WO2019238109A1 - 一种故障根因分析的方法及装置 - Google Patents

一种故障根因分析的方法及装置 Download PDF

Info

Publication number
WO2019238109A1
WO2019238109A1 PCT/CN2019/091207 CN2019091207W WO2019238109A1 WO 2019238109 A1 WO2019238109 A1 WO 2019238109A1 CN 2019091207 W CN2019091207 W CN 2019091207W WO 2019238109 A1 WO2019238109 A1 WO 2019238109A1
Authority
WO
WIPO (PCT)
Prior art keywords
alarm event
alarm
training
event
root cause
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2019/091207
Other languages
English (en)
French (fr)
Inventor
李健
黄增军
胡敏
谢博
程康
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP19819128.0A priority Critical patent/EP3796176B1/en
Publication of WO2019238109A1 publication Critical patent/WO2019238109A1/zh
Priority to US17/120,605 priority patent/US11438212B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/079—Root cause analysis, i.e. error or fault diagnosis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
    • G06F18/213—Feature extraction, e.g. by transforming the feature space; Summarisation; Mappings, e.g. subspace methods
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
    • G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/24—Classification techniques
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/24—Classification techniques
    • G06F18/243—Classification techniques relating to the number of classes
    • G06F18/24323—Tree-organised classifiers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • H04L41/0636—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis based on a decision tree analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/069—Management of faults, events, alarms or notifications using logs of notifications; Post-processing of notifications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/04—Processing captured monitoring data, e.g. for logfile generation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • H04L41/064—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis involving time analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • H04L41/065—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis involving logical or physical relationship, e.g. grouping and hierarchies

