CN-116723090-B - Alarm root cause positioning method and device, electronic equipment and readable storage medium

CN116723090BCN 116723090 BCN116723090 BCN 116723090BCN-116723090-B

Abstract

The embodiment of the application provides a method and a device for positioning an alarm root cause, electronic equipment and a readable storage medium, and relates to the technical field of intelligent operation and maintenance in the field of communication. The method comprises the steps of obtaining each current alarm data in a current period, dividing each current alarm data into each current alarm event, generating a directed graph of each current alarm event, determining a target node from each node of the target directed graph according to at least one of the number of nodes and the weight of each directed edge in the target directed graph, taking the current alarm data corresponding to the target node as an alarm root cause of the current alarm event, and realizing quick and accurate positioning of the alarm root cause of each current alarm event, so that faults of at least one current alarm data in the current alarm event are generated based on the root cause elimination, and the fault elimination speed is improved.

Inventors

SHI YINGWEI
WANG ZHIGANG
LEI TING
WANG JIE
OUYANG YE

Assignees

亚信科技（中国）有限公司

Dates

Publication Date: 20260512
Application Date: 20230725

Claims (10)

1. The method for positioning the alarm root cause is characterized by comprising the following steps: determining at least one target network element from the network cloud in the current period, wherein the target network element is a network element for generating current alarm data; obtaining a topological graph of the network cloud, wherein the topological graph comprises nodes used for representing network elements, connection lines among the nodes are used for representing connection relations among the network elements, and the topological graph is segmented to obtain at least one target sub-topological graph, wherein the target sub-topological graph comprises at least one node used for representing the target network elements; For each target sub-topological graph, current alarm data of each target network element in the target sub-topological graph is used as a current alarm event, wherein the current alarm event comprises at least one current alarm data; For each current alarm event, generating a target directed graph corresponding to the current alarm event, and determining the weight of each directed edge in the target directed graph, wherein nodes of the target directed graph represent current alarm data in the current alarm event, and the generation of the current alarm data corresponding to the termination node is caused by the generation of the current alarm data corresponding to the start node of the directed edge, and the weight of the directed edge is used for representing the influence probability of the current alarm data represented by the start node of the directed edge on the generation of the current alarm data represented by the termination node of the directed edge; For each target directed graph, determining a target node from each node of the target directed graph according to at least one of the number of nodes in the target directed graph and the weight of each directed edge, and taking current alarm data corresponding to the target node as an alarm root cause of the current alarm event; determining target nodes from all nodes of the target directed graph according to at least one of the number of nodes in the target directed graph and the weights of all directed edges, wherein if the target directed graph is determined to comprise at least 3 nodes, determining the target importance degree of each node based on the weights of all directed edges; The determining the target importance degree of each node based on the weight of each directed edge comprises the following steps: Generating current alarm data corresponding to the number of lines of the position, and influencing the probability of generating the current alarm data corresponding to the number of columns of the position; Acquiring initial importance degree of each node in the target directed graph, and generating an initial vector matrix, wherein each row of elements in the initial vector matrix represents the initial importance degree of the corresponding node; And carrying out iterative updating on the initial vector matrix based on the weight matrix, taking the vector matrix obtained in the last iteration as a target vector matrix, and representing the target importance degree of the corresponding current alarm data by each row of elements in the target vector matrix.
2. The method of claim 1, wherein the determining a target node from each node of the target directed graph based on at least one of a number of nodes in the target directed graph and weights of each directed edge comprises: if the target directed graph is determined to comprise 1 node, the 1 node is taken as a target node; If the target directed graph comprises 2 nodes, the weights of the two directed edges between the 2 nodes are compared, and the starting node of the directed edge with the largest weight is used as the target node.
3. The method of claim 1, wherein iteratively updating the initial vector matrix based on the weight matrix comprises: in each iteration, multiplying the vector matrix of the current iteration by the weight matrix, and taking the product result as the vector matrix of the next iteration; if it is determined that the determinant value of the difference matrix between the vector matrix of the current iteration and the vector matrix of the next iteration is smaller than the preset threshold, stopping iteration.
4. The method of claim 1, wherein the determining weights for each directed edge in the target directed graph comprises: for each directed edge, determining the current alarm data represented by the starting node generating the directed edge, and supporting, confidence and lifting the current alarm data represented by the ending node generating the directed edge; Acquiring weights corresponding to the support degree, the confidence degree and the lifting degree respectively; And carrying out weighted summation on the support degree, the confidence degree and the lifting degree based on the weights corresponding to the support degree, the confidence degree and the lifting degree respectively to obtain the weight of the directed edge.
