CN111339211A - Method, device, equipment and medium for analyzing network problems - Google Patents

Abstract

The embodiment of the invention provides a method, a device, equipment and a medium for analyzing network problems, wherein the method comprises the following steps: extracting data corresponding to each type of network problem; among other things, network problems include: a first event-type problem and a first session-type problem; clustering the extracted data corresponding to each type of network problem respectively to obtain clustering data corresponding to a first event type problem and a first session type problem; respectively matching the clustering data corresponding to the first event type problem and the first session type problem with a plurality of rule entries, and determining final root causes corresponding to the first event type problem and the first session type problem according to the matched rule entries; wherein the rule entry includes a rule conclusion that raised the network problem. The invention aims to solve the problem that the network problem analysis is inaccurate due to insufficient strength and depth of a network problem root analysis method.

Description

Method, device, equipment and medium for network problem analysis

technical field

The present invention relates to the field of communication technologies, and in particular, to a method, apparatus, device and medium for analyzing network problems.

Background technique

At present, the root cause analysis methods and tools for mobile communication network problems often only perform statistical analysis on some physical or logical nodes or on some interfaces; Analysis, in addition, the goal of problem analysis methods is relatively single, and often only stays at the level of analyzing phenomena, and it is not convenient to be common to different types of problems; therefore, the method of problem root cause analysis is not enough in granularity and depth, and is universal. Sex is not enough.

SUMMARY OF THE INVENTION

The embodiments of the present invention provide a method, device, equipment and medium for analyzing network problems, which aim to solve the problem of inaccurate analysis of network problems due to insufficient strength and depth of the method for analyzing the root causes of network problems.

In a first aspect, an embodiment of the present invention provides a method for analyzing a network problem. The method includes: extracting data corresponding to each type of network problem; wherein the network problem includes: a first event-type problem and a first conversation-type problem; The extracted data corresponding to each type of network questions are clustered separately to obtain the clustered data corresponding to the first event type question and the first conversation type question; the clustering data corresponding to the first event type question and the first conversation type question are respectively The class data is matched with a plurality of rule entries, and the final root cause corresponding to the first event-type problem and the first conversation-type problem is determined according to the matched rule entries; wherein, the rule entry includes the rule conclusion that generates the network problem.

In a second aspect, an embodiment of the present invention provides an apparatus for analyzing network problems. The apparatus includes: an extraction module for extracting data corresponding to each type of network problem; wherein the network problem includes: a first event-type problem and a third A conversational question; the clustering module is used to separately cluster the extracted data corresponding to each type of network question to obtain the clustered data corresponding to the first event type question and the first conversational question; the matching module is used to Match the clustering data corresponding to the first event type question and the first conversation type question with multiple rule entries respectively, and determine the final root cause corresponding to the first event type question and the first conversation type question according to the matched rule entries ; wherein, the rule entry includes the rule conclusion that produces the network problem.

An embodiment of the present invention provides a device for analyzing network problems, including: at least one processor, at least one memory, and computer program instructions stored in the memory. method on the one hand.

In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium on which computer program instructions are stored, and when the computer program instructions are executed by a processor, the method of the first aspect in the foregoing embodiments is implemented.

The method, device, device, and medium for analyzing network problems provided by the embodiments of the present invention perform clustering of the causes of the first event-type problem and the first conversation-type problem that may occur after extraction, and then perform the analysis with multiple rule entries. Match, and finally output the rule conclusion of the most matching rule entry as the final root cause. The above-mentioned data is extracted and clustered according to the first event-type problem and the first conversation-type problem, which solves the problem of inaccurate analysis of network problems due to insufficient strength and depth of the root cause analysis method of network problems.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present invention more clearly, the accompanying drawings required in the embodiments of the present invention will be briefly introduced below. For those of ordinary skill in the art, without creative work, the Additional drawings can be obtained from these drawings.

FIG. 1 shows a flowchart of a method for analyzing network problems according to some embodiments of the present invention.

Figures 2(a)-2(b) show schematic diagrams of the rule matching algorithm in Figure 1 .

FIG. 3 shows a schematic diagram of an apparatus for analyzing network problems according to some embodiments of the present invention.

FIG. 4 shows a schematic diagram of an apparatus for analyzing network problems according to some embodiments of the present invention.