Definitions

  • the present application relates to the field of information technology, and in particular, to a method and a device for analyzing root cause of a failure.
  • the data of the alarm event such as the type name of the alarm event, is used to determine whether the alarm event is the root cause, but the accuracy is low.
  • the application provides a method and a device for analyzing root cause of a fault, which are used to solve the problem of low accuracy of root cause identification in the prior art.
  • the present application provides a method for root cause analysis of a fault, the method includes:
  • the first alarm event set includes multiple alarm events; and for a first alarm event in the first alarm event set, extracting a feature vector of the first alarm event, wherein the Some or all of the features in the feature vector are used to characterize the relationship between the first alert event and other alert events in the first alert event set; determining the first alert event according to the feature vector of the first alert event Whether the alarm event is a root cause alarm event.
  • the root cause analysis device extracts feature vectors of the first alarm event in the first alarm set from multiple dimensions, and uses the feature vectors of the relationship between the first alarm event and other alarm events to determine the Whether the first alarm event is a root cause alarm event improves the accuracy of the root cause identification of the fault.
  • determining whether the first alarm event is a root cause alarm event according to the feature vector of the first alarm event specifically includes: inputting the feature vector of the first alarm event to a preset A classification model to determine whether the first alarm event is a root cause alarm event, wherein the classification model is used to characterize a relationship between a feature vector and the root cause alarm event.
  • a preset classification model is used to determine whether the first alarm event is a root cause alarm event, and the accuracy of the root cause identification of the fault is further improved by a machine learning method.
  • the acquiring the first alarm event set specifically includes: aggregating multiple alarm events into at least one alarm event set, and using one alarm event set in the at least one alarm event set as the The first alarm event set.
  • determining how to obtain the first alarm event set is an indispensable step for implementing the method of the present application.
  • the aggregating multiple alarm events into at least one alarm event set specifically includes:
  • the set rule includes at least one of a time correlation degree, a topology correlation degree, and a text similarity degree, and the time correlation degree is used for characterization
  • the temporal correlation of each alarm event, the topological correlation is used to characterize the physical relationship of each alarm event, and the text similarity is used to characterize the similarity of strings when each alarm event is represented by a string.
  • the feature vector includes at least one of an alarm severity level, an alarm name, and an event type, and at least one of an association attribute, a timing relationship, a quantity relationship, and a resource relationship, wherein the association attribute It is used to characterize the association relationship between the first alarm event and other alarm events in the first alarm event set to which it belongs, and the quantitative relationship is used to characterize the first alarm event set including the first alarm event.
  • the ratio of the total number of all alarm events with the same first alarm event to the total number of alarm events in the first alarm event set, and the resource relationship is used to characterize the first alarm event and other alarms in the first alarm event set Communication between events.
  • the feature vector further includes an alarm context, wherein the alarm context is used to characterize a fault type corresponding to a first alarm event set to which the first alarm event belongs.
  • the classification model is determined according to at least one training alarm event set and training according to a preset classification algorithm, wherein the information of each training alarm event in the at least one training alarm event set includes A label and a feature vector, where the label is used to characterize whether each training alarm event is a root cause alarm event;
  • the associated attributes of the training alarm event are used to characterize the association between the training alarm event and other alarm events in the training alarm event set, the number The relationship is used to characterize the sum of the number of all training alarm events in the training alarm event set including the training alarm event that is the same as the training alarm event, accounting for the total number of training alarm events in the training alarm event set.
  • the resource relationship is used to characterize the propagation relationship between the training alarm event and other alarm events in the training alarm event set.
  • a feature vector of each training alarm event in the training alarm event set includes at least one of an alarm severity level, an alarm name, an event type, and an associated attribute, a timing relationship, a quantity relationship, and a resource At least one of the relationships.
  • At least one training alarm event set is a plurality of training alarm event sets
  • a feature vector of each training alarm event in each training alarm event set in the plurality of training alarm event sets further includes An alarm context, wherein the alarm context of each training alarm event is used to characterize a fault type corresponding to a training alarm event set where each training alarm event is located.
  • the method further includes: receiving each of the first alarm event set judged by the classification model and manually corrected Label of each alarm event and the feature vector of each alarm event, and save the label and the feature vector of each alarm event to a database for training the classification model, wherein the label is used for It is used to characterize whether each alarm event is a root cause alarm event.
  • the classification model training is performed by using the labels of the first alarm event after artificial correction, and the accuracy of the classification model can be improved.
  • determining whether the first alarm event is a root cause alarm specifically includes: for the first alarm event, if it is determined to be a root cause If the ratio of the decision tree of the alarm to all decision trees is greater than or equal to the set threshold, it is determined as the root cause alarm. If the ratio of the decision tree determined to be the root cause alarm to all decision trees is less than the set threshold, it is determined as Non-root cause alarms.
  • the present application provides a device, the device including: an acquiring unit for acquiring a first alarm event set, where the first alarm event set includes multiple alarm events; and a processing unit for A first alarm event in an alarm event set, and a feature vector of the first alarm event is extracted, wherein some or all of the features in the feature vector are used to characterize the first alarm event and the first alarm event The relationship between other alarm events in the set; the processing unit is further configured to determine whether the first alarm event is a root cause alarm event according to a feature vector of the first alarm event.
  • the processing unit is specifically configured to: input a feature vector of the first alarm event into a preset classification model to determine whether the first alarm event is a root cause alarm event,
  • the classification model is used to characterize a relationship between a feature vector and a root cause alarm event.
  • the acquiring unit is specifically configured to aggregate multiple alarm events into at least one alarm event set, and use one alarm event set in the at least one alarm event set as the first alarm event. set.
  • the obtaining unit is specifically configured to aggregate multiple alarm events into at least one alarm set according to a set rule, wherein the set rule includes a time correlation degree, a topology correlation degree, and a text similarity At least one of degrees, wherein the temporal correlation degree is used to characterize the temporal relationship of each alarm event, the topological correlation degree is used to characterize the physical relationship of each alarm event, and the text similarity degree is used to characterize each When an alarm event is represented by a string, the similarity of the string.
  • the feature vector includes at least one of an alarm severity level, an alarm name, and an event type, and at least one of an association attribute, a timing relationship, a quantity relationship, and a resource relationship, wherein the association attribute
  • the sum of the number of all alarm events that are the same as the first alarm event in the first alarm event set that the first alarm event belongs to includes the first alarm event and accounts for all alarms in the first alarm event set.
  • a ratio of the number of events, and the resource relationship is used to characterize a propagation relationship between a first alarm event and other alarm events in the first alarm event set.
  • the feature vector further includes an alarm context, wherein the alarm context is used to characterize a fault type corresponding to a first alarm event set to which the first alarm event belongs.
  • the classification model is determined according to at least one training alarm event set and training according to a preset classification algorithm, wherein the information of each training alarm event in the at least one training alarm event set includes A label and a feature vector, where the label is used to characterize whether each training alarm event is a root cause alarm event;
  • the associated attributes of the training alarm event are used to characterize the association between the training alarm event and other alarm events in the training alarm event set, the number The relationship is used to characterize the sum of the number of all training alarm events in the training alarm event set including the training alarm event that is the same as the training alarm event, accounting for the total number of training alarm events in the training alarm event set.
  • the resource relationship is used to characterize the propagation relationship between the training alarm event and other alarm events in the training alarm event set.
  • a feature vector of each training alarm event in the training alarm event set includes at least one of an alarm severity level, an alarm name, an event type, and an associated attribute, a timing relationship, a quantity relationship, and a resource At least one of the relationships.
  • At least one training alarm event set is a plurality of training alarm event sets
  • a feature vector of each training alarm event in each training alarm event set in the plurality of training alarm event sets further includes An alarm context, wherein the alarm context of each training alarm event is used to characterize a fault type corresponding to a training alarm event set where each training alarm event is located.
  • the obtaining unit is further configured to: receive the first alarm event judged by the classification model and manually corrected The label of each alarm event in the set, and the feature vector of each alarm event, save the label and the feature vector of each alarm event to a database used to train the classification model, where The label is used to indicate whether each alarm event is a root cause alarm event.
  • the processing unit is specifically configured to:
  • the ratio of the decision tree determined to be a root cause alarm to all decision trees is greater than or equal to a set threshold, it is determined to be a root cause alarm, and if the decision tree determined to be a root cause alarm and all decision trees If the ratio is less than the set threshold, it is determined as a non-root cause alarm.
  • an embodiment of the present application further provides an apparatus including a processor, a memory, and a communication interface.
  • the memory is used to store a computer program
  • the processor is used to read the computer program stored in the memory and implement The first aspect, the method provided by any one of the first aspects.
  • the present application further provides a computer-readable storage medium for storing computer software instructions for performing the functions of any one of the first aspect and the first aspect, which includes instructions for executing the first aspect.
  • the program designed by any one of the design methods of the first aspect.
  • the present application provides a computer program product containing instructions that, when run on a computer, causes the computer to execute the method described in the first aspect and / or any one of the first aspects.
  • FIG. 1 is a schematic diagram of an alarm event provided by this application.
  • FIG. 2 is a schematic diagram of a resource relationship tree provided by the present application.
  • FIG. 3 is a system architecture diagram provided by the present application.
  • FIG. 4 is a flowchart of a method for analyzing a root cause of a failure provided by the present application
  • FIG. 5 is a flowchart of another method for analyzing root cause of a failure provided by the present application.
  • FIG. 6 is a schematic diagram of a random forest provided by this application.
  • FIG. 7 is a schematic diagram of a device provided by this application.
  • FIG. 8 is a hardware structural diagram provided by the present application.
  • the embodiments of the present application provide a method and a device for analyzing root cause of a fault, which are used to solve the problem of low accuracy of root cause identification in the prior art.
  • the method and equipment are based on the same inventive concept. Since the principle of the method and the equipment to solve the problem is similar, the implementation of the equipment and the method can refer to each other, and the duplicated parts are not described again.
  • At least one, which may be one or more, is not limited in this application.
  • a classification model is used to characterize the relationship between the feature vector and the root cause alarm event, and determine whether the alarm event is a root cause alarm event according to the input feature vector of the alarm event.
  • the classification model is determined according to a preset classification algorithm according to at least one training alarm event set.
  • the alarm events in the training alarm event set are obtained offline.
  • the classification model may be updated and updated according to a set time.
  • the online real-time alarm event included in the database used at the time may be an alarm event judged by a classification model and manually corrected.
  • Alarm severity level which is used to characterize the level of the alarm event. It can be expressed in Chinese or English strings. For example, when it is expressed in Chinese, it can be 5 levels of emergency, important, minor, reminder, and unknown. , Chinese character strings can be processed into corresponding features. Due to the progressive relationship between alarm severity levels, separate coding is required, so urgent, important, minor, reminder, and unknown can be processed into 5, 4, 3, 2 respectively.
  • Alarm events carry alarm severity levels when reported. Assume that there are 4 alarm events in a situation, and the alarm severity levels are urgent, important, important, and important. The characteristics of the severity levels are 5, 4, 4, and 4, and the coding can also be in other forms, which are not limited in this application.
  • the name of the alarm which is used to characterize the attributes of the alarm event, can indicate the specific cause of the failure.
  • the name of the alarm will also correspond to a suggestion for recovery operation.
  • the alarm name can be expressed in discrete Chinese or English strings.
  • the alarm name can be ETH_LOS, MPLS_TUNNEL_LOCV, ETH_APS_LOST, TUNNEL_DOWN, and the number of users of the whole machine has decreased to the minimum threshold. Since the alarm names are independent, the One-hot encoding is used in the encoding.
  • the alarm names in a situation are ETH_LOS, MPLS_TUNNEL_LOCV, ETH_APS_LOST, TUNNEL_DOWN, and the number of users of the whole machine is reduced to the minimum threshold.
  • the five alarms The codes corresponding to the names are 00001, 00010, 00100, 01000, 10000, which are the characteristics of the alarm name.
  • the codes can also be in other forms, which are not limited in this application.
  • Event types which are used to characterize the types of alarm events. Specifically, they can be divided into hardware alarms, environmental alarms, line alarms, service alarms, and security alarms. You can also encode the event type by one-hot encoding. It is assumed that the event types in a situation are hardware alarm, environmental alarm, line alarm, service alarm, and security alarm. After one-hot encoding, these five event types The corresponding codes are 00001, 00010, 00100, 01000, 10000, which are the characteristics of the event type. The codes can also be in other forms, which are not limited in this application.
  • Correlation attributes which are used to characterize the correlation between alarm events and other alarm events in a situation, which can specifically be root cause alarm events, non-root cause alarm events may also have no attributes. Whether it is a root cause alarm event is determined based on the correlation between the alarm event and other alarm events. For example, alarm event A causes alarm event B. If alarm event A is a root cause alarm event, then alarm event A The associated attributes of are marked as root cause alarm events, and the associated attributes of alarm event B are marked as non-root cause alarm events. When the alarm event is a root cause alarm event, it is marked as P, and when the alarm event is a non-root cause alarm event, it is marked as C. Assume that the association attribute tags in a situation are P, C, and null respectively. After one-hot encoding, the corresponding codes of the three association attributes are 001, 010, and 100, that is, association attribute characteristics. The encoding can also be in other forms. This application does not limit it.
  • the timing relationship characteristics corresponding to these 5 alarm events are 0.0. 0.14, 0.14, 0.14, 1.
  • the resource relationship is used to characterize the propagation relationship between various alarm events in a situation.
  • it is the client layer alarm event caused by the server layer alarm event, as shown in Figure 1, Figure 1
  • Medium 12,3,4,5,6,7,8,9 represent network elements, and a, b, c, d, and e are alarm events that occur.
  • Combine the alarm event with the directed graph acyclic graph G You can get the alarm event resource relationship tree in the situation as shown in Figure 2.
  • the alarm event located at the root of the tree is the root cause alarm event, marked as 1, and the leaf nodes are marked as 0. For example, there are five alarm events in a situation. After judging by the resource relationship tree, the lowest alarm is only the first alarm, and the other alarms are at a higher level.
  • the characteristics of these five alarms are 1, 0, 0,0,0, where the directed graph acyclic graph G is a diagram that represents the physical and logical connection relationships between network elements, boards, and ports according to the network topology and inventory.
  • the contents represented by 1 and 0 are not limited.
  • the alarm context is used to characterize the fault type corresponding to the situation to which the alarm event belongs, such as line faults, transmission faults, network element disconnection, and dropped group faults.
  • One-hot coding can also be used for coding.
  • the feature becomes m binary features.
  • One-hot is used. Encoding can solve the problem that the classifier is inconvenient to process attribute data, and it also plays a role of expanding features to a certain extent.
  • One-hot encoding needs to encode each feature first, and then encode it. splice. Assume that the number of possible values of the three characteristics of alarm name, event type, and associated attributes are a, b, and c respectively. After one-hot encoding, the feature vector dimension of an alarm changes from 3 dimensions to a + b + c dimension.
  • the fault root cause analysis device aggregates at least one alarm event into at least one alarm event set by using an alarm event aggregation method, and then extracts a feature vector of each alarm event in the at least one alarm set from multiple dimensions. , Inputting the feature vector of each alarm event into a preset classification model determined through machine learning to determine whether each alarm event is a root cause alarm event. It can reduce the manpower investment of experts and improve the accuracy of root cause identification.
  • the root cause analysis device may be a separate server or a software module of a network management device.
  • the system architecture where the root cause analysis device is located may be shown in FIG.
  • the root cause analysis device can also be called root cause identification device, routers, switches, firewalls, load balancing devices, access gateway devices and other network element equipment to generate various types of alarm events (also known as alarm logs, original alarms) Example)
  • the data of the alarm event is shown in Table 1. Table 1 is only a simple example and does not include all the characteristics of the alarm event.
  • the online real-time alarm can be obtained from the data bus.
  • the network management device receives the alarm events sent by various network element devices, and constructs the situation.
