CN111339211B - Method, device, equipment and medium for analyzing network problems - Google Patents

Abstract

Embodiments of the present invention provide methods, devices, equipment and media for network problem analysis. The method includes: extracting data corresponding to each type of network problem; wherein the network problems include: first event-type questions and first conversation-type questions. ; Cluster the extracted data corresponding to each type of network questions separately to obtain the cluster data corresponding to the first event-type question and the first conversation-type question; respectively cluster the data corresponding to the first event-type question and the first conversation-type question. The clustered data is matched with multiple rule entries, and the final root cause corresponding to the first event-type problem and the first conversation-type problem is determined based on the matched rule entries; wherein the rule entries include a rule conclusion that generates the network problem. The purpose of the present invention is to solve the problem of inaccurate network problem analysis due to insufficient strength and depth of the network problem root cause analysis method.

Description

Methods, devices, equipment and media for network problem analysis

Technical field

The present invention relates to the field of communication technology, and in particular, to a method, device, equipment and medium for network problem analysis.

Background technique

At present, mobile communication network problem root cause analysis methods and tools often only perform statistical analysis on certain physical or logical nodes, or on certain interfaces; and do not fully utilize the various information sources available for in-depth mining and analysis. Analysis, in addition, the goal of problem analysis methods is relatively single, often just staying at the level of analyzing phenomena, and it is not easy to be used interchangeably between different types of problems; therefore, the methods of problem root cause analysis are not granular and deep enough, and are not universal. Not enough sex.

Contents of the invention

Embodiments of the present invention provide methods, devices, equipment and media for network problem analysis, with the purpose of solving the problem of inaccurate network problem analysis due to insufficient strength and depth of network problem root cause analysis methods.

In a first aspect, embodiments of the present invention provide a method for analyzing network problems. The method includes: extracting data corresponding to each type of network problem; wherein the network problems include: first event-type questions and first conversation-type questions; The extracted data corresponding to each type of network questions are clustered separately to obtain the cluster data corresponding to the first event-type question and the first conversation-type question; respectively, the cluster data corresponding to the first event-type question and the first conversation-type question are obtained. The class data is matched with multiple rule entries, and the final root cause corresponding to the first event-type problem and the first conversation-type problem is determined based on the matched rule entries; wherein the rule entries include a rule conclusion that generates the network problem.

In a second aspect, embodiments of the present invention provide a device for analyzing network problems. The device includes: an extraction module for extracting data corresponding to each type of network problem; wherein the network problems include: a first event-type problem and a third A conversational question; a clustering module, used to cluster the extracted data corresponding to each type of network question, to obtain clustered data corresponding to the first event-type question and the first conversational question; a matching module, used to Match the clustered data corresponding to the first incident-type problem and the first conversation-type problem with multiple rule entries respectively, and determine the final root cause corresponding to the first incident-type problem and the first conversation-type problem based on the matched rule entries ; Among them, the rule entries include rule conclusions that cause network problems.

An embodiment of the present invention provides a device for analyzing network problems, including: at least one processor, at least one memory, and computer program instructions stored in the memory. When the computer program instructions are executed by the processor, the first implementation in the above embodiment is implemented. One way approach.

In a fourth aspect, embodiments of the present invention provide a computer-readable storage medium on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method of the first aspect in the above embodiments is implemented.

The network problem analysis methods, devices, equipment and media provided by embodiments of the present invention cluster the possible first event-type problems and the first conversation-type problems after extracting them, and then combine them with multiple rule entries. Match, and finally output the rule conclusion of the most matching rule entry as the final root cause. The above method extracts and clusters data based on the first event-type questions and the first conversation-type questions, which solves the problem of inaccurate network problem analysis due to insufficient strength and depth of network problem root cause analysis methods.

Description of drawings

In order to explain the technical solutions of the embodiments of the present invention more clearly, the drawings required to be used in the embodiments of the present invention will be briefly introduced below. For those of ordinary skill in the art, without exerting creative efforts, they can also Additional drawings can be obtained from these drawings.

Figure 1 shows a flowchart of a method for network problem analysis provided according to some embodiments of the present invention.

Figures 2(a)-2(b) show a schematic diagram of the rule matching algorithm in Figure 1.

Figure 3 shows a schematic diagram of a network problem analysis device provided according to some embodiments of the present invention.

Figure 4 shows a schematic diagram of a network problem analysis device provided according to some embodiments of the present invention.