5. The method of claim 4, wherein determining the current alert data characterized by the starting node that generated the directed edge, the support, confidence, and promotion of the current alert data characterized by the ending node that generated the directed edge, comprises: The method comprises the steps of determining each historical period before the current period, and acquiring historical alarm events of each historical period, wherein the historical alarm events comprise at least two historical alarm data, and the at least two historical alarm data in each historical alarm event are different alarm data generated by different network elements in the network cloud in the same historical period; determining the occurrence times of each historical alarm data in all historical alarm events, and determining at least one target historical alarm data from the historical alarm data included in each historical alarm event based on the occurrence times of each historical alarm data; If it is determined that first target historical alarm data and second target historical alarm data exist in each target historical alarm data, the first target historical alarm data are identical to current alarm data represented by a starting node of the directed edge, and the second target historical alarm data are identical to current alarm data represented by a terminating node of the directed edge, determining the support degree, the confidence degree and the lifting degree of generating the first target historical alarm data on generating the second target historical alarm data based on each historical alarm event; and respectively taking the support, the confidence and the lifting degree of the first target historical alarm data to the second target historical alarm data as the support, the confidence and the lifting degree of the current alarm data represented by the starting node for generating the directed edge to the current alarm data represented by the ending node for generating the directed edge.
6. The method of claim 5, wherein determining at least one target historical alert data from each historical alert data included in each historical alert event, further comprising: And if the first target historical alarm data or the second target historical alarm data does not exist in each target historical alarm data, respectively taking the first preset value, the second preset value and the third preset value as the support degree, the confidence degree and the lifting degree of the current alarm data represented by the starting node for generating the directed edge to the current alarm data represented by the ending node for generating the directed edge.
7. The method of claim 1, wherein the generating the target-directed graph corresponding to the current alert event comprises: Removing other network elements except for the target network element in the target sub-topological graph corresponding to the current alarm event; And converting the target sub-topological graph from which other network elements are removed into an initial directed graph, and modifying the target network elements represented by all nodes in the initial directed graph into current alarm data corresponding to the target network elements.
8. A locating device for an alarm root cause, comprising: The current alarm data acquisition module is used for determining at least one target network element from the network cloud in the current period, wherein the target network element is a network element for generating current alarm data; The system comprises a topology graph segmentation module, a target sub-topology graph, a network cloud segmentation module and a network cloud segmentation module, wherein the topology graph is used for acquiring a topology graph of the network cloud, the topology graph comprises nodes used for representing network elements, connection lines among the nodes are used for representing connection relations among the network elements, and the topology graph is segmented to obtain at least one target sub-topology graph; The system comprises a current alarm event generation module, a current alarm event generation module and a current alarm event generation module, wherein the current alarm event generation module is used for taking current alarm data of each target network element in each target sub-topological graph as a current alarm event; The directed graph determining module is used for generating a target directed graph corresponding to each current alarm event and determining the weight of each directed edge in the target directed graph, wherein the nodes of the target directed graph represent the current alarm data in the current alarm event, the generation of the current alarm data corresponding to the starting node is caused by the generation of the current alarm data corresponding to the ending node, and the direction between the starting node and the ending node of the directed edge represents the generation of the current alarm data corresponding to the ending node; The alarm root cause positioning module is used for determining target nodes from all nodes of the target directed graph according to at least one of the number of nodes and the weights of all directed edges in each target directed graph, and taking current alarm data corresponding to the target nodes as alarm root causes of the current alarm event; the alarm root cause positioning module is further used for determining the target importance degree of each node based on the weight of each directed edge under the condition that the target directed graph comprises at least 3 nodes; The alarm root cause positioning module is also used for generating a weight matrix based on the weight of each directed edge in the target directed graph, wherein the element of each position of the weight matrix represents that the current alarm data corresponding to the number of lines of the position is generated and the probability of influencing the current alarm data corresponding to the number of columns of the position is generated; Acquiring initial importance degree of each node in the target directed graph, and generating an initial vector matrix, wherein each row of elements in the initial vector matrix represents the initial importance degree of the corresponding node; And carrying out iterative updating on the initial vector matrix based on the weight matrix, taking the vector matrix obtained in the last iteration as a target vector matrix, and representing the target importance degree of the corresponding current alarm data by each row of elements in the target vector matrix.
9. An electronic device comprising a memory, a processor and a computer program stored on the memory, characterized in that the processor executes the computer program to carry out the steps of the method according to any one of claims 1-7.
10. A computer readable storage medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor, implements the steps of the method according to any of claims 1-7.