  • the alarm events in the situation are judged by the root cause analysis device to determine whether the alarm event is the root cause alarm event.
  • the situation construction can also be completed in the failure root cause analysis device.
  • FIG. 4 is a flowchart of a method for analyzing a root cause of a failure provided by the present application. The method includes:
  • Step S401 The failure root cause analysis device obtains a first alarm event set, where the first alarm event set includes multiple alarm events.
  • Step S402 The failure root cause analysis device extracts a feature vector of a first alarm event in the first alarm set, where some or all of the features in the feature vector are used to characterize the first alarm event and the first Relationship between other alarm events in the alarm event collection.
  • the feature vector includes at least one of an alarm severity level, an alarm name, and an event type, and at least one of an associated attribute, a timing relationship, a quantity relationship, and a resource relationship.
  • the feature vector further includes an alarm Context.
  • the association attribute is used to characterize the association relationship between the first alarm event and other alarm events in the first alarm event set to which it belongs, and the quantitative relationship is used to characterize that the first alarm event set includes the first alarm event
  • the ratio of the total number of all alarm events included in the first alarm event to the total number of alarm events in the first alarm event set, and the resource relationship is used to characterize the first alarm in the first alarm event set
  • a propagation relationship between an event and other alarm events, and the alarm context is used to characterize a fault type corresponding to the first alarm event set.
  • Step S403 Determine whether the first alarm event is a root cause alarm event according to a feature vector of the first alarm event.
  • the fault root cause analysis device inputs the feature vector of each alarm event into a preset classification model, where the classification model is used to characterize the relationship between the feature vector and the root cause alarm event.
  • the classification model may be determined according to at least one training alarm event set and training according to a preset classification algorithm, wherein information of each training alarm event in the at least one training alarm event set includes a label and a feature vector, and the label It is used to characterize whether each training alarm event is a root cause alarm event.
  • the associated attributes of the training alarm event are used to characterize the association between the training alarm event and other alarm events in the training alarm event set, the number The relationship is used to characterize the sum of the number of all training alarm events in the training alarm event set including the training alarm event that is the same as the training alarm event, accounting for the total number of training alarm events in the training alarm event set.
  • the resource relationship is used to characterize the propagation relationship between the training alarm event and other alarm events in the training alarm event set.
  • the at least one training alarm event set may be multiple training alarm event sets, and the feature vector of each training alarm event in each training alarm event set in the multiple training alarm event sets may further include an alarm context, where: The alarm context of each training alarm event is used to characterize a fault type corresponding to the training alarm event set where each training alarm event is located.
  • the feature vector of the training alarm event used in training the classification model and the feature vector of the first alarm event extracted in step S402 are generally consistent, for example, the training alarm event used in training the classification model
  • the feature vector includes alarm severity level, alarm name, event type, correlation attribute, timing relationship, and quantity relationship.
  • the feature vector of the first alarm event extracted in step S402 also includes alarm severity level, alarm name, and event type. , Correlation attributes, timing relationships, and quantity relationships.
  • the root cause analysis device extracts feature vectors of the first alarm event in the first alarm set from multiple dimensions, and uses the feature vectors of the relationship between the first alarm event and other alarm events to determine Whether the first alarm event is a root cause alarm event improves the accuracy of fault root cause identification.
  • the method before step S401, further includes: aggregating multiple alarm events into at least one alarm event set, and using one alarm event set in the at least one alarm event set as the first alarm Event collection.
  • multiple alarm events are aggregated into at least one alarm event set according to a set rule, where the set rule includes one or more of time correlation, topological correlation, and text similarity.
  • the time correlation degree is used to characterize the time correlation of each alarm event. For example, the correlation degree of alarm events with similar time is better, and the alarm events with closer time belong to the possibility of the same fault.
  • the topological correlation is used to characterize the physical relationship of each alarm event. For example, from a spatial topology perspective, the closer the physical correlation of the alarm events is, the better Adjacent alarm events are more likely to belong to the same fault and should be aggregated into an alarm set.
  • the text similarity is used to represent the degree of similarity of strings when each alarm event is represented by a string. For example, the alarm event Alarm name, alarm source, and alarm location information are stitched into strings, and different alarm events are compared by comparing Text string similarity, that the higher the similarity of the text is more likely to belong to the same alarm event of a fault, an alarm should be set to the polymerization.
  • the method further includes: receiving a label of each alarm event in the first alarm event set judged by the classification model and manually corrected, and the label of each alarm event.
  • Feature vector storing the label and the feature vector of each alarm event into a database for training the classification model, wherein the label is used to characterize whether each alarm event is a root cause alarm event .
  • 1 and 0 may respectively represent non-root cause alarm events and root cause alarm events, which are not limited in this application.
  • the classification model adopted can be updated according to the continuously updated database when the alarm event is judged in real time, or it can be updated regularly.
  • the data added in the continuously updated database corresponds to the alarm event corrected by the operation and maintenance personnel.
  • the initial classification model can be determined based on at least one training alarm event set and training according to a preset classification algorithm.
  • the alarm events in the training alarm event set can be obtained from a single machine or a distributed database. No restrictions.
  • the alarm event is directly determined as the root cause alarm event, and a characteristic setting for characterizing the relationship between the alarm event and other alarm events may also be set in the alarm event It is a default value, and it is determined whether the alarm event is a root cause alarm event according to the foregoing method of steps S401 to S403.
  • Step S501 Receive various types of alarm events generated by various network element devices.
  • Step S502 Aggregate the received alarm events according to at least one of the temporal correlation, the topological correlation, and the text similarity to determine at least one alarm event set.
  • Step S503 Perform feature vector extraction for each set of alarm events.
  • the feature vector matrix shown in Table 2 below can be produced.
  • f0 represents the alarm severity level
  • the combination of f11, f12, f13, and f14 represents the alarm name.
  • the combination of f21, f22 represents the event type
  • the combination of f31, f32, and f33 represents the associated attributes
  • f4 represents the timing relationship
  • f5 represents the quantity relationship
  • f6 represents the resource relationship
  • f71, f72 represents the alarm context.
  • Step S504 Input the feature vectors in any row in Table 2 into a preset classification model to perform root cause identification.
  • the classification algorithm used in the classification model may be SVM, GBDT, decision tree, random forest, Bayesian classifier, neural network, but it is not limited to the above algorithm, which is not limited in this application.
  • the ratio of the decision tree to all the decision trees that determine the alarm event corresponding to the feature vector of any row is the root cause alarm.
  • the ratio is greater than or equal to a set threshold, It is determined that the alarm event is a root cause alarm, and if the ratio of the decision tree that is determined to be a root cause alarm to all decision trees is less than the set threshold, the alarm event is determined to be a non-root cause alarm.
  • a random forest classification model with m decision trees identifies alarm event A. If m1 decision tree determines that alarm event A is the root cause and m1> m / 2, the output of the random forest classification model is this alarm. Event A is the root cause alarm event.
  • the schematic diagram of the random forest decision tree is shown in Figure 6.
  • the random forest algorithm is: 1) assuming that the total number of samples in the training set is N and the total feature is F; 2) generating n samples from the training set through a random resampling method with replacement to form a single training set 3) For a single training set, select k features from the F features, obtain the best segmentation point by establishing a decision tree, and generate a CART decision tree; 4) repeat step 2) and steps m times 3) Generate m decision trees, where m is input from external configuration; 5) Combine m decision trees to form a random forest model.
  • the data set D can be divided into two subsets, that is, the selection of the optimal segmentation point for a specific feature is completed; 6) Steps 3), 4), and 5) are recursively called for the above two child nodes until the Stop conditions; 7) Generate a CART decision tree, and save m CART decision trees to obtain the classification model after offline training.
  • Step S505 After the root cause alarm event is identified, dispatch is performed, and the operation and maintenance personnel correct the identified root cause alarm event and add a feedback mark. If the classification model is correct, it is marked as 1. If the classification model is incorrect, it is marked as 0. The labeled value is added to the feature vector matrix of Table 2 to generate Table 3. The first column in Table 3 is the feedback marker. The generated table 3 is updated into the database as a training alarm event collection for the classification model.
  • the classification model is determined according to at least one training alarm event set and training according to a preset classification algorithm, wherein the information of each training alarm event in the at least one training alarm event set includes a label and a feature vector. That is, as shown in Table 3, the label is used to indicate whether each training alarm event is a root cause alarm event.
  • the acquisition of training data when training the classification model requires ordinary operation and maintenance personnel to simply determine whether the root cause alarm event identified by the fault root cause analysis device is correct in daily work, without the need for expert input, reducing manpower Investment, and has universality, no need to redesign and develop the network for different products, avoiding the problem of repeated investment.
  • Combining different data, extracting multi-dimensional features ensures the accuracy of the algorithm; and through continuous learning, new models are obtained, and the recognition accuracy will gradually improve.
  • the device includes: an obtaining unit 701, configured to obtain a first alarm event set, where the first alarm event The set includes a plurality of alarm events; a processing unit 702 is configured to extract a feature vector of the first alarm event for a first alarm event in the first alarm event set, where part or all of the feature vectors are The feature is used to characterize the relationship between the first alert event and other alert events in the first alert event set; the processing unit 702 is further configured to determine the feature vector according to the feature vector of the first alert event Whether the first alarm event is a root cause alarm event.
  • the processing unit is specifically configured to: input a feature vector of the first alarm event into a preset classification model to determine whether the first alarm event is a root cause alarm event
  • the classification model is used to characterize a relationship between a feature vector and a root cause alarm event.
  • the obtaining unit is specifically configured to aggregate multiple alarm events into at least one alarm event set, and use one alarm event set in the at least one alarm event set as the first alarm. Event collection.
  • the obtaining unit is specifically configured to aggregate multiple alarm events into at least one alarm set according to a set rule, where the set rule includes at least one of time correlation, topology correlation, and text similarity.
  • the set rule includes at least one of time correlation, topology correlation, and text similarity.
  • the feature vector includes at least one of an alarm severity level, an alarm name, and an event type, and at least one of an association attribute, a timing relationship, a quantity relationship, and a resource relationship, where the association attribute is used to represent all
  • the association relationship between the first alarm event and other alarm events in the first alarm event set to which the first alarm event belongs is described, and the quantity relationship is used to characterize the first alarm event including the first alarm event and the first alarm event in the first alarm event set.
  • the ratio of the sum of the same number of all alarm events to the total number of alarm events in the first alarm event set, and the resource relationship is used to characterize the propagation between the first alarm event and other alarm events in the first alarm event set relationship.
  • the feature vector further includes an alarm context, wherein the alarm context is used to characterize a fault type corresponding to a first alarm event set to which the first alarm event belongs.
  • the classification model is determined according to at least one training alarm event set and training according to a preset classification algorithm, wherein information of each training alarm event in the at least one training alarm event set Including a label and a feature vector, where the label is used to characterize whether each training alarm event is a root cause alarm event;
  • the associated attributes of the training alarm event are used to characterize the association between the training alarm event and other alarm events in the training alarm event set, the number The relationship is used to characterize the sum of the number of all training alarm events in the training alarm event set including the training alarm event that is the same as the training alarm event, accounting for the total number of training alarm events in the training alarm event set.
  • the resource relationship is used to characterize the propagation relationship between the training alarm event and other alarm events in the training alarm event set.
  • the feature vector of each training alarm event in the training alarm event set includes at least one of an alarm severity level, an alarm name, an event type, and at least one of an associated attribute, a timing relationship, a quantity relationship, and a resource relationship.
  • the at least one training alarm event set is a plurality of training alarm event sets, and a feature vector of each training alarm event in each training alarm event set in the plurality of training alarm event sets further includes an alarm context, where The alarm context of each training alarm event is used to characterize a fault type corresponding to a training alarm event set where each training alarm event is located.
  • the obtaining unit is further configured to: receive the first alarm that is judged by the classification model and manually corrected A label of each alarm event in the event set, and a feature vector of each alarm event, storing the label and the feature vector of each alarm event in a database for training the classification model, wherein: The label is used to characterize whether each alarm event is a root cause alarm event.
  • the processing unit is specifically configured to: for the first alarm event, if a ratio of a decision tree determined to be a root cause alarm to all decision trees is greater than or equal to If a threshold is set, it is determined as a root cause alarm, and if the ratio of the decision tree judged to be a root cause alarm to all decision trees is less than the set threshold value, it is determined as a non-root cause alarm.
  • each functional module in each embodiment of the present application may be integrated into one process. In the device, it can also exist alone physically, or two or more modules can be integrated into one module.
  • the above integrated modules can be implemented in the form of hardware or software functional modules.
  • a device may include a processor 802.
  • the hardware of the entity corresponding to the processing unit 702 may be the processor 802.
  • the processor 802 may be a central processing module (English: central processing unit, CPU for short), or a digital processing module.
  • the device may further include a communication interface 801 (which may be a transceiver), and the hardware entity corresponding to the obtaining unit 701 may be a communication interface 801.
  • the device may further include: a memory 803, configured to store a program executed by the processor 802.
  • the memory 803 may be a non-volatile memory, such as a hard disk (English: hard disk drive (abbreviation: HDD)) or a solid state hard disk (English: solid-state drive (abbreviation: SSD)), etc., or a volatile memory (English: volatile memory), such as random-access memory (English: random-access memory, abbreviation: RAM).
  • the memory 803 is any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.
  • the processor 802 is configured to execute the program code stored in the memory 803, and is specifically configured to execute the method described in the embodiment shown in FIG. 4 and FIG. 5. For details, reference may be made to the method described in the embodiments shown in FIG. 4 and FIG. 5, which is not repeatedly described in this application.
  • the embodiment of the present application is not limited to a specific connection medium between the communication interface 801, the processor 802, and the memory 803.
  • the memory 803, the processor 802, and the communication interface 801 are connected by a bus 804 in FIG. 8.
  • the bus is indicated by a thick line in FIG. It is not limited.
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is used in FIG. 8, but it does not mean that there is only one bus or one type of bus.
  • An embodiment of the present invention further provides a computer-readable storage medium for storing computer software instructions to be executed to execute the processor, which includes a program for executing the processor.
  • this application may be provided as a method, a system, or a computer program product. Therefore, this application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, this application may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
  • computer-usable storage media including, but not limited to, disk storage, CD-ROM, optical storage, etc.
  • At least one means one or more, and “multiple” means two or more.
  • At least one or more of the following” or similar expressions refers to any combination of these items, including any combination of single or plural items.
  • “at least one or more of a, b, or c”, or “at least one or more of a, b, and c” can be expressed as: a, b, c, ab ( That is, a and b), ac, bc, or abc, where a, b, and c can be single or multiple.
  • the size of the sequence numbers of the above processes does not mean the order of execution, and some or all of the steps may be performed in parallel or sequentially.
  • the execution order of each process shall be based on its function and The internal logic is determined without any limitation to the implementation process of the embodiments of the present application.
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to work in a specific manner such that the instructions stored in the computer-readable memory produce a manufactured article including an instruction device, the instructions
  • the device implements the functions specified in one or more flowcharts and / or one or more blocks of the block diagram.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of steps can be performed on the computer or other programmable device to produce a computer-implemented process, which can be executed on the computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more flowcharts and / or one or more blocks of the block diagrams.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Evolutionary Computation (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Evolutionary Biology (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Artificial Intelligence (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Health & Medical Sciences (AREA)
  • Biomedical Technology (AREA)
  • Quality & Reliability (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Debugging And Monitoring (AREA)

