摘要
针对大规模网络频繁告警造成的短信网关压力和核心报警延迟甚至遗漏的问题,论文改进了Apriori算法用于告警合并,以适应运维场景的实际情况,并且实现了时序关联关系数据挖掘装置。该装置通过历史告警数据抓取、模型训练和数据验证测试三个步骤完成对告警数据的合并。与传统Apriori算法不同的是,针对时序告警序列规则一对一串行的特点,该优化算法省去了迭代过程并提出了一种新的置信度计算方式,解决了频繁告警项引起的置信度计算失真的问题,提高了关联规则的可信度。实验结果表明,该装置有效合并了告警信息,减轻了短信网关的压力,为海量告警信息故障的根因定位起到了积极的作用。
In view of the problems of the SMS Gateway pressure and the core alarm delay or omission caused by large-scale frequent network alarms,the improved Apriori algorithm is proposed for alarm merging to adapt to the actual operation scenarios and further the data mining device which is based on temporal correlation is realized. The device realizes the combination of alarm data through three steps:data capture,model training and data validation test. Contrary to the traditional Apriori algorithm,the improved algorithm removes the iteration process and proposes a new confidence level calculation method, according to the one-to-one characteristic of sequential alarm rules,solving the distortion problem of computing the confidence level caused by frequent alarms,as well as improving the credibility of association rules. Experimental results show that the device effectively merges the alarm information and reduce the pressure of SMS Gateway,which contributes to the root cause location of mass alarm failure information.
出处
《计算机与数字工程》
2018年第2期260-263,269,共5页
Computer & Digital Engineering
