Search

CN-122027499-A - Network equipment alarm prediction method and system based on GRU-SPADE fusion model

CN122027499ACN 122027499 ACN122027499 ACN 122027499ACN-122027499-A

Abstract

The invention relates to the technical field of network operation and maintenance artificial intelligence, and particularly provides a network equipment alarm prediction method and system based on a GRU-SPADE fusion model. Compared with the prior art, the invention can improve the alarm recall rate, reduce the false alarm rate, obviously increase the prediction advance time and has good engineering application value.

Inventors

  • WANG YANCHENG

Assignees

  • 浪潮通信信息系统有限公司

Dates

Publication Date
20260512
Application Date
20260209

Claims (10)

  1. 1. The network equipment alarm prediction method based on the GRU-SPADE fusion model is characterized by comprising the following steps of: s1, preprocessing data; S2, extracting bimodal features; S3, feature fusion; S4, predicting output.
  2. 2. The network device alarm prediction method based on the GRU-SPADE fusion model according to claim 1, wherein in step S1, the network device Syslog and SNMP Trap messages are time discretized and event coded.
  3. 3. The network equipment alarm prediction method based on the GRU-SPADE fusion model according to claim 2, wherein in step S2, a sequence pattern mining algorithm SPADE is adopted, frequent alarm sequences with the support degree higher than a set threshold delta are extracted, and alarm level weight factors are introduced Strengthening the influence of high-level alarms in association rules; and inputting alarm event codes, time intervals delta t and real-time load indexes of equipment by utilizing time sequence characteristics of a GRU network learning alarm sequence of a gating circulation unit, wherein the internal calculation of the GRU gating circulation unit is as follows: ; ; ; ; Wherein, update the door Function of controlling the old state And new input Is added to the mixture ratio of (a), the value range 0,1, The weight matrix is used for the weight matrix, The old state and the input are spliced together, Bias items; Reset gate The effect is to determine the influence degree of the history information on the current candidate state, The weight matrix is used for the weight matrix, Bias items; candidate hidden states The effect is to generate candidate states containing new information, The weight matrix is used for the weight matrix, The bias term is used for the bias of the bias term, Gating operations for resetting the gate to the old state; final hidden state The effect is to determine the mixing ratio of the old state and the candidate state by updating the gate.
  4. 4. The network equipment alarm prediction method based on the GRU-SPADE fusion model according to claim 3, wherein in step S3, the correlation rule feature generated by the SPADE and the time sequence feature output by the GRU are weighted and fused by using an attention mechanism, and the attention weight calculation mode is as follows: ; attention weights corresponding to the ith element, The vector of the query is used to determine, The i-th key vector is used to determine, Any one of a set of key vectors, And Calculating the score of the similarity between the query vector and the key vector; an exponential function based on a natural constant e, Sum all j corresponding terms.
  5. 5. The network device alarm prediction method based on the GRU-SPADE fusion model according to claim 4, wherein in step S4, a high risk alarm probability threshold is set based on probability distribution of various types of alarms in a future time window T output by a Softmax classifier, and if the probability threshold exceeds the high risk alarm probability threshold, an early warning is triggered, and a visual alarm chain analysis report is automatically generated.
  6. 6. The network equipment alarm prediction system based on the GRU-SPADE fusion model is characterized in that firstly, data preprocessing is carried out, bimodal feature extraction is carried out, then features are fused, and finally, prediction output is carried out.
  7. 7. The network device alarm prediction system based on the GRU-SPADE fusion model according to claim 6, wherein the time discretization and event coding are performed on the Syslog log of the network device and the SNMP Trap message during the data preprocessing.
  8. 8. The network equipment alarm prediction system based on GRU-SPADE fusion model as claimed in claim 7, wherein when bimodal feature extraction is performed, a sequence pattern mining algorithm SPADE is adopted to extract frequent alarm sequences with support degree higher than a set threshold delta, and an alarm level weight factor is introduced Strengthening the influence of high-level alarms in association rules; and inputting alarm event codes, time intervals delta t and real-time load indexes of equipment by utilizing time sequence characteristics of a GRU network learning alarm sequence of a gating circulation unit, wherein the internal calculation of the GRU gating circulation unit is as follows: ; ; ; ; Wherein, update the door Function of controlling the old state And new input Is added to the mixture ratio of (a), the value range 0,1, The weight matrix is used for the weight matrix, The old state and the input are spliced together, Bias items; Reset gate The effect is to determine the influence degree of the history information on the current candidate state, The weight matrix is used for the weight matrix, Bias items; candidate hidden states The effect is to generate candidate states containing new information, The weight matrix is used for the weight matrix, The bias term is used for the bias of the bias term, Gating operations for resetting the gate to the old state; final hidden state The effect is to determine the mixing ratio of the old state and the candidate state by updating the gate.
  9. 9. The network equipment alarm prediction system based on the GRU-SPADE fusion model according to claim 8, wherein when the features are fused, the correlation rule features generated by the SPADE and the time sequence features output by the GRU are weighted and fused by using an attention mechanism, and the attention weight calculation mode is as follows: ; attention weights corresponding to the ith element, The vector of the query is used to determine, The i-th key vector is used to determine, Any one of a set of key vectors, And Calculating the score of the similarity between the query vector and the key vector; an exponential function based on a natural constant e, Sum all j corresponding terms.
  10. 10. The network equipment alarm prediction system based on the GRU-SPADE fusion model according to claim 9, wherein when the prediction is output, the probability distribution of various types of alarms in a future time window T is output based on a Softmax classifier, a high risk alarm probability threshold is set, early warning is triggered when the probability threshold exceeds the high risk alarm probability threshold, and a visual alarm chain analysis report is automatically generated.