Description

Alarm root cause positioning method and device, electronic equipment and readable storage medium Technical Field The application relates to the technical field of intelligent operation and maintenance in the field of communication, in particular to a method and a device for positioning an alarm root cause, electronic equipment and a readable storage medium. Background With the development of network cloud technology, more and more software systems are deployed on a cloud environment, and the high stability requirement of communication services brings three challenges to the operation and maintenance of the network cloud. Firstly, a large number of faults occur at a certain moment, operation and maintenance personnel can not see the huge amount of alarm data, time and effort are consumed, and rapid treatment of service system faults is not facilitated, secondly, a large amount of alarm data occur simultaneously, association relations among the data are complex and huge, the data are mutually interwoven, real alarm root causes are difficult to find rapidly, thirdly, under the network cloud environment, the environment is complex, alarm information is various, even the most experienced operation and maintenance personnel cannot guarantee complete grasp of all alarms, and in the face of network cloud alarms, the experience of human experts is limited. The existing scheme usually locates the root cause of the alarm by classifying the alarm data and determining the influence scoring of the alarm data, however, the methods require operation and maintenance specialists to analyze, preprocess and label the alarm data, which requires great amount of specialist experience and labor cost, and subjectivity cannot be avoided. Meanwhile, the methods cannot cope with alarm storm, cannot compress and divide alarms for a large number of alarms, and cannot effectively locate the exact alarm root cause. Disclosure of Invention The embodiment of the application provides a method, a device, electronic equipment, a computer readable storage medium and a computer program product for positioning an alarm root cause, which can solve the problems in the background technology. The technical scheme is as follows: According to a first aspect of an embodiment of the present application, there is provided a method for locating an alarm root cause, the method including: Determining at least one target network element from the network cloud in the current period, wherein the target network element is the network element generating the current alarm data; Obtaining a topological graph of a network cloud, wherein the topological graph comprises nodes used for representing network elements, the connection between the nodes is used for representing the connection relation between the network elements, and the topological graph is segmented to obtain at least one target sub-topological graph, and the target sub-topological graph comprises at least one node used for representing the target network elements; For each target sub-topological graph, current alarm data of each target network element in the target sub-topological graph is used as a current alarm event, wherein the current alarm event comprises at least one current alarm data; For each current alarm event, generating a target directed graph corresponding to the current alarm event, and determining the weight of each directed edge in the directed graph, wherein the nodes of the target directed graph represent the current alarm data in the current alarm event, and the direction between the starting node and the ending node of the directed edge represents the generation of the current alarm data corresponding to the starting node and leads to the generation of the current alarm data corresponding to the ending node; For each target directed graph, determining target nodes from all nodes of the target directed graph according to at least one of the number of nodes in the target directed graph and the weights of all directed edges, and taking current alarm data corresponding to the target nodes as an alarm root cause of a current alarm event. According to a second aspect of an embodiment of the present application, there is provided a positioning device for an alarm root cause, the device including: The current alarm data acquisition module is used for determining at least one target network element from the network cloud in the current period, wherein the target network element is a network element for generating current alarm data; The system comprises a topology map segmentation module, a target sub-topology map, a network management module and a network management module, wherein the topology map segmentation module is used for acquiring a topology map of a network cloud, the topology map comprises nodes used for representing network elements, connection lines among the nodes are used for representing connection relations among the network elements, and segmentation is carried out on the