Detailed ways

Features and exemplary embodiments of various aspects of the present invention will be described in detail below. In order to make the purpose, technical solutions and advantages of the present invention clearer, the present invention will be described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are configured only to explain the invention and not to limit the invention. It will be apparent to one skilled in the art that the present invention may be practiced without some of these specific details. The following description of the embodiments is merely intended to provide a better understanding of the invention by illustrating examples of the invention.

It should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that these entities or operations are mutually exclusive. any such actual relationship or sequence exists between them. Furthermore, the terms "comprises," "comprises," or any other variations thereof are intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus that includes a list of elements includes not only those elements, but also those not expressly listed other elements, or elements inherent to the process, method, article or equipment. Without further limitation, an element defined by the statement "comprising..." does not exclude the presence of additional identical elements in a process, method, article, or device that includes the stated element.

In order to better understand the present invention, the network problem analysis method according to the embodiment of the present invention will be described in detail below with reference to FIG. 1 .

Figure 1 shows a flowchart of a method for network problem analysis provided according to some embodiments of the present invention. As shown in Figure 1, the network problem analysis method may include:

Step S1: Obtain data corresponding to each type of network problem; the network problems include: first event-type questions and first conversation-type questions.

In the embodiment of the present invention, events and sessions are used as the analysis granularity, which can solve the problem of only performing statistical analysis on certain physical or logical nodes or on certain interfaces, and it is impossible to achieve analysis as fine as an event level or a session level.

The methods of classifying event-type problems and conversation-type problems include: determining the type of network problem based on the length of time in which the network problem occurs; defining problems that occur in a short period of time as event-type problems, such as a VOLTE call failure, A VOLTE call drop, etc.; problems that occur over a relatively long period of time are defined as conversational problems, such as poor call quality during VOLTE voice calls and freezes during video playback. For example, event-type questions include successful event-type questions and failure-event-type questions (first event-type questions); conversational questions include poor-quality conversational questions (first conversational-type questions) and good-quality conversational questions.

In step S1, using the first event-type question and the first conversation-type question as clues, only the data related to the first event-type question and the first conversation-type question are extracted, and irrelevant data is not extracted, and then Reduce data processing workload.

In the embodiment of the present invention, before step S1, the network problem analysis method also includes: first, using the big data platform to obtain data. The obtained data includes: China Mobile unified DPI, including hard mining and soft mining data, especially It is soft mining data that is more valuable for mining. Soft mining data includes: signaling plane and user information; wireless network engineering parameters, mainly including antenna feeder information and wireless environment information of cell coverage; wireless and core network node configuration parameters; wireless and core Network node statistical information; wireless and core network node alarm information.

In step S1, using the first event-type question and the first conversation-type question as clues, only the data related to the first event-type question and the first conversation-type question are extracted from the above-mentioned acquired data, and irrelevant data are extracted. The data is not extracted, thereby reducing the workload of data processing.

Step S2: Cluster the extracted data corresponding to each type of network questions respectively to obtain cluster data corresponding to the first event-type questions and the first conversation-type questions.

Specifically, the data collected in step S1 are clustered according to the types of network problems to obtain clustering data corresponding to each type of network problem. The following table extracts information that may lead to poor quality sessions:

The purpose of root cause analysis of problems in the embodiments of the present invention is to analyze failure events and poor-quality sessions in the network, try to give the most likely cause of the problem, and provide ideas and solutions to solve the problem as much as possible.

Step S3: Match the cluster data corresponding to the first event-type question and the first conversation-type question with multiple rule entries respectively, and determine the data corresponding to the first event-type question and the first conversation-type question based on the matched rule entries. Final root cause; where the rule entry includes the rule conclusion that caused the network problem.

In the embodiment of the present invention, the rule tree as shown in Figure 2(a) can be used to match and obtain the final root cause corresponding to each type of network problem; the rule entries as shown in Figure 2(b) can also be used to match Matching results in the final root cause of each type of network problem. Among them, A is the factor that may cause network problems.

In the embodiment of the present invention, the method of generating matching rule entries (as shown in Figure 2(b)) from the rule tree in Figure 2(a) realizes that the rules can be configured, modified, and extensible, and the business logic is changed from the program code separated from the logic. The rule tree decomposition process shown in Figure 2(a) and Figure 2(b) is to decompose the problem analysis rule tree in business logic into multiple rule entries. Each rule entry corresponds to a certain leaf in the rule tree. node, a rule tree becomes a rule entry record with a series of judgment conditions (in Figure 2(b), including rule 1, rule 2 and rule 3, each rule corresponds to a conclusion and a condition).

