CN-121984832-A - Network fault diagnosis method, device, electronic equipment and storage medium

CN121984832ACN 121984832 ACN121984832 ACN 121984832ACN-121984832-A

Abstract

The application discloses a network fault diagnosis method, a network fault diagnosis device, electronic equipment and a storage medium. The method comprises the steps of obtaining alarm data of a network to be diagnosed, obtaining topology structure information of equipment in the network to be diagnosed and product documents related to alarms of the equipment, carrying out frequent alarm co-occurrence pattern mining through a preset association rule mining algorithm based on the alarm data and the topology structure information to obtain alarm association triplets, determining an alarm pair set based on the topology structure information and the alarm data, generating a first conduction relation triplet through a pre-trained first large language model based on the alarm pair set and a first preset prompt word, carrying out knowledge graph mining based on the product documents to determine a second conduction relation triplet, constructing a three-channel knowledge graph based on the alarm association triplets, the first conduction relation triplet and the second conduction relation triplet, and carrying out network fault diagnosis based on the three-channel knowledge graph to obtain target fault diagnosis information.

Inventors

ZHAO JIE
NING WENXIN
ZHAO YUXIANG
YU LI
WANG NA

Assignees

中国移动通信集团浙江有限公司
中国移动通信集团有限公司
中国移动(浙江)创新研究院有限公司

Dates

Publication Date: 20260505
Application Date: 20251231

Claims (10)

1. A method of diagnosing a network failure, the method comprising: Acquiring alarm data of a network to be diagnosed, topological structure information of equipment in the network to be diagnosed and a product document related to the alarm of the equipment, wherein the alarm data comprises alarm time; Based on the alarm data and the topological structure information, carrying out frequent alarm co-occurrence mode mining through a preset association rule mining algorithm to obtain alarm association triples; Determining an alarm pair set based on the topological structure information and the alarm data, and generating a first conduction relation triplet through a pre-trained first large language model based on the alarm pair set and a first preset prompt word, wherein the first preset prompt word is used for indicating the first large language model to output a target alarm pair with a conduction relation; based on the product document, carrying out knowledge graph mining, and determining a second conduction relation triplet; And constructing a three-channel knowledge graph based on the alarm association triplet, the first conduction relation triplet and the second conduction relation triplet, and performing network fault diagnosis based on the three-channel knowledge graph to obtain target fault diagnosis information.
2. The method of claim 1, wherein performing network fault diagnosis based on the three-channel knowledge graph to obtain target fault diagnosis information comprises: acquiring historical alarm data of the network to be diagnosed, and grouping the historical alarm data based on the historical alarm data, a preset time interval condition and the three-channel knowledge graph to obtain a first alarm association group; Generating fault case information through a pre-trained second large language model based on a second preset prompting word and the first alarm association group, and storing the fault case information into a fault case library, wherein the fault case information comprises fault diagnosis information corresponding to the historical alarm data; Acquiring the alarm flow of the network to be diagnosed, and grouping the alarm flow based on the three-channel knowledge graph to obtain a second alarm association group; and generating the target fault diagnosis information based on the second alarm association group and the fault case library.
3. The method according to claim 1, wherein the performing frequent alarm co-occurrence pattern mining based on the alarm data and the topology information by a preset association rule mining algorithm to obtain alarm association triples includes: Based on the alarm data, constructing a space-time object set and determining a candidate set corresponding to the space-time object set; Determining local density of the candidate set and a constraint operator of the topological space domain based on the topological structure information and the alarm data, and determining a time sequence filtering operator of the candidate set; Determining the support degree of the candidate set based on the space-time object set, the local density, the time sequence filtering operator and the topological space domain constraint operator, and generating a frequent item set based on the support degree and a preset support degree threshold; and determining the confidence level of the association rule corresponding to the frequent item set based on a preset first causal time threshold, the support level of the association rule corresponding to the frequent item set and the alarm time, and generating the alarm association triplet based on the confidence level and a preset confidence level threshold.
4. The method of claim 1, wherein the determining a second conductivity triplet based on the product document by knowledge-graph mining comprises: Based on the product document, performing format conversion, document blocking and embedding processing to generate a knowledge object set; Performing entity extraction, entity relation extraction and entity disambiguation on the knowledge object set to obtain a relation between an alarm entity and the alarm entity, and performing entity category label identification on the alarm entity to obtain a label of the alarm entity; And generating the second conduction relation triplet based on the alarm entity, the relation among the alarm entities and the label.
5. The method of claim 1, wherein the determining the set of alert pairs based on the topology information and the alert data comprises: determining the alarm density of the alarm data, and determining a time window based on the alarm density and a preset second causal time threshold; and generating an initial alarm pair set aiming at the alarm data corresponding to the time window, and filtering the initial alarm pair set based on the topological structure information and a preset fault conduction radius to generate the alarm pair set.
6. The method of claim 2, further comprising, after the generating the target fault diagnosis information based on the second alert association set and the fault case library: And under the condition that the target fault diagnosis information corresponding to the alarm flow is determined to be correct, determining target fault case information corresponding to the target fault diagnosis information, and storing the target fault case information into the fault case library.
7. A network fault diagnosis apparatus, the apparatus comprising: The system comprises an acquisition module, a diagnosis module and a storage module, wherein the acquisition module is used for acquiring alarm data of a network to be diagnosed, topological structure information of equipment in the network to be diagnosed and a product document related to the alarm of the equipment; the mining module is used for mining the frequent alarm co-occurrence mode through a preset association rule mining algorithm based on the alarm data and the topological structure information to obtain alarm association triples; The generation module is used for determining an alarm pair set based on the topological structure information and the alarm data, and generating a first conduction relation triplet through a pre-trained first large language model based on the alarm pair set and a first preset prompt word, wherein the first preset prompt word is used for indicating the first large language model to output target alarm pairs with conduction relations; the determining module is used for carrying out knowledge graph mining based on the product document and determining a second conduction relation triplet; And the diagnosis module is used for constructing a three-channel knowledge graph based on the alarm association triplet, the first conduction relation triplet and the second conduction relation triplet, and carrying out network fault diagnosis based on the three-channel knowledge graph to obtain target fault diagnosis information.
8. An electronic device, comprising: processor, and A memory arranged to store computer executable instructions configured to be executed by the processor, the executable instructions comprising instructions for performing the network fault diagnosis method of any of claims 1-6.
9. A storage medium storing computer-executable instructions for causing a computer to perform the network fault diagnosis method according to any one of claims 1 to 6.
10. A computer program product comprising a computer program which, when executed by a processor, implements the network fault diagnosis method according to any one of claims 1-6.

