| With the continuous development of networks,alarm correlation analysis has received extensive attention as an important means of fault diagnosis.The analysis can filter,merge,transform the alarms before the network administrator processes the data,and discover the root alarm that reflects the nature of the fault,helping the administrator to locate the fault in a timely and accurate manner.The alarm correlation analysis method based on rule reasoning has been widely used because of its intuitive expression,flexibility and easy understanding.However,in the existing alarm correlation analysis system,the rules are mostly from expert knowledge,the acquisition of rules is limited.So data mining technology is used to obtain association rules from historical alarms to break through the limitation of rule bottleneck.However,the existing association rule mining algorithms mostly have the problems of repeatedly scanning the database,large search space and high time consumption.Secondly,due to the complex environment in the actual network,the problem of missing alarms caused by link data interruption,congestion,etc.and the problem of alarm storm caused by fault propagation make the existing Rete inference engine difficult to meet the accuracy and real-time requirements of root alarm reasoning.Aiming at the above problems,this paper proposes an improved association rule mining algorithm Im_Eclat and an improved rule inference algorithm Im_Rete.Aiming at the problems that need to scan the database multiple times,the search space is large,and the time consumption is high in the existing association rules mining algorithms,Im_Eclat adopts vertical data representation,scans the database once and reduces I/O overhead greatly.In addition,Im_Eclat adopts a layer-based pruning strategy and a strategy based on Tidset data compression.While reducing the candidate search space,the AND operation is used instead of the set operation to solve the common Tidset of the two nodes.The simulation results show that the algorithm can effectively improve the time performance of association rules mining.Furthermore,in view of the lack of alarms caused by network failures and alarm storms,Im_Rete adopts fuzzy reasoning strategy for alarm missing,and a propagation strategy based on probabilistic association model,performs a certain approximation of the inference process.The algorithm improves the inference speed while improving the fault tolerance of reasoning,to better adapt to the real-time and accuracy requirements of root alarm reasoning.The simulation results show that the proposed algorithm can effectively improve the efficiency of alarm correlation analysis.Based on the improved association rule-mining algorithm Im_Eclat and the improved rule inference algorithm Im_Rete,this paper designs and implements the alarm correlation analysis subsystem based on Rete rule reasoning.The system mainly includes a data-preprocessing module,an association rule module,an alarm query module and a root alarm-reasoning module.The data-preprocessing module implements filtering,and formatting of the original data.The association rule module implements the mining and the management of association rules.The alarm query module implements the monitoring of real-time alarms and the management of historical alarms.The root alarm-reasoning module implements real-time reasoning and presentation of root alarms.The system test results show that the subsystem can perform data pre-processing,association rule mining,rule management,real-time alarm query,historical alarm management,and root alarm real-time reasoning.The system can effectively filter and compress a large number of redundant alarms before the administrator processes alarms,helping them to locate the fault in a timely and accurate manner. |