Abstract

一种故障根因分析的方法及装置，用以解决现有技术中故障根因识别的准确度低的问题。包括：故障根因分析装置获取第一告警事件集合，所述第一告警事件集合包括多个告警事件；对于所述第一告警事件集合中的第一告警事件，提取所述第一告警事件的特征向量，其中，所述特征向量中的部分或全部特征用于表征所述第一告警事件和所述第一告警事件集合中其它告警事件之间的关系，根据所述第一告警事件的特征向量确定所述第一告警事件是否为根因告警事件。本申请根据第一告警事件和其它告警事件之间的关系的特征向量来判断第一告警事件是否为根因告警事件，并提高故障根因识别的准确度。

Description

一种故障根因分析的方法及装置 技术领域
本申请涉及信息技术领域，尤其涉及一种故障根因分析的方法及装置。
背景技术
随着网络规模的扩大，各类网络设备的增多，这些网络设备会产生海量的各类型的告警，给运营支撑系统(operations support system，OSS)带来了很大的压力，原因在于这些海量告警中存在大量的无效告警，重复告警等不需要关注的告警，而运维人员无法从海量的告警中准确识别出故障根因，排障效率低，导致了大量的派单，浪费人力，运维成本高。
在现有技术中，为了提高排障效率，减少派单，利用告警事件的数据，例如告警事件的类型名称，判断该告警事件是否为根因，但准确度低。
综上所述，提高故障根因识别的准确度是目前需要解决的问题。
发明内容
本申请提供一种故障根因分析的方法及装置，用以解决现有技术中故障根因识别的准确度低的问题。
第一方面，本申请提供了一种故障根因分析的方法，所述方法包括：
获取第一告警事件集合，所述第一告警事件集合包括多个告警事件；对于所述第一告警事件集合中的第一告警事件，提取所述第一告警事件的特征向量，其中，所述特征向量中的部分或全部特征用于表征所述第一告警事件和所述第一告警事件集合中其它告警事件之间的关系；根据所述第一告警事件的特征向量，确定所述第一告警事件是否为根因告警事件。
通过上述方法，故障根因分析装置从多个维度提取所述第一个告警集合中第一告警事件的特征向量，使用第一告警事件和其它告警事件之间的关系的特征向量来判断所述第一告警事件是否为根因告警事件，提高了故障根因识别的准确度。
在一种可能的设计中，根据所述第一告警事件的特征向量确定所述第一告警事件是否为根因告警事件，具体包括：将所述第一告警事件的特征向量输入到预先设置的分类模型中，以确定所述第一告警事件是否为根因告警事件，其中，所述分类模型用于表征特征向量和根因告警事件之间的关系。
通过该方法，采用预先设置的分类模型判断第一告警事件是否为根因告警事件，通过机器学习的方法进一步提高了故障根因识别的准确度。
在一种可能的设计中，所述获取第一告警事件集合，具体包括：将多个告警事件聚合为至少一个告警事件集合，将所述至少一个告警事件集合中的一个告警事件集合作为所述第一告警事件集合。
通过该方法，确定出如何获取第一告警事件集合，是实现本申请的方法不可缺少的步 骤。
在一种可能的设计中，所述将多个告警事件聚合为至少一个告警事件集合，具体包括：
将多个告警事件按照设定规则聚合为至少一个告警集合，其中，所述设定规则包括时间关联度、拓扑关联度、文本相似度中的至少一个，其中，所述时间关联度用于表征各告警事件在时间上的关联关系，拓扑关联度用于表征各告警事件在物理位置上的关联关系，文本相似度用于表征各告警事件用字符串表示时，字符串的相似程度。
在一种可能的设计中，所述特征向量包括告警严重等级、告警名称、事件类型中的至少一个、以及关联属性、时序关系、数量关系、资源关系中的至少一个，其中，所述关联属性用于表征所述第一告警事件在所属的第一告警事件集合中与其他告警事件的关联关系，所述数量关系用于表征所述第一告警事件集合中包括第一告警事件在内的与第一告警事件相同的所有告警事件的个数的总和占第一告警事件集合中全部告警事件数量的比值，所述资源关系用于表征所述第一告警事件集合中第一告警事件与其它告警事件间的传播关系。
在一种可能的设计中，所述特征向量还包括告警上下文，其中，所述告警上下文用于表征所述第一告警事件所属的第一告警事件集合对应的故障类型。
在一种可能的设计中，所述分类模型是根据至少一个训练告警事件集合，按照预设分类算法训练确定的，其中，所述至少一个训练告警事件集合中的每条训练告警事件的信息包括标签和特征向量，所述标签用于表征所述每条训练告警事件是否为根因告警事件；
对于所述训练告警事件集合中的任一训练告警事件，所述训练告警事件的关联属性用于表征所述训练告警事件在所述训练告警事件集合中与其他告警事件的关联关系，所述数量关系用于表征所述训练告警事件集合中包括所述训练告警事件在内的与所述训练告警事件相同的所有训练告警事件的个数的总和占所述训练告警事件集合中全部训练告警事件数量的比值，所述资源关系用于表征所述训练告警事件集合中所述训练告警事件与其它告警事件间的传播关系。
在一种可能的设计中，所述训练告警事件集合中的每条训练告警事件的特征向量包括告警严重等级、告警名称、事件类型中的至少一个、以及关联属性、时序关系、数量关系、资源关系中的至少一个。
在一种可能的设计中，至少一个训练告警事件集合为多个训练告警事件集合，所述多个训练告警事件集合中的每个训练告警事件集合中的每条训练告警事件的特征向量还包括告警上下文，其中，所述每条训练告警事件的告警上下文用于表征所述每条训练告警事件所在的训练告警事件集合对应的故障类型。
在一种可能的设计中，确定所述第一告警事件是否为根因告警事件之后，该方法还包括：接收到经过所述分类模型判断并人工矫正后的所述第一告警事件集合中每条告警事件的标签，以及所述每条告警事件的特征向量，将所述标签以及所述每条告警事件的特征向量保存到用于训练所述分类模型的数据库中，其中，所述标签用于表征所述每条告警事件是否为根因告警事件。
通过该方法，使用人工矫正后的所述第一告警事件的标签进行分类模型训练，可以提高分类模型的准确度。
在一种可能的设计中，若所述预设分类算法为随机森林，则所述确定所述第一告警事件是否为根因告警，具体包括：对于所述第一告警事件，若判断为根因告警的决策树与全 部决策树的比值大于或等于设定阈值，则确定为根因告警，若判断为根因告警的决策树与全部决策树的比值小于所述设定阈值，则确定为非根因告警。
第二方面，本申请提供一种装置，所述装置包括：获取单元，用于获取第一告警事件集合，所述第一告警事件集合包括多个告警事件；处理单元，用于对于所述第一告警事件集合中的第一告警事件，提取所述第一告警事件的特征向量，其中，所述特征向量中的部分或全部特征用于表征所述第一告警事件和所述第一告警事件集合中其它告警事件之间的关系；所述处理单元，还用于根据所述第一告警事件的特征向量，确定所述第一告警事件是否为根因告警事件。
在一种可能的设计中，所述处理单元具体用于：将所述第一告警事件的特征向量输入到预先设置的分类模型中，以确定所述第一告警事件是否为根因告警事件，其中，所述分类模型用于表征特征向量和根因告警事件之间的关系。
在一种可能的设计中，所述获取单元具体用于：将多个告警事件聚合为至少一个告警事件集合，将所述至少一个告警事件集合中的一个告警事件集合作为所述第一告警事件集合。
在一种可能的设计中，所述获取单元具体用于：将多个告警事件按照设定规则聚合为至少一个告警集合，其中，所述设定规则包括时间关联度、拓扑关联度、文本相似度中的至少一个，其中，所述时间关联度用于表征各告警事件在时间上的关联关系，拓扑关联度用于表征各告警事件在物理位置上的关联关系，文本相似度用于表征各告警事件用字符串表示时，字符串的相似程度。
在一种可能的设计中，所述特征向量包括告警严重等级、告警名称、事件类型中的至少一个、以及关联属性、时序关系、数量关系、资源关系中的至少一个，其中，所述关联属性用于表征所述第一告警事件在所属的第一告警事件集合中包括第一告警事件在内的与第一告警事件相同的所有告警事件的个数的总和占第一告警事件集合中全部告警事件数量的比值，所述资源关系用于表征所述第一告警事件集合中第一告警事件与其它告警事件间的传播关系。
在一种可能的设计中，所述特征向量还包括告警上下文，其中，所述告警上下文用于表征所述第一告警事件所属的第一告警事件集合对应的故障类型。
在一种可能的设计中，所述分类模型是根据至少一个训练告警事件集合，按照预设分类算法训练确定的，其中，所述至少一个训练告警事件集合中的每条训练告警事件的信息包括标签和特征向量，所述标签用于表征所述每条训练告警事件是否为根因告警事件；
对于所述训练告警事件集合中的任一训练告警事件，所述训练告警事件的关联属性用于表征所述训练告警事件在所述训练告警事件集合中与其他告警事件的关联关系，所述数量关系用于表征所述训练告警事件集合中包括所述训练告警事件在内的与所述训练告警事件相同的所有训练告警事件的个数的总和占所述训练告警事件集合中全部训练告警事件数量的比值，所述资源关系用于表征所述训练告警事件集合中所述训练告警事件与其它告警事件间的传播关系。
在一种可能的设计中，所述训练告警事件集合中的每条训练告警事件的特征向量包括告警严重等级、告警名称、事件类型中的至少一个、以及关联属性、时序关系、数量关系、资源关系中的至少一个。
在一种可能的设计中，至少一个训练告警事件集合为多个训练告警事件集合，所述多个训练告警事件集合中的每个训练告警事件集合中的每条训练告警事件的特征向量还包括告警上下文，其中，所述每条训练告警事件的告警上下文用于表征所述每条训练告警事件所在的训练告警事件集合对应的故障类型。
在一种可能的设计中，确定所述第一告警事件是否为根因告警事件之后，所述获取单元还用于：接收到经过所述分类模型判断并人工矫正后的所述第一告警事件集合中每条告警事件的标签，以及所述每条告警事件的特征向量，将所述标签以及所述每条告警事件的特征向量保存到用于训练所述分类模型的数据库中，其中，所述标签用于表征所述每条告警事件是否为根因告警事件。
在一种可能的设计中，若所述预设分类算法为随机森林，则所述处理单元具体用于：
对于所述第一告警事件，若判断为根因告警的决策树与全部决策树的比值大于或等于设定阈值，则确定为根因告警，若判断为根因告警的决策树与全部决策树的比值小于所述设定阈值，则确定为非根因告警。
第三方面，本申请实施例还提供了一种装置，包括处理器、存储器和通信接口，所述存储器用于存储计算机程序，所述处理器用于读取所述存储器中存储的计算机程序并实现第一方面、第一方面的任意一种设计提供的方法。
第四方面，本申请还提供了一种计算机可读存储介质，用于存储为执行上述第一方面、第一方面的任意一种设计的功能所用的计算机软件指令，其包含用于执行上述第一方面、第一方面的任意一种设计的方法所设计的程序。
第五方面，本申请提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行第一方面和/或第一方面的任一种设计所述的方法。
附图说明
图1为本申请提供的一种告警事件示意图；
图2为本申请提供的一种资源关系树示意图；
图3为本申请提供的一种系统架构图；
图4为本申请提供的一种故障根因分析的方法流程图；
图5为本申请提供的另一种故障根因分析的方法流程图；
图6为本申请提供的随机森林示意图；
图7为本申请提供的一种的装置示意图；
图8为本申请提供的一种的硬件结构图。
具体实施方式
下面将结合附图对本申请实施例作进一步地详细描述。
本申请实施例提供一种故障根因分析的方法及装置，用于解决现有技术中故障根因识别的准确度低的问题。其中，方法和设备是基于同一发明构思的，由于方法及设备解决问题的原理相似，因此设备与方法的实施可以相互参见，重复之处不再赘述。
随着网络规模的扩大，路由器，交换机，防火墙，负载均衡设备，接入网关设备等各类网络设备增多，这些网络设备会上报海量告警给OSS，但这些海量告警中存在大量的无效 告警，重复告警等不需要关注的告警，运维人员无法从海量的告警中准确识别出故障根因，导致了大量的派单，浪费人力，运维成本高。在现有技术中，利用告警事件的数据，例如告警事件的类型名称，判断该告警事件是否为根因，准确度低，因此，如何提高故障根因识别的准确度是目前需要解决的问题。
以下，对本申请中的部分用语进行解释说明，以便使本领域技术人员理解。
1)告警事件集合，也可以称为situation，是根据时间关联度，拓扑关联度，文本相似度中的至少一个维度，对一个可能的故障对应的一系列告警事件进行聚合得到的，举例说明：假设原始告警事件的集合为A＝[a 1,a 2,…,a n]，聚合后的所有situation记为S，S＝{s 1:[a 1,…,a k],…,s i:[a p,…,a q],…,s r:[a m,…,a n]}，其中r是situation的数量，1<＝k，p，q，m<n，即每一个situation s i都是一系列告警事件的集合，其中，所述告警事件集合可以是通过聚合的方式得到的也可以是人工确定的。
2)至少一个，可以为一个，也可以为多个，本申请对其不做限定。
3)分类模型，用于表征所述特征向量和根因告警事件之间的关系，根据输入的告警事件的特征向量，判断该告警事件是否为根因告警事件。其中，所述分类模型是按照预设分类算法根据至少一个训练告警事件集合确定的，所述训练告警事件集合中的告警事件是离线获取的，所述分类模型可以按照设定时间进行更新，更新时使用的数据库中包括的在线实时告警事件可以是经过分类模型判断并人工矫正后的告警事件。
4)告警严重等级，用于表征告警事件的等级，可以用中文或者英文的字符串表示，例如，用中文表示时可以为紧急、重要、次要、提醒、未知5个等级，在数据处理时，可以将中文字符串处理为对应的特征，由于告警严重等级间存在递进的关系，需要进行单独编码，因此紧急、重要、次要、提醒、未知可以分别处理成5，4，3，2，1等告警严重等级特征，告警事件在上报时携带告警严重等级，假设，一个situation中有4条告警事件，告警严重等级分别为紧急、重要、重要，重要，则该4条告警事件的告警严重等级特征分别为5，4，4，4，编码也可以为其它形式，本申请对其不做限定。
5)告警名称，用于表征告警事件的属性，可以表征具体的故障原因，可选的，告警名称还会对应一个恢复操作建议。其中，告警名称可以用离散的中文或者英文的字符串表示，例如，告警名称可以为ETH_LOS、MPLS_TUNNEL_LOCV、ETH_APS_LOST、TUNNEL_DOWN、整机用户数降到最小阈值等；由于告警名称间都是独立的，因此在编码时采用独热(one-hot)编码，假设，一个situation中的告警名称有ETH_LOS、MPLS_TUNNEL_LOCV、ETH_APS_LOST、TUNNEL_DOWN、整机用户数降到最小阈值，进行one-hot编码后，这5个告警名称分别对应的编码为00001，00010，00100，01000，10000，即告警名称特征，编码也可以为其它形式，本申请对其不做限定。
6)事件类型，用于表征告警事件的类型，具体的，可以分为硬件告警、环境告警、线路告警、业务告警、安全告警等。也可以同通过one-hot编码对事件类型进行编码，假设，一个situation中的事件类型有硬件告警、环境告警、线路告警、业务告警、安全告警，进行one-hot编码后，这5个事件类型分别对应的编码为00001，00010，00100，01000，10000，即事件类型特征，编码也可以为其它形式，本申请对其不做限定。
7)关联属性，用于表征告警事件在一个situation中与其他告警事件的关联关系，具体可以为根因告警事件、非根因告警事件也可能无属性，各告警事件的关联属性中所标记 的是否为根因告警事件，是根据该告警事件和其他告警事件的关联关系确定的，例如告警事件A引起告警事件B，则告警事件A对于告警事件B就是根因告警事件，则将告警事件A的关联属性标记为根因告警事件，将告警事件B的关联属性标记为非根因告警事件。当告警事件为根因告警事件时，标记为P，当告警事件为非根因告警事件时标记为C。假设一个situation中关联属性标记分别为P、C和空，进行one-hot编码后，这3个关联属性分别对应的编码为001，010，100，即关联属性特征，编码也可以为其它形式，本申请对其不做限定。
8)时序关系，用于表征告警事件在一个situation中发生的时间顺序，还可以表征各告警事件之间在时间上的距离关系，具体的，首先根据告警事件发生时间对situation中所有的告警事件进行排序，将告警事件发生时间构造为向量T＝[t 1，t 2，…t i，…，t n]，1<＝i<＝n，由于不同的situation持续时间不一样，因此需要进行归一化处理，即ti时刻的告警事件所对应的时序特征Ti＝(ti-min(T))/(max(T)-min(T))。例如，一个situation中有5条告警事件，发生时间分别为10:01，10:02，10:02，10:02，10:08，则这5个告警事件对应的时序关系特征分别为0.0，0.14，0.14，0.14，1。
9)数量关系，用于表征一个situation中相同告警事件的数量占situation中全部告警事件数量的比值，具体的，situation中有N i个i告警事件，记i告警事件的次数为N i，situation中告警事件总数有N个，则i告警事件的数量关系特征为C i，C i＝N i/N。在具体实现时，可以将来自同一告警源的具有相同告警名称的告警事件看做相同告警事件。
10)资源关系，用于表征一个situation中各个告警事件间的传播关系，在垂直方向上，都是server层告警事件引起其承载的client层告警事件，举例说明，如图1所示，图1中1，2，3，4，5，6，7，8，9代表网元，a，b，c，d，e为发生的告警事件，将告警事件与有向图无环图G相结合，可以得到如图2所示的该situation中告警事件资源关系树，位于树根的告警事件是根因告警事件，标记为1，叶子节点标记为0。例如，一个situation中有5个告警事件，通过资源关系树判断后，处在最底层的告警只有第一个告警，其他告警位于更上层次，那么这5个告警的特征分别为1，0，0，0，0，其中，所示有向图无环图G为根据网络拓扑和存量，将网元、单板、端口间的物理和逻辑连接关系进行表示的图，本申请实施例中对1和0所表示的内容不做限定。
11)告警上下文，用于表征告警事件所属的situation对应的故障类型，例如，线路类故障、传输故障、网元脱管、掉线群障等，编码时也可以采用独热one-hot编码。
12)多个，是指两个或两个以上。
本申请实施例中，对于采用one-hot编码的特征，假设该特征具有m个可能的取值，则经过one-hot编码后，该特征就变成了m个二元特征，采用one-hot编码，可以解决分类器不方便处理属性数据的问题，同时也在一定程度上起到了扩充特征的作用，在进行数据处理时，One-hot编码需要针对每个特征先进行编码，编码后再进行拼接。假设，告警名称、事件类型、关联属性这3个特征每个可能的取值的数量分别为a，b，c，则经过one-hot编码后，一条告警的特征向量维度从3维变成了a+b+c维。
另外，需要理解的是，在本申请的描述中，“第一”、“第二”等词汇，仅用于区分描述的目的，而不能理解为指示或暗示相对重要性，也不能理解为指示或暗示顺序。
本申请实施例中，故障根因分析装置采用告警事件聚合的方式将至少一个告警事件聚 合为至少一个告警事件集合，然后从多个维度提取所述至少一个告警集合中每条告警事件的特征向量，将所述每条告警事件的特征向量输入到预先设置的通过机器学习确定的分类模型中，确定所述每条告警事件是否为根因告警事件。可以减少专家人力投入，提高故障根因识别的准确度。
在本申请实施例中，故障根因分析装置可以为一个单独的服务器，也可以是网管设备的一个软件模块，具体的，故障根因分析装置所在的系统架构可以图3所示，所述故障根因分析装置也可以称为根因识别装置，路由器，交换机，防火墙，负载均衡设备，接入网关设备等各类网元设备产生各种类型的告警事件(也可以称为告警日志、原始告警实例)，所述告警事件的数据如表1所示，表1仅仅是一个简单的例子，并没有包括告警事件的全部特征，在线实时告警可以从数据总线获取。
表1