In step S2, all the information needed in the rule entries has been associated and extracted to a failure event (first event-type problem) or poor quality session (first session-type problem); now, the decomposed rules The entries are logically matched with the information content of these failed events or poor-quality sessions. If the match is successful, the conclusion part of the matching entry is output. In this way, complex business logic is separated from system implementation. Business experts are responsible for researching and organizing business rules and designing rule entries, while system developers only need to focus on how to correlate and extract the required amount of information.

In the embodiment of the present invention, after executing steps S1 and S2, the relevant information corresponding to the poor quality session and the failure event has been associated and extracted. The relevant information comes from various related aspects, and the more relevant information The more the better; and the task of the rule entries is to formulate more detailed and accurate judgment conditions. The more judgments used, the better, and the finer the granularity of the conditions, the better.

In this embodiment of the present invention, rule entries include rule conditions and rule priorities; setting a priority for each rule entry is to adapt to changes in rule conditions. When the rule conditions use more fine-grained information, the rule entry The priority is higher; when matching rules, each failure event or poor quality session will be matched with all rule entries. If a failure event or poor quality session can match multiple rule entries, the one with the highest priority will be used. rules as the final matching result. In this way, through the priority of rules, different levels of problem root cause analysis can be achieved, and the most likely cause of the problem can be given as much as possible to maximize accuracy.

In the embodiment of the present invention, the rule entries after the rule tree is decomposed form a rule entry table. Each rule entry in the table will contain four parts of information, as shown in the following table:

In the embodiment of the present invention, as long as enough information is used in the condition part of the rule entry, the rule entry can give a very accurate problem analysis conclusion and even directly provide a solution.

In the embodiment of the present invention, after executing step S3, the rule entries can also be updated based on the final root cause and the data clustered in step S2, including: based on the clustered data, possible root causes of the problem can be obtained, and possible root causes can be obtained. The difference between the root cause of the problem and the final root cause, and whether the network problem has been improved after adjusting the final root cause; if there is no improvement, it means that the setting of this rule entry is inappropriate and needs to be adjusted, for example, by possibly If the root cause of the problem is to solve the network problem, then the rule conditions and priority of the rule entry can be adjusted according to the possible root cause of the network problem, so that the rule entry is more accurate; furthermore, when the rule entry is very accurate, It is possible to reversely adjust the clustered data to obtain data that is most direct to the root cause of the problem. Data that is not the most direct cause of the problem can be lowered in priority or not obtained.

In the embodiment of the present invention, after step S3, classification and statistics are performed on the first event-type question and the first conversation-type question, which specifically includes: collecting final statistics corresponding to the first event-type question and the first conversation-type question according to the user information. Root cause. Through the above statistical methods, the main components of the first event-type questions and the first conversation-type questions can be given, and the problems can be solved in a targeted manner.

In this embodiment of the present invention, by extracting and clustering the causes of the first event-type problems and the first conversation-type problems that may occur, and then matching them with multiple rule entries, the rule of the most matching rule entry is finally output. Conclusion as final root cause. The above method extracts and clusters data based on the first event-type questions and the first conversation-type questions, which solves the problem of inaccurate network problem analysis due to insufficient strength and depth of network problem root cause analysis methods.

Figure 3 shows a schematic diagram of a network problem analysis device provided according to some embodiments of the present invention. As shown in Figure 3, the network problem analysis device includes:

The extraction module 301 is used to extract data corresponding to each type of network problem; where the network problems include: first event-type questions and first conversation-type questions;

The clustering module 302 is used to cluster the extracted data corresponding to each type of network problem respectively, to obtain clustering data corresponding to the first event-type problem and the first conversation-type problem;

The matching module 303 is configured to match the cluster data corresponding to the first event-type question and the first conversation-type question with multiple rule entries, and determine the relationship between the first event-type question and the first conversation-type question according to the matching rule entries. The final root cause corresponding to the problem; where the rule entries include the rule conclusion that caused the network problem.

Optionally, the device further includes: a determination module; a determination module, configured to determine the first event-type problem and the first conversation-type problem respectively according to the first time period and the second time period when the network problem occurs; wherein, the first time period period is smaller than the second period.

Optionally, the clustering data includes: information type, priority of information type, information subcategory and description.

Optionally, the information type includes: one or more of time point, IMSI level, cell basic, grid level and large granular dimension level.