Description

Network fault diagnosis method, device, electronic equipment and storage medium Technical Field The application belongs to the technical field of operation and maintenance, and particularly relates to a network fault diagnosis method, a network fault diagnosis device, electronic equipment and a storage medium. Background With the continuous expansion of the scale of the communication network and the increasing complexity of the network architecture, particularly the wide application of new technologies such as 5G, cloud network integration, edge computing and the like, the network alarm information has the characteristics of sea quantity, cross-manufacturer isomerism and the like, and the rapid positioning, root cause analysis and intelligent treatment of faults are provided with serious challenges. Related network fault diagnosis technology does not fully consider space-time elements in the alarm aggregation process. The frequent item mining algorithm, such as Apriori and FP-Growth, is adopted to perform mode discovery only based on the transaction co-occurrence relationship, and the modeling capability of the time sequence and the space position of the occurrence of alarms is lacking, so that a great number of false correlations exist in the mined correlation mode, and the true propagation path of the fault is difficult to accurately reflect. That is, the related network fault diagnosis technique has a problem that the network fault diagnosis is inaccurate. Disclosure of Invention The embodiment of the application provides a network fault diagnosis method, a device, electronic equipment and a storage medium, which can solve the problem of inaccurate network fault diagnosis existing in related network fault diagnosis technology. The embodiment of the application provides a network fault diagnosis method, which comprises the steps of obtaining alarm data of a network to be diagnosed, obtaining topology information of equipment in the network to be diagnosed and a product document related to alarms of the equipment, wherein the alarm data comprise alarm time, carrying out frequent alarm co-occurrence mode mining through a preset association rule mining algorithm based on the alarm data and the topology information to obtain alarm association triples, determining an alarm pair set based on the topology information and the alarm data, generating a first conduction relation triplet through a pre-trained first large language model based on the alarm pair set and a first preset prompt word, wherein the first preset prompt word is used for indicating the first large language model to output a target alarm pair with a conduction relation, carrying out knowledge mining based on the product document, determining a second conduction relation triplet based on the alarm association triples, the first conduction relation triplet and the second conduction relation triplet, constructing a three-channel knowledge graph based on the knowledge graph, and carrying out fault diagnosis based on the three-channel graph to obtain the fault diagnosis information of the network. The embodiment of the application provides a network fault diagnosis device, which comprises an acquisition module, a mining module, a generation module and a diagnosis module, wherein the acquisition module is used for acquiring alarm data of a network to be diagnosed, topological structure information of equipment in the network to be diagnosed and a product document related to the equipment, related to alarms, the alarm data comprise alarm time, the mining module is used for carrying out frequent alarm co-occurrence mode mining through a preset association rule mining algorithm based on the alarm data and the topological structure information to obtain alarm association triples, the generation module is used for determining an alarm pair set based on the topological structure information and the alarm data and generating a first conduction relation triplet based on the alarm pair set and a first preset prompt word through a pre-trained first large language model, the first preset prompt word is used for indicating a target alarm pair with a conduction relation in the first large language model output, the determination module is used for carrying out knowledge graph mining based on the product document to determine a second conduction relation triplet, the diagnosis module is used for constructing a three-way knowledge graph based on the association triples, the first conduction relation triplet and the third channel is used for carrying out the diagnosis of a fault graph based on the association triples. In a third aspect, an embodiment of the application provides an electronic device comprising a processor, and a memory arranged to store computer executable instructions configured to be executed by the processor, the executable instructions comprising instructions for performing the network fault diagnosis method according to the first aspect. In a four