Detailed ways

The features and exemplary embodiments of various aspects of the present invention will be described in detail below. In order to make the objects, technical solutions and advantages of the present invention more clear, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only configured to explain the present invention, and are not configured to limit the present invention. It will be apparent to those skilled in the art that the present invention may be practiced without some of these specific details. The following description of the embodiments is only intended to provide a better understanding of the present invention by illustrating examples of the invention.

It should be noted that, in this document, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any relationship between these entities or operations. any such actual relationship or sequence exists. Moreover, the terms "comprising", "comprising" or any other variation thereof are intended to encompass a non-exclusive inclusion such that a process, method, article or device that includes a list of elements includes not only those elements, but also includes not explicitly listed or other elements inherent to such a process, method, article or apparatus. Without further limitation, an element defined by the phrase "comprises" does not preclude the presence of additional identical elements in a process, method, article, or device that includes the element.

In order to better understand the present invention, a method for analyzing a network problem according to an embodiment of the present invention is described in detail below with reference to FIG. 1 .

FIG. 1 shows a flowchart of a method for analyzing network problems according to some embodiments of the present invention. As shown in Figure 1, the method for analyzing the network problem may include:

Step S1: Acquire data corresponding to each type of network problem; wherein, the network problem includes: a first event-type problem and a first conversation-type problem.

In the embodiment of the present invention, events and sessions are used as the analysis granularity, which can solve the problem that only statistical analysis is performed on some physical or logical nodes or on some interfaces, and analysis down to event level or session level cannot be realized.

The method of dividing event-type problems and conversation-type problems includes: determining the type of network problems according to the length of the network problem; A VOLTE call dropped, etc.; the problem that occurs in a relatively long period of time is defined as a conversational problem, such as poor call quality during a VOLTE voice call, and freezes during video playback. For, event-type questions include success-event-type questions and failure-event-type questions (first-event-type questions); conversation-type questions include poor-quality conversation-type questions (first-conversation-type questions) and good-quality conversation-type questions.

In step S1, using the first event-type question and the first conversation-type question as clues, only the data related to the first event-type question and the first conversation-type question are extracted respectively, and the irrelevant data is not extracted, and then Reduce the workload of data processing.

In the embodiment of the present invention, before step S1, the method for analyzing network problems further includes: first, obtaining data with the help of a big data platform, and the obtained data includes: China Mobile unified DPI, including hard mining and soft mining data, especially Soft mining data has more mining value. Soft mining data includes: signaling plane and user information; wireless network engineering parameters, mainly including antenna feeder information and wireless environment information covered by cells; wireless and core network node configuration parameters; Network node statistics; wireless and core network node alarm information.

In step S1, using the first event-type question and the first conversation-type question as clues, only the data related to the first event-type question and the first conversation-type question are extracted from the obtained data, and the irrelevant data are extracted. The data is not extracted, thereby reducing the workload of data processing.

Step S2: Clustering the extracted data corresponding to each type of network question respectively to obtain clustered data corresponding to the first event-type question and the first conversation-type question.

Specifically, the data collected in step S1 is clustered according to the types of network problems to obtain clustering data corresponding to each type of network problems. The following table extracts information from poor sessions that may lead to poor sessions:

The purpose of analyzing the root cause of the problem in the embodiment of the present invention is to analyze the failure events and poor quality sessions in the network, try to give the most probable cause of the problem, and provide ideas and solutions for solving the problem as much as possible.

Step S3: Match the clustering data corresponding to the first event-type question and the first conversation-type question with a plurality of rule entries respectively, and determine the cluster data corresponding to the first event-type question and the first conversation-type question according to the matched rule entries. The ultimate root cause; where the rule entry includes the rule conclusion that created the network problem.

In this embodiment of the present invention, the rule tree shown in FIG. 2(a) can be used to match and obtain the final root cause corresponding to each type of network problem; the rule entry shown in Matching results in the final root cause corresponding to each type of network problem. Among them, A is a factor that may cause network problems.

In the embodiment of the present invention, the method of generating matching rule entries (as shown in FIG. 2(b)) from the rule tree in Fig. 2(a) realizes that the rules are configurable, modifiable, and extensible, and the business logic is changed from the program code logically separated. The rule tree decomposition process shown in Figure 2(a) and Figure 2(b), the specific method is to decompose the problem analysis rule tree in business logic into multiple rule entries, each rule entry corresponds to a certain leaf in the rule tree Node, a rule tree becomes a rule entry record with a series of judgment conditions (in Figure 2(b), including rule 1, rule 2 and rule 3, each rule corresponds to a conclusion and a condition).