Optionally, each rule entry also includes: rule conditions and rule priority;

The matching module 303 is specifically configured to: respectively match the cluster data corresponding to the first event-type question and the first conversation-type question with the rule conditions included in each rule entry in the plurality of rule entries; The rule entry with the highest rule priority is output; and the final root cause corresponding to the first event-type problem and the first conversation-type problem is determined based on the rule entry with the highest rule priority.

Optionally, each rule entry also includes: a rule description; the rule description is used to describe the addition, deletion, modification, and query information of each rule entry.

Optionally, the device also includes: an update module; an update module configured to update rule conditions based on clustering data.

Optionally, the extraction module 301 is specifically used to extract each type of network problem from one or more of China Mobile's unified DPI, antenna engineering parameters, wireless and core node configuration parameters, and wireless and core node alarm information. corresponding data.

Optional, China Mobile's unified DPI includes: signaling plane and user information.

Optionally, the device further includes: a statistics module; a statistics module configured to count the final root cause corresponding to the first event-type problem and the first conversation-type problem according to the user information.

In this embodiment of the present invention, by extracting and clustering the causes of the first event-type problems and the first conversation-type problems that may occur, and then matching them with multiple rule entries, the rule of the most matching rule entry is finally output. Conclusion as final root cause. The above method extracts and clusters data based on the first event-type questions and the first conversation-type questions, which solves the problem of inaccurate network problem analysis due to insufficient strength and depth of network problem root cause analysis methods.

In addition, the network problem analysis method of the embodiment of the present invention described in conjunction with FIG. 1 can be implemented by a network problem analysis device. Figure 4 shows a schematic diagram of the hardware structure of a network problem analysis device provided by an embodiment of the present invention.

A device for network problem analysis may include a processor 401 and a memory 402 storing computer program instructions.

Specifically, the above-mentioned processor 401 may include a central processing unit (CPU), or an Application Specific Integrated Circuit (ASIC), or may be configured to implement one or more integrated circuits according to embodiments of the present invention.

Memory 402 may include bulk storage for data or instructions. By way of example and not limitation, the memory 402 may include a hard disk drive (HDD), a floppy disk drive, flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a Universal Serial Bus (USB) drive or two or more A combination of many of the above. Memory 402 may include removable or non-removable (or fixed) media, where appropriate. Memory 402 may be internal or external to the data processing device, where appropriate. In certain embodiments, memory 402 is non-volatile solid-state memory. In certain embodiments, memory 402 includes read-only memory (ROM). Where appropriate, the ROM may be a mask-programmed ROM, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), electrically rewritable ROM (EAROM) or flash memory or A combination of two or more of these.

The processor 401 reads and executes the computer program instructions stored in the memory 402 to implement any of the network problem analysis methods in the above embodiments.

In one example, the device for network problem analysis may also include a communication interface 403 and a bus 410. Among them, as shown in Figure 4, the processor 401, the memory 402, and the communication interface 403 are connected through the bus 410 and complete communication with each other.

The communication interface 403 is mainly used to implement communication between modules, devices, units and/or equipment in the embodiment of the present invention.

Bus 410 includes hardware, software, or both, coupling the components of the network problem analysis device to each other. By way of example, and not limitation, the bus may include Accelerated Graphics Port (AGP) or other graphics bus, Enhanced Industry Standard Architecture (EISA) bus, Front Side Bus (FSB), HyperTransport (HT) interconnect, Industry Standard Architecture (ISA) Bus, Infinite Bandwidth Interconnect, Low Pin Count (LPC) Bus, Memory Bus, Micro Channel Architecture (MCA) Bus, Peripheral Component Interconnect (PCI) Bus, PCI-Express (PCI-X) Bus, Serial Advanced Technology Attachment (SATA) bus, Video Electronics Standards Association Local (VLB) bus or other suitable bus or a combination of two or more of these. Where appropriate, bus 410 may include one or more buses. Although embodiments of the invention describe and illustrate a particular bus, the invention contemplates any suitable bus or interconnection.

In addition, combined with the network problem analysis method in the above embodiment, the embodiment of the present invention can be implemented by providing a computer-readable storage medium. Computer program instructions are stored on the computer-readable storage medium; when the computer program instructions are executed by the processor, any one of the network problem analysis methods in the above embodiments is implemented.

It is to be understood that this invention is not limited to the specific arrangements and processes described above and illustrated in the drawings. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications and additions, or change the order between steps after understanding the spirit of the present invention.