Figure PCTCN2019091207-appb-000001
网管设备接收各类网元设备发送出的告警事件，进行situation构建，将situation中的告警事件通过故障根因分析装置进行判断，确定告警事件是否为根因告警事件，若为根因则派单给OSS，本申请实施例中，situation构建也可以在故障根因分析装置中完成。
下面结合附图4对上述系统架构中situation构建和故障根因分析装置进行判断告警事件是否为根因告警事件的方案进行具体说明。具体参见图4，为本申请提供的一种故障根因分析的方法流程图。该方法包括：
步骤S401、故障根因分析装置获取第一告警事件集合，所述第一告警事件集合包括多个告警事件。
步骤S402、故障根因分析装置提取所述第一告警集合中第一告警事件的特征向量，其中，所述特征向量中的部分或全部特征用于表征所述第一告警事件和所述第一告警事件集合中其它告警事件之间的关系。
具体的，所述特征向量包括告警严重等级、告警名称、事件类型中的至少一个、以及关联属性、时序关系、数量关系、资源关系中的至少一个，可选的，所述特征向量还包括告警上下文。所述关联属性用于表征所述第一告警事件在所属的第一告警事件集合中与其他告警事件的关联关系，所述数量关系用于表征所述第一告警事件集合中包括第一告警事件 在内的与第一告警事件相同的所有告警事件的个数的总和占第一告警事件集合中全部告警事件数量的比值，所述资源关系用于表征所述第一告警事件集合中第一告警事件与其它告警事件间的传播关系，所述告警上下文用于表征所述第一告警事件集合对应的故障类型。
步骤S403、根据所述第一告警事件的特征向量，确定所述第一告警事件是否为根因告警事件。
具体的，故障根因分析装置将所述每条告警事件的特征向量输入到预先设置的分类模型中，其中，所述分类模型用于表征所述特征向量和根因告警事件之间的关系。
该分类模型可以是根据至少一个训练告警事件集合，按照预设分类算法训练确定的，其中，所述至少一个训练告警事件集合中的每条训练告警事件的信息包括标签和特征向量，所述标签用于表征所述每条训练告警事件是否为根因告警事件。对于所述训练告警事件集合中的任一训练告警事件，所述训练告警事件的关联属性用于表征所述训练告警事件在所述训练告警事件集合中与其他告警事件的关联关系，所述数量关系用于表征所述训练告警事件集合中包括所述训练告警事件在内的与所述训练告警事件相同的所有训练告警事件的个数的总和占所述训练告警事件集合中全部训练告警事件数量的比值，所述资源关系用于表征所述训练告警事件集合中所述训练告警事件与其它告警事件间的传播关系。
上述至少一个训练告警事件集合可以为多个训练告警事件集合，所述多个训练告警事件集合中的每个训练告警事件集合中的每条训练告警事件的特征向量还可以包括告警上下文，其中，所述每条训练告警事件的告警上下文用于表征所述每条训练告警事件所在的训练告警事件集合对应的故障类型。
可以理解的是，在训练分类模型时用到的训练告警事件的特征向量和步骤S402中提取的第一告警事件的特征向量通常是一致的，如，在训练分类模型时用到的训练告警事件的特征向量包括告警严重等级、告警名称、事件类型、关联属性、时序关系和数量关系，相应地，在步骤S402中提取的第一告警事件的特征向量也包括告警严重等级、告警名称、事件类型、关联属性、时序关系和数量关系。
本申请实施例中，故障根因分析装置从多个维度提取所述第一个告警集合中第一告警事件的特征向量，使用第一告警事件和其它告警事件之间的关系的特征向量来判断所述第一告警事件是否为根因告警事件，提高了故障根因识别的准确度。
所述第一告警事件集合中的其他告警事件的处理方法与所述第一告警事件相同，本发明在此不一一赘述。
在一种可能的设计中，步骤S401之前，该方法还包括：将多个告警事件聚合为至少一个告警事件集合，将所述至少一个告警事件集合中的一个告警事件集合作为所述第一告警事件集合。
具体的，将多个告警事件按照设定规则聚合为至少一个告警事件集合，其中，所述设定规则包括时间关联度、拓扑关联度、文本相似度中的一个或多个，本申请对其不做限定，其中，所述时间关联度用于表征各告警事件在时间上的关联关系，举例说明，时间相近的告警事件关联度比较好，时间越接近的告警事件属于同一个故障的可能性大，应该被聚合到一个告警集合中；拓扑关联度用于表征各告警事件在物理位置上的关联关系，举例说明，从空间拓扑看，物理上位置比较靠近的告警事件关联度比较好，越靠近的告警事件属于同一个故障的可能性更大，应该被聚合到一个告警集合中，文本相似度用于表征各告警事件用字符串表示时，字符串的相似程度，举例说明，将告警事件的告警名称、告警源、告警定位信息拼接为字符串，通过比较不同告警事件字符串的文本相似程度，认为文本相似度 越高的告警事件属于同一个故障的可能性更大，应该被聚合到一个告警集合中。
在一种可能的设计中，在步骤S404之后，还包括：接收到经过所述分类模型判断并人工矫正后的第一告警事件集合中每条告警事件的标签，以及所述每条告警事件的特征向量，将所述标签以及所述每条告警事件的特征向量保存到用于训练所述分类模型的数据库中，其中，所述标签用于表征所述每条告警事件是否为根因告警事件。
举例说明，假设分类模型判断为根因告警事件，标记为1，派单后，运维人员发现判断错误，实际上是非根因告警事件，运维人员对其进行人工矫正，标记为0，本申请实施例中1和0可以为分别代表非根因告警事件和根因告警事件，本申请对其不做限定。
本申请实施例中，采用的分类模型在对告警事件进行实时判断时可以根据不断更新的数据库进行更新，也可以定期更新，不断更新的数据库中增加的数据为运维人员矫正后的告警事件对应的标签和特征向量，最初的分类模型可以根据至少一个训练告警事件集合，按照预设分类算法训练确定的，训练告警事件集合中的告警事件可以从单机或者分布式数据库中获取，本申请对其不做限定。
可选的，若所述第一告警事件集合只有一个告警事件，将该告警事件直接确定为根因告警事件，也可以将该告警事件中用于表征与其他告警事件之间的关系的特征设置为默认值，并按照前述步骤S401至S403的方法确定该告警事件是否为根因告警事件。
下面通过一个完整的实施例对本申请提出的故障根因分析的方法进行详细的说明，具体如图5所示。
步骤S501、接收各类网元设备产生各种类型的告警事件。
步骤S502、根据时间关联度，拓扑关联度，文本相似度中的至少一个维度对将接收到的告警事件进行聚合，确定出至少一个告警事件集合。
步骤S503、针对每一个告警事件集合，进行特征向量提取。
举例说明，告警事件集合经过特征向量提取，并进行编码后，可以生产如下表2所示的特征向量矩阵，表2中f0表示告警严重等级，f11、f12、f13、f14的组合表示告警名称，f21、f22的组合表示事件类型，f31、f32、f33的组合表示关联属性，f4表示时序关系，f5表示数量关系，f6表示资源关系，f71、f72的组合表示告警上下文。
表2
f0 f11 f12 f13 f14 f21 f22 f31 f32 f33 f4 f5 f6 f71 f72
5 0 0 0 1 0 1 0 0 1 0 0.29 1 0 1
3 0 0 1 0 0 1 0 1 0 0.25 0.71 0 0 1
4 0 0 1 0 0 1 1 0 0 0.25 0.71 0 0 1
3 0 0 1 0 0 1 0 1 0 0.25 0.71 0 0 1
3 0 0 1 0 0 1 0 1 0 0.25 0.71 0 0 1
5 0 0 0 1 0 1 0 0 1 0 0.29 1 0 1
3 0 0 1 0 0 1 0 1 0 0.25 0.71 0 0 1
5 0 1 0 0 1 0 0 0 1 0 0.5 0 1 0
5 1 0 0 0 0 1 0 1 0 0 0.5 0 1 0
5 0 1 0 0 1 0 0 0 1 0.1 0.5 0 1 0
5 1 0 0 0 0 1 0 1 0 0.1 0.5 0 1 0
5 0 1 0 0 1 0 0 0 1 1 0.5 0 1 0
5 1 0 0 0 0 1 0 1 0 1 0.5 0 1 0
步骤S504、将上述表2中任一行特征向量输入到预先设置的分类模型中，进行根因识别。
具体的，所述分类模型中采用的分类算法可以为SVM、GBDT、决策树、随机森林、贝叶斯分类器，神经网络，但不限于上述算法，本申请对其不做限定。
以随机森林算法为例，在进行根因识别时，即计算判断所述任一行特征向量对应的告警事件为根因告警的决策树与全部决策树的比值，当比值大于或等于设定阈值，则确定告警事件为根因告警，若判断为根因告警的决策树与全部决策树的比值小于所述设定阈值，则确定告警事件为非根因告警。举例说明：假设有m棵决策树的随机森林分类模型对告警事件A进行识别，若有m1棵决策树判定告警事件A为根因且m1>m/2，随机森林分类模型的输出为此告警事件A是根因告警事件，随机森林决策树示意图如图6所示。
具体的，所述随机森林算法为：1)假定训练集样本总数为N，总特征为F；2)从训练集通过有放回的随机重采样方式产生n个样本，形成单次的训练集；3)对单次训练集，从F个特征中选取其中的k个特征，用建立决策树的方式获得最佳分割点，生成1颗CART决策树；4)重复m次步骤2)和步骤3)，产生m棵决策树，其中，m是由外部配置输入；5)将m棵决策树合并即构成随机森林的模型。
其中，每一棵CART决策树的训练过程如下：1)设结点的训练数据集为D，CART决策树是一个2叉树，训练CART决策树的过程就是将数据集D不断切分为2个分支，直到满足算法停止条件。切分点的选择通过计算Gini指数得出；2)设定停止条件：结点中的样本个数小于预定阈值，或样本集的基尼指数小于预定阈值，或没有更多特征；3)对于某特征fi，fi∈F，记fi所有的可能取值为A，a是其中的某个具体值。则可将数据集分为A＝a，和A！＝a两个子集D1和D2，计算集合D的基尼指数：
Figure PCTCN2019091207-appb-000002
4)遍历特征fi的所有取值，找出Gini指数最大的值为此特征对应的切分点；5)遍历所有的特征，找出Gini指数最大的特征，作为分裂特征。至此可以将数据集D划分为两个子集，也即完成了针对某个具体特征的最佳分割点的选择；6)对上述两个子节点递归调用步骤3)、4)、5)，直到满足停止条件；7)生成CART决策树，将生成m棵CART决策树保存即得了离线训练后的分类模型。
步骤S505、识别出根因告警事件后，进行派单，运维人员对识别出的根因告警事件进行校正并增加反馈标记。若分类模型判断正确则标记为1，若分类模型判断错误，则标记为0，将标记后的数值增加到表2的特征向量矩阵中，生成表3，表3中第一列即为反馈标记，生成的表3更新到数据库中，作为分类模型的训练告警事件集合。
表3
label f0 f11 f12 f13 f14 f21 f22 f31 f32 f33 f4 f5 f6 f71 f72
1 5 0 0 0 1 0 1 0 0 1 0 0.29 1 0 1
0 3 0 0 1 0 0 1 0 1 0 0.25 0.71 0 0 1
0 4 0 0 1 0 0 1 1 0 0 0.25 0.71 0 0 1
0 3 0 0 1 0 0 1 0 1 0 0.25 0.71 0 0 1
0 3 0 0 1 0 0 1 0 1 0 0.25 0.71 0 0 1
1 5 0 0 0 1 0 1 0 0 1 0 0.29 1 0 1
0 3 0 0 1 0 0 1 0 1 0 0.25 0.71 0 0 1
1 5 0 1 0 0 1 0 0 0 1 0 0.5 0 1 0
0 5 1 0 0 0 0 1 0 1 0 0 0.5 0 1 0
1 5 0 1 0 0 1 0 0 0 1 0.1 0.5 0 1 0
0 5 1 0 0 0 0 1 0 1 0 0.1 0.5 0 1 0
1 5 0 1 0 0 1 0 0 0 1 1 0.5 0 1 0
0 5 1 0 0 0 0 1 0 1 0 1 0.5 0 1 0
本申请实施例中，分类模型是根据至少一个训练告警事件集合，按照预设分类算法训练确定的，其中，所述至少一个训练告警事件集合中的每条训练告警事件的信息包括标签和特征向量，即表3所示的内容，所述标签用于表征所述每条训练告警事件是否为根因告警事件。
本申请实施例中，训练分类模型时训练数据的获取只需普通的运维人员在日常工作中简单判断故障根因分析装置识别的根因告警事件是否正确即可，无需专家投入，降低了人力投入，并且具有通用性，无需针对不同的产品，组网重新设计开发，避免了重复投入的问题。结合不同的数据，提取多维度特征，保证了算法的准确度；并且通过不断的学习，得到新的模型，识别准确度还会逐渐提高。
基于与方法实施例同样的发明构思，本申请还提供了一种装置示意图，如图7所示，所述装置包括：获取单元701，用于获取第一告警事件集合，所述第一告警事件集合包括多个告警事件；处理单元702，用于对于所述第一告警事件集合中的第一告警事件，提取所述第一告警事件的特征向量，其中，所述特征向量中的部分或全部特征用于表征所述第一告警事件和所述第一告警事件集合中其它告警事件之间的关系；所述处理单元702，还用于根据所述第一告警事件的特征向量，确定所述第一告警事件是否为根因告警事件。
在一种可能的实现方式中，所述处理单元具体用于：将所述第一告警事件的特征向量输入到预先设置的分类模型中，以确定所述第一告警事件是否为根因告警事件，其中，所述分类模型用于表征特征向量和根因告警事件之间的关系。
在一种可能的实现方式中，所述获取单元具体用于：将多个告警事件聚合为至少一个告警事件集合，将所述至少一个告警事件集合中的一个告警事件集合作为所述第一告警事件集合。
可选的，所述获取单元具体用于：将多个告警事件按照设定规则聚合为至少一个告警集合，其中，所述设定规则包括时间关联度、拓扑关联度、文本相似度中的至少一个。
示例性的，所述特征向量包括告警严重等级、告警名称、事件类型中的至少一个、以及关联属性、时序关系、数量关系、资源关系中的至少一个，其中，所述关联属性用于表征所述第一告警事件在所属的第一告警事件集合中与其他告警事件的关联关系，所述数量关系用于表征所述第一告警事件集合中包括第一告警事件在内的与第一告警事件相同的所有告警事件的个数的总和占第一告警事件集合中全部告警事件数量的比值，所述资源关系用于表征所述第一告警事件集合中第一告警事件与其它告警事件间的传播关系。
可选的，所述特征向量还包括告警上下文，其中，所述告警上下文用于表征所述第一告警事件所属的第一告警事件集合对应的故障类型。
在一种可能的实现方式中，所述分类模型是根据至少一个训练告警事件集合，按照预设分类算法训练确定的，其中，所述至少一个训练告警事件集合中的每条训练告警事件的信息包括标签和特征向量，所述标签用于表征所述每条训练告警事件是否为根因告警事件；
对于所述训练告警事件集合中的任一训练告警事件，所述训练告警事件的关联属性用于表征所述训练告警事件在所述训练告警事件集合中与其他告警事件的关联关系，所述数量关系用于表征所述训练告警事件集合中包括所述训练告警事件在内的与所述训练告警事件相同的所有训练告警事件的个数的总和占所述训练告警事件集合中全部训练告警事件数量的比值，所述资源关系用于表征所述训练告警事件集合中所述训练告警事件与其它告警事件间的传播关系。
可选的，所述训练告警事件集合中的每条训练告警事件的特征向量包括告警严重等级、告警名称、事件类型中的至少一个、以及关联属性、时序关系、数量关系、资源关系中的 至少一个。
可选的，至少一个训练告警事件集合为多个训练告警事件集合，所述多个训练告警事件集合中的每个训练告警事件集合中的每条训练告警事件的特征向量还包括告警上下文，其中，所述每条训练告警事件的告警上下文用于表征所述每条训练告警事件所在的训练告警事件集合对应的故障类型。
在一种可能的实现方式中，确定所述第一告警事件是否为根因告警事件之后，所述获取单元还用于：接收到经过所述分类模型判断并人工矫正后的所述第一告警事件集合中每条告警事件的标签，以及所述每条告警事件的特征向量，将所述标签以及所述每条告警事件的特征向量保存到用于训练所述分类模型的数据库中，其中，所述标签用于表征所述每条告警事件是否为根因告警事件。
可选的，若所述预设分类算法为随机森林，则所述处理单元具体用于：对于所述第一告警事件，若判断为根因告警的决策树与全部决策树的比值大于或等于设定阈值，则确定为根因告警，若判断为根因告警的决策树与全部决策树的比值小于所述设定阈值，则确定为非根因告警。
本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，另外，在本申请各个实施例中的各功能模块可以集成在一个处理器中，也可以是单独物理存在，也可以两个或两个以上模块集成在一个模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。
其中，集成的模块既可以采用硬件的形式实现时，如图8所示，一种装置可以包括处理器802。上述处理单元702对应的实体的硬件可以为处理器802。处理器802，可以是一个中央处理模块(英文：central processing unit，简称CPU)，或者为数字处理模块等等。所述设备还可以包括通信接口801(可以为收发器)，上述获取单元701对应的硬件实体可以为通信接口801。该设备还可以包括：存储器803，用于存储处理器802执行的程序。存储器803可以是非易失性存储器，比如硬盘(英文：hard disk drive，缩写：HDD)或固态硬盘(英文：solid-state drive，缩写：SSD)等，还可以是易失性存储器(英文：volatile memory)，例如随机存取存储器(英文：random-access memory，缩写：RAM)。存储器803是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。
处理器802用于执行存储器803存储的程序代码，具体用于执行图4、图5所示实施例所述的方法。可以参见图4、图5所示实施例所述的方法，本申请在此不再赘述。
本申请实施例中不限定上述通信接口801、处理器802以及存储器803之间的具体连接介质。本申请实施例在图8中以存储器803、处理器802以及通信接口801之间通过总线804连接，总线在图8中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图8中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
本发明实施例还提供了一种计算机可读存储介质，用于存储为执行上述处理器所需执行的计算机软件指令，其包含用于执行上述处理器所需执行的程序。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实 施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请中，“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A,B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。
本申请中，“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，“a,b,或c中的至少一项(个)”，或，“a,b,和c中的至少一项(个)”，均可以表示：a,b,c,a-b(即a和b),a-c,b-c,或a-b-c，其中a,b,c分别可以是单个，也可以是多个。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，部分或全部步骤可以并行执行或先后执行，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
本申请是参照根据本申请的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (24)