Description

Network equipment alarm prediction method and system based on GRU-SPADE fusion model Technical Field The invention relates to the technical field of network operation and maintenance artificial intelligence, and particularly provides a network equipment alarm prediction method and system based on a GRU-SPADE fusion model. Background The traditional threshold alarming method is based on a predefined static rule to trigger alarming, cannot adapt to dynamic changes and has the problems of high response delay and poor flexibility. The single RNN model method can only capture time sequence dependency characteristics in alarm data, and ignores association rules and causal logic between alarm events. And the modeling capability of continuous time sequence data is limited, the false alarm rate is high, and the composite fault is difficult to accurately predict. The association rule mining method, such as the Apriori algorithm, can find the event association, but is difficult to integrate into the time sequence context, and the occurrence time of the alarm cannot be predicted. The network equipment alarm data has obvious time evolution characteristics (such as slow rise of resource utilization rate) and contains causal association between events (such as link interruption caused by a certain port fault). The existing method can not effectively integrate the time sequence characteristics and the event association characteristics, so that the prediction result is lagged, the false alarm rate is high, and the operation and maintenance requirements of a high-reliability network can not be met. Particularly, in complex environments such as a 5G core network, a cloud computing data center and the like, the multi-equipment and multi-level alarm linkage relation is more complex, and the traditional method is difficult to deal with. Disclosure of Invention Aiming at the defects of the prior art, the invention provides a network equipment alarm prediction method with strong practicability based on a GRU-SPASDE fusion model. The invention further aims to provide a network equipment alarm prediction system based on a GRU-SPADE fusion model, which is reasonable in design, safe and applicable. The technical scheme adopted for solving the technical problems is as follows: The network equipment alarm prediction method based on the GRU-SPADE fusion model comprises the following steps: s1, preprocessing data; S2, extracting bimodal features; S3, feature fusion; S4, predicting output. Further, in step S1, the network device Syslog log and the SNMP Trap message are time-discretized and event-coded. Further, in step S2, a sequence pattern mining algorithm SPADE is adopted to extract frequent alarm sequences with a support degree higher than a set threshold delta, and an alarm level weight factor is introducedStrengthening the influence of high-level alarms in association rules; and inputting alarm event codes, time intervals delta t and real-time load indexes of equipment by utilizing time sequence characteristics of a GRU network learning alarm sequence of a gating circulation unit, wherein the internal calculation of the GRU gating circulation unit is as follows: ; ; ; ; Wherein, update the door Function of controlling the old stateAnd new inputIs added to the mixture ratio of (a), the value range 0,1, The weight matrix is used for the weight matrix,The old state and the input are spliced together,Bias items; Reset gate The effect is to determine the influence degree of the history information on the current candidate state,The weight matrix is used for the weight matrix,Bias items; candidate hidden states The effect is to generate candidate states containing new information,The weight matrix is used for the weight matrix,The bias term is used for the bias of the bias term,Gating operations for resetting the gate to the old state; final hidden state The effect is to determine the mixing ratio of the old state and the candidate state by updating the gate. Further, in step S3, the correlation rule feature generated by the SPADE and the time sequence feature output by the GRU are weighted and fused by using the attention mechanism, and the attention weight calculation mode is as follows: ; attention weights corresponding to the ith element, The vector of the query is used to determine,The i-th key vector is used to determine,Any one of a set of key vectors,AndCalculating the score of the similarity between the query vector and the key vector; an exponential function based on a natural constant e, Sum all j corresponding terms. Further, in step S4, based on the probability distribution of various types of alarms in the output future time window T of the Softmax classifier, a high risk alarm probability threshold is set, and if the probability distribution exceeds the high risk alarm probability threshold, an early warning is triggered, and a visual alarm chain analysis report is automatically generated. Further, firstly, preprocessing dat