基于密度PrefixSpan算法实现告警事件时序挖掘方法  

An sequencing alarm pattern mining method based on density PrefixSpan algorithm

作　　者：邓翠艳 齐小刚 姚旭清 李青云 DENG Cuiyan;QI Xiaogang;YAO Xuqing;LI Qingyun(Jinzhong College of Information,Jinzhong 030800,China;School of Mathematics and Statistics,Xidian University,Xi’an 710071,China;China mobile communications Group Shanxi Co.,LTD.,Taiyuan 030032,China)

机构地区：[1]晋中信息学院,山西晋中030800 [2]西安电子科技大学数学与统计学院,陕西西安710071 [3]中国移动通信集团山西有限公司,山西太原030032

出　　处：《通信与信息技术》2025年第2期91-97,共7页Communication & Information Technology

基　　金：2023年度山西省高等学校科技创新项目“5G网络智能精准节电研究”(项目编号:2023L517)。

摘　　要：对设备进行全生命周期故障管理是企业设备正常运行的关键,鉴于目前网络日常监控方式仍是采用基于告警日志的方式,然而随着网络规模及网元级联关系的扩大,现行的网络已进入了复杂网络时代,复杂网络告警日志往往会以告警风暴的形式出现,使得传统单一告警日志监控方法已不再适应当前网络智能化监控的要求。基于以上问题,建立以数据驱动的监控体系,提出了一种基于密度PrefixSpan算法实现告警事件时序模式挖掘的方法,首先以通信领域核心网领域的告警数据作为研究目标,提出了一种SDCA动态密度聚类算法,通过时间序列动态密度聚类算法实现了告警日志向告警事件挖掘的转变,其次利用具备剪枝功能的PrefixSpan算法实现对告警事件中告警日志时序溯源模式的挖掘,从而为准确定位事件的故障提供溯源根据。实验结果表明,该方法能够准确聚类告警事件,同时能够以时序溯源的方式揭示事件内部日志的因果关系。通过将该方法运用于通信网络监控及维护中,进一步提升了网络事件监控及实际运维能力,提高了网络智能化监控水平,该方法的有效性已在通信网络故障管理中得到证明。Proper monitoring of performance of an alarm system throughout its life cycle is an important factor in safety and reliabili⁃ty of industrial plants.Given that the current network daily monitoring method still relies on alarm logs for monitoring,with the continuous expansion of network scale and increasing complexity,this method can no longer meet the requirements of current big data monitoring.This paper proposes a data-driven method to find such alarm groups by detecting frequent patterns in alarm floods from historical alarm data.Firstly,the alarm data in the communication network core domain is selected as the research target,and an SDCA algorithm is pro⁃posed to cluster the time density of alarm events.Then,by using the PrefixSpan algorithm with pruning function,the temporal causal pat⁃terns of alarm events are mined.The mining results can reveal the correlation relationship between events in a temporal and causal way.The experimental results show that the method can cluster the alarm events accurately and reveal the correlation of the event internal log in the way of temporal correlation.By applying this method to communication network monitoring and maintenance,the ability of network event monitoring and actual operation and maintenance is further improved,improve the level of network intelligent monitoring.The effec⁃tiveness of the proposed method is demonstrated by application to real industrial data.

关 键 词：PREFIXSPAN SDCA密度算法 告警事件 通信核心网 网络时序拓扑 

分 类 号：TP311.13[自动化与计算机技术—计算机软件与理论]