  1. 一种故障根因分析的方法，其特征在于，所述方法包括：
    获取第一告警事件集合，所述第一告警事件集合包括多个告警事件；
    对于所述第一告警事件集合中的第一告警事件，提取所述第一告警事件的特征向量，其中，所述特征向量中的部分或全部特征用于表征所述第一告警事件和所述第一告警事件集合中其它告警事件之间的关系；
    根据所述第一告警事件的特征向量，确定所述第一告警事件是否为根因告警事件。
  2. 如权利要求1所述的方法，其特征在于，根据所述第一告警事件的特征向量确定所述第一告警事件是否为根因告警事件，具体包括：
    将所述第一告警事件的特征向量输入到预先设置的分类模型中，以确定所述第一告警事件是否为根因告警事件，其中，所述分类模型用于表征特征向量和根因告警事件之间的关系。
  3. 如权利要求1或2所述的方法，其特征在于，所述获取第一告警事件集合，具体包括：
    将多个告警事件聚合为至少一个告警事件集合，将所述至少一个告警事件集合中的一个告警事件集合作为所述第一告警事件集合。
  4. 如权利要求3所述的方法，其特征在于，所述将多个告警事件聚合为至少一个告警事件集合，具体包括：
    将多个告警事件按照设定规则聚合为至少一个告警集合，其中，所述设定规则包括时间关联度、拓扑关联度、文本相似度中的至少一个，其中，所述时间关联度用于表征各告警事件在时间上的关联关系，拓扑关联度用于表征各告警事件在物理位置上的关联关系，文本相似度用于表征各告警事件用字符串表示时，字符串的相似程度。
  5. 如权利要求1-4所述的方法，其特征在于，所述特征向量包括告警严重等级、告警名称、事件类型中的至少一个、以及关联属性、时序关系、数量关系、资源关系中的至少一个，其中，所述关联属性用于表征所述第一告警事件在所属的第一告警事件集合中与其他告警事件的关联关系，所述数量关系用于表征所述第一告警事件集合中包括第一告警事件在内的与第一告警事件相同的所有告警事件的个数的总和占第一告警事件集合中全部告警事件数量的比值，所述资源关系用于表征所述第一告警事件集合中第一告警事件与其它告警事件间的传播关系。
  6. 如权利要求5所述的方法，其特征在于，所述特征向量还包括告警上下文，其中，所述告警上下文用于表征所述第一告警事件集合对应的故障类型。
  7. 如权利要求2所述的方法，其特征在于，所述分类模型是根据至少一个训练告警事件集合，按照预设分类算法训练确定的，其中，所述至少一个训练告警事件集合中的每条训练告警事件的信息包括标签和特征向量，所述标签用于表征所述每条训练告警事件是否为根因告警事件；
    对于所述训练告警事件集合中的任一训练告警事件，所述训练告警事件的关联属性用于表征所述训练告警事件在所述训练告警事件集合中与其他告警事件的关联关系，所述数量关系用于表征所述训练告警事件集合中包括所述训练告警事件在内的与所述训练告警事件相同的所有训练告警事件的个数的总和占所述训练告警事件集合中全部训练告警事件数 量的比值，所述资源关系用于表征所述训练告警事件集合中所述训练告警事件与其它告警事件间的传播关系。
  8. 如权利要求7所述的方法，其特征在于，所述训练告警事件集合中的每条训练告警事件的特征向量包括告警严重等级、告警名称、事件类型中的至少一个、以及关联属性、时序关系、数量关系、资源关系中的至少一个。
  9. 如权利要求8所述的方法，其特征在于，至少一个训练告警事件集合为多个训练告警事件集合，所述多个训练告警事件集合中的每个训练告警事件集合中的每条训练告警事件的特征向量还包括告警上下文，其中，所述每条训练告警事件的告警上下文用于表征所述每条训练告警事件所在的训练告警事件集合对应的故障类型。
  10. 如权利要求7所述的方法，其特征在于，确定所述第一告警事件是否为根因告警事件之后，该方法还包括：
    接收到经过所述分类模型判断并人工矫正后的所述第一告警事件集合中每条告警事件的标签，以及所述每条告警事件的特征向量，将所述标签以及所述每条告警事件的特征向量保存到用于训练所述分类模型的数据库中，其中，所述标签用于表征所述每条告警事件是否为根因告警事件。
  11. 如权利要求7所述的方法，其特征在于，若所述预设分类算法为随机森林，则所述确定所述第一告警事件是否为根因告警，具体包括：
    对于所述第一告警事件，若判断为根因告警的决策树与全部决策树的比值大于或等于设定阈值，则确定为根因告警，若判断为根因告警的决策树与全部决策树的比值小于所述设定阈值，则确定为非根因告警。
  12. 一种装置，其特征在于，所述装置包括：
    获取单元，用于获取第一告警事件集合，所述第一告警事件集合包括多个告警事件；
    处理单元，用于对于所述第一告警事件集合中的第一告警事件，提取所述第一告警事件的特征向量，其中，所述特征向量中的部分或全部特征用于表征所述第一告警事件和所述第一告警事件集合中其它告警事件之间的关系；
    所述处理单元，还用于根据所述第一告警事件的特征向量，确定所述第一告警事件是否为根因告警事件。
  13. 如权利要求12所述的装置，其特征在于，所述处理单元具体用于：
    将所述第一告警事件的特征向量输入到预先设置的分类模型中，以确定所述第一告警事件是否为根因告警事件，其中，所述分类模型用于表征特征向量和根因告警事件之间的关系。
  14. 如权利要求12或13所述的装置，其特征在于，所述获取单元具体用于：
    将多个告警事件聚合为至少一个告警事件集合，将所述至少一个告警事件集合中的一个告警事件集合作为所述第一告警事件集合。
  15. 如权利要求14所述的装置，其特征在于，所述获取单元具体用于：
    将多个告警事件按照设定规则聚合为至少一个告警集合，其中，所述设定规则包括时间关联度、拓扑关联度、文本相似度中的至少一个，其中，所述时间关联度用于表征各告警事件在时间上的关联关系，拓扑关联度用于表征各告警事件在物理位置上的关联关系，文本相似度用于表征各告警事件用字符串表示时，字符串的相似程度。
  16. 如权利要求12-15所述的装置，其特征在于，所述特征向量包括告警严重等级、告警名称、事件类型中的至少一个、以及关联属性、时序关系、数量关系、资源关系中的至少一个，其中，所述关联属性用于表征所述第一告警事件在所属的第一告警事件集合中与其他告警事件的关联关系，所述数量关系用于表征所述第一告警事件集合中包括第一告警事件在内的与第一告警事件相同的所有告警事件的个数的总和占第一告警事件集合中全部告警事件数量的比值，所述资源关系用于表征所述第一告警事件集合中第一告警事件与其它告警事件间的传播关系。
  17. 如权利要求16所述的装置，其特征在于，所述特征向量还包括告警上下文，其中，所述告警上下文用于表征所述第一告警事件所属的第一告警事件集合对应的故障类型。
  18. 如权利要求13所述的装置，其特征在于，所述分类模型是根据至少一个训练告警事件集合，按照预设分类算法训练确定的，其中，所述至少一个训练告警事件集合中的每条训练告警事件的信息包括标签和特征向量，所述标签用于表征所述每条训练告警事件是否为根因告警事件；
    对于所述训练告警事件集合中的任一训练告警事件，所述训练告警事件的关联属性用于表征所述训练告警事件在所述训练告警事件集合中与其他告警事件的关联关系，所述数量关系用于表征所述训练告警事件集合中包括所述训练告警事件在内的与所述训练告警事件相同的所有训练告警事件的个数的总和占所述训练告警事件集合中全部训练告警事件数量的比值，所述资源关系用于表征所述训练告警事件集合中所述训练告警事件与其它告警事件间的传播关系。
  19. 如权利要求18所述的装置，其特征在于，所述训练告警事件集合中的每条训练告警事件的特征向量包括告警严重等级、告警名称、事件类型中的至少一个、以及关联属性、时序关系、数量关系、资源关系中的至少一个。
  20. 如权利要求19所述的装置，其特征在于，至少一个训练告警事件集合为多个训练告警事件集合，所述多个训练告警事件集合中的每个训练告警事件集合中的每条训练告警事件的特征向量还包括告警上下文，其中，所述每条训练告警事件的告警上下文用于表征所述每条训练告警事件所在的训练告警事件集合对应的故障类型。
  21. 如权利要求18所述的装置，其特征在于，确定所述第一告警事件是否为根因告警事件之后，所述获取单元还用于：
    接收到经过所述分类模型判断并人工矫正后的所述第一告警事件集合中每条告警事件的标签，以及所述每条告警事件的特征向量，将所述标签以及所述每条告警事件的特征向量保存到用于训练所述分类模型的数据库中，其中，所述标签用于表征所述每条告警事件是否为根因告警事件。
  22. 如权利要求18所述的装置，其特征在于，若所述预设分类算法为随机森林，则所述处理单元具体用于：
    对于所述第一告警事件，若判断为根因告警的决策树与全部决策树的比值大于或等于设定阈值，则确定为根因告警，若判断为根因告警的决策树与全部决策树的比值小于所述设定阈值，则确定为非根因告警。
  23. 一种装置，其特征在于，包括处理器、存储器和通信接口；
    所述存储器，存储有计算机程序；
    所述处理器，用于调用并执行所述存储器中存储的计算机程序，通过所述通信接口来实现如权利要求1至中11任一项所述的方法。
  24. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机指令，当所述指令在计算机上运行时，使得计算机执行如权利要求1至11任一项所述的方法。
PCT/CN2019/091207 2018-06-15 2019-06-14 一种故障根因分析的方法及装置 Ceased WO2019238109A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP19819128.0A EP3796176B1 (en) 2018-06-15 2019-06-14 Fault root cause analysis method and apparatus
US17/120,605 US11438212B2 (en) 2018-06-15 2020-12-14 Fault root cause analysis method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810623804.5 2018-06-15
CN201810623804.5A CN110609759B (zh) 2018-06-15 2018-06-15 一种故障根因分析的方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/120,605 Continuation US11438212B2 (en) 2018-06-15 2020-12-14 Fault root cause analysis method and apparatus

