CN-122001742-A - Alarm data map generation method and device and electronic equipment

CN122001742ACN 122001742 ACN122001742 ACN 122001742ACN-122001742-A

Abstract

The application provides a method and a device for generating an alarm data map, electronic equipment and a computer program product, and belongs to the field of cloud computing. The method comprises the steps of preprocessing original alarm data, determining alarm events according to the preprocessed alarm data, generating a time-ordered alarm event sequence, obtaining an alarm sequence database with multiple time granularities according to the alarm event sequence, determining a target alarm association pair from the alarm sequence database, carrying out causal judgment on the target alarm association pair based on a time sequence statistical rule to obtain an alarm propagation relation pair at a network element level, mapping network element objects related to the alarm propagation relation pair into network element categories with common attributes according to a preset generalization rule to obtain a category-level generalized alarm propagation relation, and generating an alarm data map according to the generalized alarm propagation relation.

Inventors

ZHANG XIN
Bi Chenshi
YANG GUANGDA
SUN YANG
XIE HONGTAO
WANG HENGSHI
CAI XUHUI
QIU HUIJIE
ZHANG XIANGWEN
CHEN QIANG
GAO CONGHUI

Assignees

中国移动通信集团黑龙江有限公司
中国移动通信集团有限公司

Dates

Publication Date: 20260508
Application Date: 20251224

Claims (10)

1. The method for generating the alarm data map is characterized by comprising the following steps: Preprocessing the original alarm data; Determining alarm events according to the preprocessed alarm data, generating an alarm event sequence ordered according to time, obtaining an alarm sequence database with multi-time granularity according to the alarm event sequence, determining a target alarm association pair from the alarm sequence database, and performing causal judgment on the target alarm association pair based on a time sequence statistics rule to obtain an alarm propagation relation pair at a network element level; Mapping the network element objects related in the alarm propagation relation pair into network element categories with common attributes according to a preset generalization rule to obtain a generalization alarm propagation relation of category levels; and generating the alarm data map according to the generalized alarm propagation relationship.
2. The method of claim 1, wherein the preprocessing of the original alert data comprises the steps of: performing data cleaning on the original alarm data; And extracting the data of the alarm data subjected to data cleaning to obtain key fields, wherein the key fields comprise an alarm positioning object identifier, alarm occurrence time and alarm type identifier.
3. The method according to claim 1, wherein the obtaining the multi-time granularity alert sequence database from the alert event sequence comprises the steps of: dividing a plurality of time periods with different time lengths from the set total duration based on a dynamic time division rule; And aiming at the time length corresponding to each time period, intercepting an alarm event subsequence with corresponding time length from the alarm event sequence, and forming an alarm sequence database with multiple time granularity based on the alarm event subsequence.
4. The method of claim 1, wherein said determining a target alert association pair from said alert sequence database comprises the steps of: extracting candidate alarm event pairs from the alarm sequence database; Counting the occurrence frequency of each candidate alarm event pair based on time granularity; Setting weights inversely related to time lengths for different time granularities; carrying out weighted summation calculation according to the occurrence frequency and the weight thereof to obtain the comprehensive association strength of the candidate alarm event pair; And determining the target alarm association pair from the candidate alarm events according to the comprehensive association strength.
5. The method according to claim 1, wherein the determining the network element level alarm propagation relationship pair based on the causal decision of the timing statistics on the target alarm association pair comprises the steps of: Counting a first number of times that the first alarm event occurs before the second alarm event and a second number of times that the second alarm event occurs before the first alarm event in all alarm event sequences for the first alarm event and the second alarm event in the target alarm association pair; calculating the ratio of the second times to the first times, and comparing the ratio with a preset threshold value; And judging the causal relation between the first alarm event and the second alarm event according to the comparison result, and obtaining the alarm propagation relation pair of the network element level according to the causal relation result.
6. The method of claim 1, wherein the pre-set generalization rules include at least one of similarity based on network element core functionality, consistency based on supported protocols, similarity based on interface characteristics or usage, consistency based on network level location, and similarity based on type of traffic carried.
7. The method according to claim 1, wherein said generating said alert data map from said generalized alert propagation relationship comprises the steps of: And constructing the alarm data map by taking the network element category and the alarm type in the generalized alarm propagation relationship as nodes and taking the propagation causal relationship defined in the generalized alarm propagation relationship as an edge.
8. An apparatus for generating an alert data map, the apparatus comprising: the data preprocessing module is used for preprocessing the original alarm data; The relation mining module is used for determining alarm events according to the preprocessed alarm data and generating a time-ordered alarm event sequence, forming a multi-time granularity alarm sequence database according to the alarm event sequence, determining a target alarm association pair from the alarm sequence database, and performing causal judgment on the target alarm association pair based on a time sequence statistical rule to obtain an alarm propagation relation pair at a network element level; a relation generalization module for mapping the network element objects related in the alarm propagation relation pair into network element categories with common attributes according to a preset generalization rule to obtain a generalized alarm propagation relation of category levels, and And the map generation module is used for generating the alarm data map according to the generalized alarm propagation relationship.
9. An electronic device comprising a processor, a memory, a program or instructions stored on the memory and executable on the processor, which program or instructions when executed by the processor implement the steps of the method of any one of claims 1 to 7.
10. A computer program product comprising a computer program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions which when executed by a computer implement the steps of the method of any of claims 1 to 7.