In step S2, all the information required in the rule entry has been correlated and extracted to a failure event (the first event type problem) or poor quality conversation (the first conversation type problem); now, the decomposed rule The entries are logically matched with the information content of these failed events or poor quality sessions, and if the match is successful, the conclusion part of the matching entry is output. In this way, the complex business logic is separated from the system implementation. Business experts are responsible for researching and sorting out business rules and designing rule entries, while system developers only need to focus on how to associate and extract the required amount of information.

In this embodiment of the present invention, after step S1 and step S2 are performed, the relevant information corresponding to the poor quality session and the failure event has been associated and extracted, and the relevant information comes from various aspects of the association. The more the better; the task of the rule entry is to formulate more detailed and accurate judgment conditions, the more judgments used, the better, and the finer the granularity of the conditions, the better.

In this embodiment of the present invention, a rule entry includes a rule condition and a rule priority; setting a priority for each rule entry is to adapt to changes in the rule condition. When the rule condition uses more fine-grained information, the rule entry's The priority is higher; when a rule is matched, each failure event or poor quality session will be matched with all rule entries. If a failure event or poor quality session can match multiple rule entries, the one with the highest priority will be selected. rule as the final matching result. In this way, through the priority of the rules, the root cause analysis of the problem at different levels can be realized, and the most probable cause of the problem can be given as much as possible to maximize the accuracy.

In the embodiment of the present invention, the rule entries after the decomposition of the rule tree form a rule entry table, and each rule entry in the table will contain four parts of information, as shown in the following table:

In this embodiment of the present invention, as long as enough information is used in the condition part of the rule entry, the rule entry can give a very accurate problem analysis conclusion, or even directly provide a solution.

In this embodiment of the present invention, after step S3 is performed, the rule entry can also be updated according to the final root cause and the data clustered in step S2, including: according to the clustered data, the possible root cause of the problem can be obtained, and the possible root cause of the problem can be obtained. The difference between the root cause of the problem and the final root cause, and whether the network problem is improved after adjusting the root cause of the final problem; If the root cause of the problem solves the network problem, then the rule condition and priority of the rule entry can be adjusted according to the possible root cause of the network problem, so that the rule entry is more accurate; It is the data that can be adjusted in reverse, and the data that is most direct to the root cause of the problem can be adjusted to obtain the data that is not the most direct cause of the problem, and the priority can be reduced or not obtained.

In the embodiment of the present invention, after step S3, classifying and counting the first event-type questions and the first conversation-type questions specifically includes: according to user information, counting the final results corresponding to the first event-type questions and the first conversation-type questions. Root cause. The main constituent factors of the first event-type problem and the first conversation-type problem can be given by the above statistical methods, and the problems can be solved in a targeted manner.

In this embodiment of the present invention, the causes of the first event-type problem and the first conversation-type problem that may occur are clustered after extraction, and then matched with multiple rule entries, and finally the rule of the most matching rule entry is output. Conclusion as the ultimate root cause. The above-mentioned data is extracted and clustered according to the first event-type problem and the first conversation-type problem, which solves the problem of inaccurate analysis of network problems due to insufficient strength and depth of the root cause analysis method of network problems.

FIG. 3 shows a schematic diagram of an apparatus for analyzing network problems according to some embodiments of the present invention. As shown in Figure 3, the device for analyzing network problems includes:

The extraction module 301 is used for extracting data corresponding to each type of network question; wherein, the network question includes: a first event type question and a first conversation type question;

The clustering module 302 is configured to separately cluster the extracted data corresponding to each type of network question to obtain clustered data corresponding to the first event-type question and the first conversation-type question;

The matching module 303 is configured to respectively match the clustering data corresponding to the first event-type question and the first conversation-type question with multiple rule entries, and determine whether the first event-type question and the first conversation-type question are related to the first event-type question and the first conversation-type question according to the matched rule entries. The final root cause corresponding to the problem; wherein, the rule entry includes the rule conclusion that produces the network problem.

Optionally, the device further includes: a determining module; a determining module, configured to: determine the first event-type problem and the first conversation-type problem respectively according to the first time period and the second time period in which the network problem occurs; wherein, the first time period period is less than the second time period.

Optionally, the clustering data includes: information type, priority of information type, information sub-category and description.

Optionally, the information type includes: one or more of time point, IMSI level, cell basic, grid level and large particle dimension level.