Publications (1)

Publication Number Publication Date
WO2019238109A1 true WO2019238109A1 (zh) 2019-12-19

Family

ID=68841904

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/091207 Ceased WO2019238109A1 (zh) 2018-06-15 2019-06-14 一种故障根因分析的方法及装置

Country Status (4)

Country Link
US (1) US11438212B2 (zh)
EP (1) EP3796176B1 (zh)
CN (2) CN113946461A (zh)
WO (1) WO2019238109A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115174355A (zh) * 2022-07-26 2022-10-11 杭州东方通信软件技术有限公司 故障根因定位模型的生成方法，故障根因定位方法和装置
DE102021109228B4 (de) 2020-07-24 2024-08-22 Hewlett Packard Enterprise Development Lp Verfahren und system zur ursachenanalyse von netzwerkproblemen
CN122027440A (zh) * 2026-04-13 2026-05-12 成都信息工程大学 基于网络拓扑的机房故障节点识别方法及系统

Families Citing this family (49)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10721142B1 (en) * 2018-03-08 2020-07-21 Palantir Technologies Inc. Computer network troubleshooting
WO2020261621A1 (ja) * 2019-06-27 2020-12-30 日本電気株式会社 監視システム、監視方法及びプログラム
CN113328872B (zh) * 2020-02-29 2023-03-28 华为技术有限公司 故障修复方法、装置和存储介质
CN113360350B (zh) * 2020-03-03 2024-06-18 中国移动通信集团贵州有限公司 定位网络设备根因告警的方法、装置、设备和存储介质
CN113497716B (zh) * 2020-03-18 2023-03-10 华为技术有限公司 相似故障推荐方法及相关设备
CN111541559A (zh) * 2020-03-23 2020-08-14 广东工业大学 一种基于因果规则的故障定位方法
CN111488088B (zh) * 2020-04-07 2022-05-06 Oppo广东移动通信有限公司 设备状态标识方法、装置及智能终端
CN113839802B (zh) * 2020-06-24 2024-11-22 中兴通讯股份有限公司 树模型构建方法、装置、设备和存储介质
CN112003718B (zh) * 2020-09-25 2021-07-27 南京邮电大学 一种基于深度学习的网络告警定位方法
CN111858123B (zh) * 2020-07-29 2023-09-26 中国工商银行股份有限公司 基于有向图网络的故障根因分析方法和装置
US11314575B2 (en) * 2020-08-03 2022-04-26 International Business Machines Corporation Computing system event error corrective action recommendation
CN114221851B (zh) * 2020-09-04 2022-12-27 华为技术有限公司 一种故障分析方法及装置
CN114285730A (zh) * 2020-09-18 2022-04-05 华为技术有限公司 确定故障根因的方法，装置以及相关设备
CN112052151B (zh) * 2020-10-09 2022-02-18 腾讯科技（深圳）有限公司 故障根因分析方法、装置、设备及存储介质
CN114430360B (zh) * 2020-10-14 2024-03-12 中国移动通信集团山东有限公司 一种互联网安全监控方法、电子设备和存储介质
CN112507720B (zh) * 2020-11-12 2024-08-20 西安交通大学 基于因果语义关系传递的图卷积网络根因识别方法
CN112583644B (zh) * 2020-12-14 2022-10-18 华为技术有限公司 告警处理方法、装置、设备及可读存储介质
CN114691447A (zh) * 2020-12-30 2022-07-01 超聚变数字技术有限公司 一种设备的状态分析方法和分析装置
CN112822052B (zh) * 2021-01-08 2022-03-29 河海大学 一种基于网络拓扑和告警的网络故障根因定位方法
CN112799929B (zh) * 2021-01-29 2024-06-28 中国工商银行股份有限公司 报警日志的根因分析方法及系统
CN112988522A (zh) * 2021-03-08 2021-06-18 北京明略软件系统有限公司 用于告警信号关联的方法、装置及设备
EP4068693B1 (en) * 2021-03-30 2025-10-22 Nokia Solutions and Networks Oy Methods and devices for network monitoring
CN113268370B (zh) * 2021-05-11 2023-05-23 西安交通大学 一种根因告警分析方法、系统、设备及存储介质
CN113821418B (zh) * 2021-06-24 2024-05-14 腾讯科技（深圳）有限公司 故障根因分析方法及装置、存储介质和电子设备
CN115622863B (zh) * 2021-07-12 2026-08-04 中国移动通信集团浙江有限公司 基于指令通道的语音专线告警定界方法及装置
CN113598969A (zh) * 2021-08-18 2021-11-05 云南力衡医疗技术有限公司 一种治疗仪使用后维护处理系统和方法
CN113434193B (zh) * 2021-08-26 2021-12-07 北京必示科技有限公司 根因变更的定位方法和装置
CN115733724B (zh) * 2021-08-27 2024-11-15 中移动信息技术有限公司 业务故障根因定位方法、装置、电子设备及存储介质
CN113542039A (zh) * 2021-09-16 2021-10-22 浩鲸云计算科技股份有限公司 一种通过ai算法定位5g网络虚拟化跨层问题的方法
CN113961441B (zh) * 2021-10-29 2025-03-25 中国工商银行股份有限公司 告警事件处理方法、审计方法、装置、设备、介质和产品
CN116212172A (zh) * 2021-12-02 2023-06-06 深圳迈瑞生物医疗电子股份有限公司 医疗通气设备及其报警方法
MX2024008033A (es) * 2021-12-30 2024-07-15 Assurant Inc Aparatos, metodos implementados por computadora y productos de programas de computadora para mejorar la seleccion y provision de objetos de datos de soporte operativo.
CN114358312B (zh) * 2021-12-31 2025-07-29 中国联合网络通信集团有限公司 网络告警事件识别模型的训练方法、设备及存储介质
CN114090326B (zh) * 2022-01-14 2022-06-03 云智慧（北京）科技有限公司 一种告警的根因确定方法、装置及设备
CN114598588B (zh) * 2022-03-14 2023-07-25 阿里巴巴（中国）有限公司 服务器故障确定方法、装置及终端设备
CN114826685B (zh) * 2022-03-30 2024-10-18 深信服科技股份有限公司 一种信息分析方法、设备和计算机可读存储介质
CN117290133B (zh) * 2022-06-16 2025-10-21 中兴通讯股份有限公司 异常事件处理方法、电子设备及存储介质
CN115296849B (zh) * 2022-07-05 2024-03-19 中国电信股份有限公司 关联告警方法及系统、存储介质和电子设备
CN115373982B (zh) * 2022-08-09 2025-07-29 中国平安人寿保险股份有限公司 基于人工智能的测试报告分析方法、装置、设备及介质
GB2621851A (en) * 2022-08-24 2024-02-28 Vodafone Group Services Ltd Computer implemented methods, systems and program instructions for detecting anomalies in a core network of a telecommunications network
CN115396287B (zh) * 2022-08-29 2023-05-12 武汉烽火技术服务有限公司 一种故障分析方法和装置
CN115802395A (zh) * 2022-10-31 2023-03-14 中国电信股份有限公司 告警生成方法、装置、电子设备及存储介质
CN116260709B (zh) * 2022-12-12 2025-12-02 浪潮通信信息系统有限公司 一种基于故障传播关系的通信网络故障定位方法及系统
CN115766402B (zh) * 2023-01-09 2023-04-28 苏州浪潮智能科技有限公司 服务器故障根因的过滤方法和装置、存储介质及电子装置
CN116361147A (zh) * 2023-02-03 2023-06-30 广州华多网络科技有限公司 测试用例根因定位方法及其装置、设备、介质、产品
CN118034972B (zh) * 2024-01-03 2026-03-24 中国人寿保险股份有限公司 基于多维度数据分析的智能拨测告警方法和装置
US20250233792A1 (en) * 2024-01-12 2025-07-17 Jpmorgan Chase Bank, N.A. Systems and methods for determining causal relationships among network alarms
EP4727077A1 (en) * 2024-10-14 2026-04-15 Deutsche Telekom AG Methods, computer programs, and apparatuses for labelling and for supporting labelling of alarms of a telecommunication system and for training machine learning models
CN119996238B (zh) * 2025-04-11 2025-06-20 江阴长仪集团有限公司 基于数据分析的电能表通信模块状态检测方法及系统