The functional blocks shown in the above structural block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it may be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, or the like. When implemented in software, elements of the invention are programs or code segments used to perform the required tasks. The program or code segments may be stored in a machine-readable medium or transmitted over a transmission medium or communications link via a data signal carried in a carrier wave. "Machine-readable medium" may include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, and the like. Code segments may be downloaded via computer networks such as the Internet, intranets, and the like.

It should also be noted that the exemplary embodiments mentioned in the present invention describe some methods or systems based on a series of steps or devices. However, the present invention is not limited to the order of the above steps. That is to say, the steps may be performed in the order mentioned in the embodiments, or may be different from the order in the embodiments, or several steps may be performed simultaneously.

The above are only specific implementations of the present invention. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the above-described systems, modules and units can be referred to the foregoing method embodiments. The corresponding process will not be described again here. It should be understood that the protection scope of the present invention is not limited thereto. Any person familiar with the technical field can easily think of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should be covered. within the protection scope of the present invention.

Claims (12)

1. A method of network problem analysis, the method comprising:

extracting data corresponding to each type of network problem; wherein the network problem comprises: a first event type problem and a first session type problem;

respectively clustering the extracted data corresponding to each type of network problem to obtain clustering data corresponding to the first event type problem and the first session type problem;

respectively matching the clustering data corresponding to the first event type problem and the first session type problem with a plurality of rule entries, and determining a final root cause corresponding to the first event type problem and the first session type problem according to the matched rule entries; wherein the rule entry includes a rule conclusion that generated a network problem;

wherein the event type problem includes a problem occurring in a short time; conversational-type problems include problems that occur over a relatively long period of time; the cluster data includes: information type, priority of information type, information subclass, and description.

2. The method of claim 1, wherein before the clustering the extracted data corresponding to each type of network problem to obtain the first event type problem and the clustered data corresponding to the first session type problem, the method further comprises:

respectively determining a first event type problem and a first session type problem according to a first time period and a second time period of occurrence of the network problem; wherein the first time period is less than the second time period.

3. The method of claim 2, wherein the information type comprises: one or more of time point, IMSI level, cell base, grid level, and large particle dimension level.

4. The method of claim 1 or 2, wherein each rule entry further comprises: rule conditions and rule priorities;

respectively matching the clustering data corresponding to the first event type problem and the first session type problem with a plurality of rule entries, and determining a final root cause corresponding to the first event type problem and the first session type problem according to the matched rule entries, wherein the method comprises the following steps:

respectively matching the first event type problem and the clustering data corresponding to the first session type problem with rule conditions included in each rule item in a plurality of rule items;

outputting the rule item with the highest rule priority in the matched rule items;

and determining the final root cause corresponding to the first event type problem and the first session type problem according to the rule entry with the highest rule priority.

5. The method of claim 4, wherein each rule entry further comprises: describing rules;

the rules describe information describing each rule entry pruning.

6. The method according to claim 4, wherein the method further comprises:

updating the rule entries.

7. The method of claim 1, wherein extracting data corresponding to each type of network problem comprises:

and extracting data corresponding to each type of network problem from one or more of Chinese mobile unified DPI, antenna engineering parameters, wireless and core node configuration parameters and wireless and core node alarm information.

8. The method of claim 7, wherein the chinese mobile unified DPI comprises: signaling plane and user information.

9. The method of claim 8, wherein the method further comprises:

and counting final root causes corresponding to the first event type problem and the first session type problem according to the user information.

10. An apparatus for network problem analysis, the apparatus comprising:

the extraction module is used for extracting data corresponding to each type of network problem; wherein the network problem comprises: a first event type problem and a first session type problem;

the clustering module is used for respectively clustering the extracted data corresponding to each type of network problem to obtain clustering data corresponding to the first event type problem and the first session type problem;

the matching module is used for respectively matching the clustering data corresponding to the first event type problem and the first session type problem with a plurality of rule items and determining a final root cause corresponding to the first event type problem and the first session type problem according to the matched rule items; wherein the rule entry includes a rule conclusion that generated a network problem;

wherein the event type problem includes a problem occurring in a short time; conversational-type problems include problems that occur over a relatively long period of time; the cluster data includes: information type, priority of information type, information subclass, and description.

11. An apparatus for network problem analysis, comprising: at least one processor, at least one memory, and computer program instructions stored in the memory, which when executed by the processor, implement the method of any one of claims 1-9.

12. A computer readable storage medium having stored thereon computer program instructions, which when executed by a processor, implement the method of any of claims 1-9.