Description

Alarm data map generation method and device and electronic equipment Technical Field The present application relates to the field of cloud computing, and in particular, to a method and apparatus for generating an alert data map, an electronic device, and a computer program product. Background With the wide application of cloud computing technology, the scale of a cloud resource pool is continuously enlarged, and timeliness of operation and maintenance work, particularly fault positioning, faces serious challenges. The traditional fault positioning method mainly depends on alarm description information, combines trial and error and equipment replacement, and can cope with common alarm of daily independent equipment. However, when a cloud platform presents an alarm storm and involves a large number of devices, the conventional method has difficulty in rapidly locating the root cause. In the prior art, although a fault propagation relation analysis method is introduced, a fault source is positioned by constructing an alarm relation diagram, and obvious limitations still exist. For example, relationship graphs constructed based on unsupervised clustering or expert experience are difficult to accurately reflect real causal propagation, and the constructed alarm time sequence often depends on a fixed time window, so that association rules are easy to miss. The existing method is limited to physical equipment or a virtualization layer, and multi-dimensional attributes such as power environment alarm and the like are not fully considered, so that the accuracy of alarm relation judgment is affected. Disclosure of Invention The embodiment of the application provides a method, a device, electronic equipment and a computer program product for generating an alarm data map, which can solve the problem that the existing method can not truly reflect the causal propagation relationship of alarm events. In a first aspect, an embodiment of the present application provides a method for generating an alarm data map, where the method includes the following steps: Preprocessing the original alarm data; Determining alarm events according to the preprocessed alarm data, generating an alarm event sequence ordered according to time, obtaining an alarm sequence database with multi-time granularity according to the alarm event sequence, determining a target alarm association pair from the alarm sequence database, and performing causal judgment on the target alarm association pair based on a time sequence statistics rule to obtain an alarm propagation relation pair at a network element level; Mapping the network element objects related in the alarm propagation relation pair into network element categories with common attributes according to a preset generalization rule to obtain a generalization alarm propagation relation of category levels; and generating the alarm data map according to the generalized alarm propagation relationship. In a second aspect, an embodiment of the present application provides a device for generating an alarm data map, where the device includes: the data preprocessing module is used for preprocessing the original alarm data; The relation mining module is used for determining alarm events according to the preprocessed alarm data and generating a time-ordered alarm event sequence, forming a multi-time granularity alarm sequence database according to the alarm event sequence, determining a target alarm association pair from the alarm sequence database, and performing causal judgment on the target alarm association pair based on a time sequence statistical rule to obtain an alarm propagation relation pair at a network element level; a relation generalization module for mapping the network element objects related in the alarm propagation relation pair into network element categories with common attributes according to a preset generalization rule to obtain a generalized alarm propagation relation of category levels, and And the map generation module is used for generating the alarm data map according to the generalized alarm propagation relationship. In a third aspect, an embodiment of the present application provides an electronic device, where the electronic device includes a processor, a memory, and a program or an instruction stored on the memory and executable on the processor, where the program or the instruction is executed by the processor to implement the steps of the method for generating an alert data map according to the first aspect. In a fourth aspect, embodiments of the present application provide a computer program product comprising a computer program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions which, when executed by a computer, implement the steps of the method of generating an alert data profile as described in the first aspect. The embodiment of the application can effectively identify the relevance and causal propagation rel