summarizing module is configured to sum up the work order dispatching relationships in the target candidate set according to dispatching orders.

In an exemplary embodiment, the update module 158 is further configured to

Using a key to represent an alarm, searching for a corresponding node in the fault knowledge graph for the effective alarm association relationship of the target candidate set and the work order dispatch knowledge through ontology mapping and entity mapping;

When the corresponding node is found, content conflict detection is performed to obtain a detection result;

When the detection result is that there is no content conflict, hang the effective alarm association relationship and the work order dispatch knowledge on the corresponding node;

When the corresponding node is not in the fault knowledge graph, a new parent node is created in the fault knowledge graph, and the effective alarm association relationship and the work order dispatch knowledge are linked to the newly created on the parent node.

Embodiments of the present disclosure also provide a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps in any one of the above method embodiments when running.

In an exemplary embodiment, the above-mentioned computer-readable storage medium may include but not limited to: U disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM) , mobile hard disk, magnetic disk or optical disk and other media that can store computer programs.

Embodiments of the present disclosure also provide an electronic device, including a memory and a processor, where a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

In an exemplary embodiment, the electronic device may further include a transmission device and an input and output device, wherein the transmission device is connected to the processor, and the input and output device is connected to the processor.

For specific examples in this embodiment, reference may be made to the examples described in the foregoing embodiments and exemplary implementation manners, and details will not be repeated here in this embodiment.

Obviously, those skilled in the art should understand that each module or each step of the above-mentioned disclosure can be realized by a general-purpose computing device, and they can be concentrated on a single computing device, or distributed in a network composed of multiple computing devices In fact, they can be implemented in program code executable by a computing device, and thus, they can be stored in a storage device to be executed by a computing device, and in some cases, can be executed in an order different from that shown here. Or described steps, or they are fabricated into individual integrated circuit modules, or multiple modules or steps among them are fabricated into a single integrated circuit module for implementation. As such, the present disclosure is not limited to any specific combination of hardware and software.

The above descriptions are only preferred embodiments of the present disclosure, and are not intended to limit the present disclosure. For those skilled in the art, the present disclosure may have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims (11)

1. A fault knowledge graph construction method, comprising:

   Extract entities and relationships from the rule base to obtain the first candidate set including alarm relationship instances and work order dispatch instances;

   Extract entities and relationships from real-time data to obtain the second candidate set of alarm association relationship and work order dispatch relationship;

   Performing conflict detection according to the first candidate set and the second candidate set to obtain a target candidate set including effective alarm correlation and work order dispatch knowledge;

   The target candidate set is integrated into the fault knowledge graph constructed according to the rule base to obtain an updated fault knowledge graph.
2. The method according to claim 1, wherein the entity and relationship extraction is performed on the rule base, and the first candidate set including the alarm relationship instance and the work order dispatch instance obtained includes:

   For the alarm association rules in the rule base, the association relationship between different alarms is extracted through key fields to form the alarm relationship instance;

   For the work order dispatching rules in the rule base, the relationship between different alarms in the order dispatching conditions is extracted through key fields to form the work order dispatching instance.
3. The method according to claim 2, wherein, for the alarm rules in the rule base, the association relationship between different alarms is extracted through the key field, and the alarm relationship instance comprises:

   Extract parent-child alarm and rule description content according to the first key field;

   According to the second key field, the left and right participle is performed on the description content of the rule to obtain the left participle and the right participle;

   The left participle and the right participle are respectively matched with parent-child alarms to form the alarm association instance.
4. The method according to claim 2, wherein, before performing entity and relationship extraction on the rule base to obtain the first candidate set including alarm relationship instances and work order dispatch instances, the method further includes:

   The semi-structured data in the rule base is converted into structured data.
5. The method according to claim 1, wherein the entity and relationship extraction is performed on the real-time data, and the second candidate set for obtaining the alarm association relationship and the work order dispatch relationship includes:

   Carrying out correlation mining on the alarm data in the real-time data to obtain a correlation alarm;

   For the work order data in the real-time data, extract the alarm content and fault handling content according to the key fields, wherein the fault handling content includes at least the fault handling situation, the preliminary judgment of the fault cause, and the fault handling opinion;

   Perform word segmentation processing on the alarm content and the fault handling content to obtain one or more cause alarms;

   determining an alarm vector of the one or more cause alarms according to the similarity;

   The alarm vector is matched with the correlation alarm to obtain the alarm correlation and the work order dispatching relationship.
6. The method according to claim 1, wherein, performing conflict detection according to the first candidate set and the second candidate set, obtaining the target candidate set including effective alarm association relationship and work order dispatch knowledge includes:

   For each alarm association relationship and each work order dispatch relationship in the second candidate set, perform the following operations to obtain the target candidate set composed of effective alarm association relationships and work order dispatch knowledge, wherein, for the The alarm association relationship and work order dispatching relationship is called the current alarm association relationship and the current work order dispatching relationship:

   Judging whether the current alarm association relationship exists in the first candidate set; if the judgment result is no, determine that the current alarm association relationship is valid through machine learning; if the judgment result is yes, when the When the current alarm association relationship does not match the alarm relationship instance in the first candidate set and there is no conflict, determine whether the data frequency of the current alarm association relationship is less than a preset threshold, and if the determination result is no, pass Machine learning determines that the current alarm association relationship is the effective alarm association relationship;

   Judging whether the current work order dispatching relationship exists in the work order dispatching instance of the first candidate set; if the judgment result is no, merging the current work order dispatching relationship and related alarms into the Describe the work order dispatch knowledge.
7. The method according to any one of claims 1 to 6, wherein, before incorporating the target candidate set into the fault knowledge graph constructed according to the rule base to obtain the updated fault knowledge graph, the method further include:

   Summarizing the alarm correlations in the target candidate set according to the correlation;

   Summarize work order dispatch relationships in the target candidate set according to dispatch.
8. The method according to any one of claims 1 to 6, wherein incorporating the target candidate set into the fault knowledge graph constructed according to the rule base, and obtaining the updated fault knowledge graph comprises:

   Using a key to represent an alarm, searching for a corresponding node in the fault knowledge graph for the effective alarm association relationship of the target candidate set and the work order dispatch knowledge through ontology mapping and entity mapping;

   When the corresponding node is found, content conflict detection is performed to obtain a detection result;

   When the detection result is that there is no content conflict, hang the effective alarm association relationship and the work order dispatch knowledge on the corresponding node;

   When the corresponding node is not in the fault knowledge graph, a new parent node is created in the fault knowledge graph, and the effective alarm association relationship and the work order dispatch knowledge are linked to the newly created on the parent node.
9. A fault knowledge map construction device, including:

   The first extraction module is configured to extract entities and relationships from the rule base to obtain a first candidate set including alarm relationship instances and work order dispatch instances;

   The second extraction module is configured to extract entities and relationships from real-time data to obtain a second candidate set of alarm association relationships and work order dispatch relationships;

   The conflict detection module is configured to perform conflict detection according to the first candidate set and the second candidate set to obtain a target candidate set including effective alarm correlation and work order dispatch knowledge;

   The update module is configured to integrate the target candidate set into the fault knowledge graph constructed according to the rule base to obtain an updated fault knowledge graph.
10. A computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to perform the method described in any one of claims 1 to 8 when running.
11. An electronic device, comprising a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to perform the method described in any one of claims 1 to 8.

Images