Optionally, each rule entry further includes: rule condition and rule priority;

The matching module 303 is specifically configured to: respectively match the cluster data corresponding to the first event type question and the first conversation type question with the rule condition included in each rule entry in the multiple rule entries; The rule entry with the highest rule priority is output; and the final root cause corresponding to the first event-type problem and the first conversation-type problem is determined according to the rule entry with the highest rule priority.

Optionally, each rule entry further includes: a rule description; the rule description is used to describe the information added, deleted, modified and checked for each rule entry.

Optionally, the apparatus further includes: an update module; an update module for updating the rule condition according to the clustering data.

Optionally, the extraction module 301 is specifically configured to: extract each type of network problem from one or more of China Mobile's unified DPI, antenna engineering parameters, wireless and core node configuration parameters, and wireless and core node alarm information corresponding data.

Optionally, the unified DPI of China Mobile includes: signaling plane and user information.

Optionally, the apparatus further includes: a statistics module; and a statistics module, configured to: according to the user information, count the final root causes corresponding to the first event-type question and the first conversation-type question.

In this embodiment of the present invention, the causes of the first event-type problem and the first conversation-type problem that may occur are clustered after extraction, and then matched with multiple rule entries, and finally the rule of the most matching rule entry is output. Conclusion as the ultimate root cause. The above-mentioned data is extracted and clustered according to the first event-type problem and the first conversation-type problem, which solves the problem of inaccurate analysis of network problems due to insufficient strength and depth of the root cause analysis method of network problems.

In addition, the method for analyzing network problems in the embodiment of the present invention described in conjunction with FIG. 1 may be implemented by a device for analyzing network problems. FIG. 4 shows a schematic diagram of a hardware structure of a device for analyzing network problems provided by an embodiment of the present invention.

The apparatus for network problem analysis may include a processor 401 and a memory 402 storing computer program instructions.

Specifically, the above-mentioned processor 401 may include a central processing unit (CPU), or a specific integrated circuit (Application Specific Integrated Circuit, ASIC), or may be configured as one or more integrated circuits implementing the embodiments of the present invention.

Memory 402 may include mass storage for data or instructions. By way of example and not limitation, memory 402 may include a Hard Disk Drive (HDD), a floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape or Universal Serial Bus (USB) drive or two or more A combination of more than one of the above. Memory 402 may include removable or non-removable (or fixed) media, where appropriate. Memory 402 may be internal or external to the data processing device, where appropriate. In certain embodiments, memory 402 is non-volatile solid state memory. In particular embodiments, memory 402 includes read only memory (ROM). Where appropriate, the ROM may be a mask programmed ROM, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), electrically rewritable ROM (EAROM) or flash memory or A combination of two or more of the above.

The processor 401 reads and executes the computer program instructions stored in the memory 402 to implement any one of the network problem analysis methods in the foregoing embodiments.

In one example, the apparatus for network problem analysis may further include a communication interface 403 and a bus 410 . Among them, as shown in FIG. 4 , the processor 401 , the memory 402 , and the communication interface 403 are connected through the bus 410 and complete the mutual communication.

The communication interface 403 is mainly used to implement communication between modules, apparatuses, units and/or devices in the embodiments of the present invention.

The bus 410 includes hardware, software, or both, coupling the components of the network problem analysis device to each other. By way of example and not limitation, the bus may include Accelerated Graphics Port (AGP) or other graphics bus, Enhanced Industry Standard Architecture (EISA) bus, Front Side Bus (FSB), HyperTransport (HT) Interconnect, Industry Standard Architecture (ISA) Bus, Infiniband Interconnect, Low Pin Count (LPC) Bus, Memory Bus, Microchannel Architecture (MCA) Bus, Peripheral Component Interconnect (PCI) Bus, PCI-Express (PCI-X) Bus, Serial Advanced Technology Attachment (SATA) bus, Video Electronics Standards Association Local (VLB) bus or other suitable bus or a combination of two or more of the above. Bus 410 may include one or more buses, where appropriate. Although embodiments of the present invention describe and illustrate a particular bus, the present invention contemplates any suitable bus or interconnect.

In addition, in combination with the method for analyzing network problems in the foregoing embodiments, the embodiments of the present invention may provide a computer-readable storage medium for implementation. Computer program instructions are stored on the computer-readable storage medium; when the computer program instructions are executed by the processor, any one of the network problem analysis methods in the foregoing embodiments is implemented.

It is to be understood that the present invention is not limited to the specific arrangements and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above-described embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the sequence of steps after comprehending the spirit of the present invention.