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101707537A (zh) * 2009-11-18 2010-05-12 华为技术有限公司 故障链路定位方法、告警根因分析方法及设备、系统
CN103746831A (zh) * 2013-12-24 2014-04-23 华为技术有限公司 一种告警分析的方法、装置及系统
CN107171819A (zh) * 2016-03-07 2017-09-15 北京华为数字技术有限公司 一种网络故障诊断方法及装置

Family Cites Families (45)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102136949A (zh) * 2011-03-24 2011-07-27 国网电力科学研究院 一种基于网络和时间的告警相关性分析方法及系统
US10579928B2 (en) * 2012-09-17 2020-03-03 Siemens Aktiengesellschaft Log-based predictive maintenance using multiple-instance learning
US10914608B2 (en) * 2012-10-12 2021-02-09 Nec Corporation Data analytic engine towards the self-management of complex physical systems
CN103346912B (zh) * 2013-06-29 2017-04-12 华为技术有限公司 告警相关性分析的方法、装置及系统
JP6152788B2 (ja) * 2013-12-02 2017-06-28 富士通株式会社 障害予兆検知方法、情報処理装置およびプログラム
US10209956B2 (en) * 2014-10-09 2019-02-19 Splunk Inc. Automatic event group actions
US10979304B2 (en) * 2015-01-27 2021-04-13 Moogsoft Inc. Agent technology system with monitoring policy
US10873508B2 (en) * 2015-01-27 2020-12-22 Moogsoft Inc. Modularity and similarity graphics system with monitoring policy
US10536357B2 (en) * 2015-06-05 2020-01-14 Cisco Technology, Inc. Late data detection in data center
WO2017008197A1 (zh) * 2015-07-10 2017-01-19 华为技术有限公司 告警信息上报方法及装置
US9729571B1 (en) * 2015-07-31 2017-08-08 Amdocs Software Systems Limited System, method, and computer program for detecting and measuring changes in network behavior of communication networks utilizing real-time clustering algorithms
US10284453B2 (en) * 2015-09-08 2019-05-07 Uber Technologies, Inc. System event analyzer and outlier visualization
US10193780B2 (en) * 2015-10-09 2019-01-29 Futurewei Technologies, Inc. System and method for anomaly root cause analysis
US10685043B2 (en) * 2015-11-10 2020-06-16 International Business Machines Corporation Event analysis in network management event streams
US11049004B1 (en) * 2015-11-15 2021-06-29 ThetaRay Ltd. System and method for anomaly detection in dynamically evolving data using random neural network decomposition
US10171288B2 (en) * 2015-12-18 2019-01-01 International Business Machines Corporation Diagnosing faults in stateless distributed computing platforms
US10135701B2 (en) * 2016-02-19 2018-11-20 At&T Intellectual Property I, L.P. Context-aware virtualized control decision support system for providing quality of experience assurance for internet protocol streaming video services
US10055481B2 (en) * 2016-07-20 2018-08-21 LogsHero Ltd. Method and system for automatic event classification
CN107770797A (zh) * 2016-08-17 2018-03-06 中国移动通信集团内蒙古有限公司 一种无线网络告警管理的关联分析方法及系统
CN109716730B (zh) * 2016-09-09 2021-10-22 微软技术许可有限责任公司 用于生产应用的自动化性能调试的方法和计算设备
EP3497527B1 (en) * 2016-09-16 2022-06-22 Siemens Aktiengesellschaft Generation of failure models for embedded analytics and diagnostics
US10372120B2 (en) * 2016-10-06 2019-08-06 General Electric Company Multi-layer anomaly detection framework
US10237294B1 (en) * 2017-01-30 2019-03-19 Splunk Inc. Fingerprinting entities based on activity in an information technology environment
EP3379356A1 (en) * 2017-03-23 2018-09-26 ASML Netherlands B.V. Method of modelling lithographic systems for performing predictive maintenance
US10831585B2 (en) * 2017-03-28 2020-11-10 Xiaohui Gu System and method for online unsupervised event pattern extraction and holistic root cause analysis for distributed systems
US10417079B2 (en) * 2017-03-30 2019-09-17 Ca, Inc. Fault tolerant root cause analysis system
CN106941423B (zh) * 2017-04-13 2018-06-05 腾讯科技（深圳）有限公司 故障原因定位方法及装置
US11176464B1 (en) * 2017-04-25 2021-11-16 EMC IP Holding Company LLC Machine learning-based recommendation system for root cause analysis of service issues
US10917419B2 (en) * 2017-05-05 2021-02-09 Servicenow, Inc. Systems and methods for anomaly detection
US10467083B2 (en) * 2017-06-08 2019-11-05 International Business Machines Corporation Event relationship analysis in fault management
WO2019022737A1 (en) * 2017-07-26 2019-01-31 Hitachi, Ltd. MAINTENANCE RECOMMENDATION SYSTEM BASED ON FAILURE PREDICTION
US10635565B2 (en) * 2017-10-04 2020-04-28 Servicenow, Inc. Systems and methods for robust anomaly detection
US10523495B2 (en) * 2017-11-27 2019-12-31 Abb Schweiz Ag Industrial plant alarm management
US11392826B2 (en) * 2017-12-27 2022-07-19 Cisco Technology, Inc. Neural network-assisted computer network management
CN108156037B (zh) * 2017-12-29 2020-12-15 中国移动通信集团江苏有限公司 告警关联分析方法、装置、设备及介质
US10785237B2 (en) * 2018-01-19 2020-09-22 General Electric Company Learning method and system for separating independent and dependent attacks
US10771313B2 (en) * 2018-01-29 2020-09-08 Cisco Technology, Inc. Using random forests to generate rules for causation analysis of network anomalies
US10742482B2 (en) * 2018-02-26 2020-08-11 Hewlett Packard Enterprise Development Lp Clustering event records representing anomalous events
US10721142B1 (en) * 2018-03-08 2020-07-21 Palantir Technologies Inc. Computer network troubleshooting
US10938845B2 (en) * 2018-05-10 2021-03-02 International Business Machines Corporation Detection of user behavior deviation from defined user groups
US10742483B2 (en) * 2018-05-16 2020-08-11 At&T Intellectual Property I, L.P. Network fault originator identification for virtual network infrastructure
US11455493B2 (en) * 2018-05-16 2022-09-27 International Business Machines Corporation Explanations for artificial intelligence based recommendations
US10785090B2 (en) * 2018-05-18 2020-09-22 Cisco Technology, Inc. Using machine learning based on cross-signal correlation for root cause analysis in a network assurance service
US10721256B2 (en) * 2018-05-21 2020-07-21 Oracle International Corporation Anomaly detection based on events composed through unsupervised clustering of log messages
US10778566B2 (en) * 2018-05-24 2020-09-15 Cisco Technology, Inc. Pattern discovery from high dimensional telemetry data using machine learning in a network assurance service

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101707537A (zh) * 2009-11-18 2010-05-12 华为技术有限公司 故障链路定位方法、告警根因分析方法及设备、系统
CN103746831A (zh) * 2013-12-24 2014-04-23 华为技术有限公司 一种告警分析的方法、装置及系统
CN107171819A (zh) * 2016-03-07 2017-09-15 北京华为数字技术有限公司 一种网络故障诊断方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3796176A4 *

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE102021109228B4 (de) 2020-07-24 2024-08-22 Hewlett Packard Enterprise Development Lp Verfahren und system zur ursachenanalyse von netzwerkproblemen
CN115174355A (zh) * 2022-07-26 2022-10-11 杭州东方通信软件技术有限公司 故障根因定位模型的生成方法，故障根因定位方法和装置
CN115174355B (zh) * 2022-07-26 2024-01-19 杭州东方通信软件技术有限公司 故障根因定位模型的生成方法，故障根因定位方法和装置
CN122027440A (zh) * 2026-04-13 2026-05-12 成都信息工程大学 基于网络拓扑的机房故障节点识别方法及系统

Also Published As

Publication number Publication date
US11438212B2 (en) 2022-09-06
US20210099336A1 (en) 2021-04-01
EP3796176B1 (en) 2023-07-26
CN113946461A (zh) 2022-01-18
CN110609759A (zh) 2019-12-24
EP3796176A4 (en) 2021-08-04
CN110609759B (zh) 2021-09-14
EP3796176A1 (en) 2021-03-24

Similar Documents

Publication Publication Date Title
CN110609759B (zh) 一种故障根因分析的方法及装置
CN112003718B (zh) 一种基于深度学习的网络告警定位方法
US10713597B2 (en) Systems and methods for preparing data for use by machine learning algorithms
CN111754345B (zh) 一种基于改进随机森林的比特币地址分类方法
CN114511905B (zh) 一种基于图卷积神经网络的人脸聚类方法
CN110458187B (zh) 一种恶意代码家族聚类方法和系统
CN102693317B (zh) 数据挖掘流程生成方法及装置
CN113824575B (zh) 故障节点识别的方法、装置、计算设备及计算机存储介质
CN105978711B (zh) 一种基于最小生成树的最佳交换边查找方法
CN116415206A (zh) 运营商多数据融合方法、系统、电子设备及计算机存储介质
CN101494557A (zh) 用于自动识别最优属性组的方法和系统
CN114297347A (zh) 行业类别的确定方法、装置、存储介质和电子设备
CN113806180B (zh) 一种无监督智能降噪处理方法
CN117389908B (zh) 接口自动化测试用例的依赖关系分析方法、系统及介质
CN116542634A (zh) 工单处理方法、装置和计算机可读存储介质
CN116910670A (zh) 工单处理措施推荐模型的训练方法、推荐方法及相关装置
CN113064597B (zh) 一种冗余代码的识别方法、装置和设备
CN106778252A (zh) 基于粗糙集理论与waode算法的入侵检测方法
CN114416423A (zh) 一种基于机器学习的根因定位方法和系统
CN109522915B (zh) 病毒文件聚类方法、装置及可读介质
CN116484805A (zh) 结合知识图谱和语义分析的电力报告智能清洗处理方法
CN109522196A (zh) 一种故障日志处理的方法及装置
CN116307736A (zh) 风险画像自动生成的方法、装置、设备及存储介质
CN107862328A (zh) 信息元集合生成方法及基于规则引擎的规则执行方法
CN108846543B (zh) 一种非重叠社区集合质量度量指标的计算方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19819128

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019819128

Country of ref document: EP

Effective date: 20210112

ENP Entry into the national phase

Ref document number: 2019819128

Country of ref document: EP

Effective date: 20210115