The functional blocks shown in the above-described structural block diagrams may be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, it may be, for example, an electronic circuit, an application specific integrated circuit (ASIC), suitable firmware, a plug-in, a function card, or the like. When implemented in software, elements of the invention are programs or code segments used to perform the required tasks. The program or code segments may be stored in a machine-readable medium or transmitted over a transmission medium or communication link by a data signal carried in a carrier wave. A "machine-readable medium" may include any medium that can store or transmit information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, and the like. The code segments may be downloaded via a computer network such as the Internet, an intranet, or the like.

It should also be noted that the exemplary embodiments mentioned in the present invention describe some methods or systems based on a series of steps or devices. However, the present invention is not limited to the order of the above steps, that is, the steps may be performed in the order mentioned in the embodiments, or may be different from the order in the embodiments, or several steps may be performed simultaneously.

The above are only specific implementations of the present invention. Those skilled in the art can clearly understand that, for the convenience and simplicity of the description, the specific working process of the above-described systems, modules and units may refer to the foregoing method embodiments. The corresponding process in , will not be repeated here. It should be understood that the protection scope of the present invention is not limited to this. Any person skilled in the art can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should all cover within the protection scope of the present invention.

Claims (13)

1. A method of network problem analysis, the method comprising:

extracting data corresponding to each type of network problem; wherein the network problem comprises: a first event-type problem and a first session-type problem;

clustering the extracted data corresponding to each type of network problem respectively to obtain the first event type problem and the clustered data corresponding to the first session type problem;

respectively matching the clustering data corresponding to the first event type question and the first session type question with a plurality of rule entries, and determining a final root cause corresponding to the first event type question and the first session type question according to the matched rule entries; wherein the rule entry includes a rule conclusion that a network problem is generated.

2. The method according to claim 1, wherein before the clustering the extracted data corresponding to each type of network problem to obtain the clustered data corresponding to the first event-type problem and the first session-type problem, the method further comprises:

determining a first event type problem and a first session type problem according to a first time period and a second time period in which the network problem occurs, respectively; wherein the first time period is less than the second time period.

3. The method of claim 2, wherein the clustering data comprises:

information type, priority of information type, information subclass, and description.

4. The method of claim 3, wherein the information types comprise: one or more of a point in time, an IMSI level, a cell base, a grid level, and a large granule dimension level.

5. The method of claim 1 or 2, wherein each rule entry further comprises: rule conditions and rule priorities;

matching the cluster data corresponding to the first incident-type question and the first session-type question with a plurality of rule entries, respectively, and determining a final root cause corresponding to the first incident-type question and the first session-type question according to the matched rule entries, comprising:

respectively matching the clustering data corresponding to the first event-type question and the first session-type question with rule conditions included in each of a plurality of rule entries;

outputting the rule item with the highest rule priority in the matched rule items;

and determining a final root cause corresponding to the first incident type question and the first incident type question according to the rule entry with the highest rule priority.

6. The method of claim 5, wherein each rule entry further comprises: a rule description;

the rule description is used for describing information for adding and deleting the check of each rule entry.

7. The method of claim 5, further comprising:

and updating the rule entry.

8. The method of claim 1, wherein extracting data corresponding to each type of network problem comprises:

and extracting data corresponding to each type of network problem from one or more of China Mobile unified DPI, antenna engineering parameters, wireless and core node configuration parameters and wireless and core node alarm information.

9. The method according to claim 8, wherein the China Mobile unified DPI comprises: signaling plane and user information.

10. The method of claim 9, further comprising:

and counting final root causes corresponding to the first event type problem and the first session type problem according to the user information.

11. An apparatus for network problem analysis, the apparatus comprising:

the extraction module is used for extracting data corresponding to each type of network problem; wherein the network problem comprises: a first event-type problem and a first session-type problem;

the clustering module is used for clustering the extracted data corresponding to each type of network problem respectively to obtain clustering data corresponding to the first event type problem and the first session type problem;

a matching module, configured to match the clustering data corresponding to the first event-type problem and the first session-type problem with a plurality of rule entries, and determine a final root cause corresponding to the first event-type problem and the first session-type problem according to the matched rule entries; wherein the rule entry includes a rule conclusion that a network problem is generated.

12. An apparatus for network problem analysis, comprising: at least one processor, at least one memory, and computer program instructions stored in the memory that, when executed by the processor, implement the method of any of claims 1-10.

13. A computer-readable storage medium having computer program instructions stored thereon, which when executed by a processor implement the method of any one of claims 1-10.

Images