基于模糊关联规则的网络故障诊断研究

发布时间：2018-09-05 11:16

【摘要】：当网络节点因为异常或者故障形成网络告警时,往往其周边的网络节点也会有相当数量的网络告警出现,这些告警信息之间往往存在着某种相关性。如何找到这些告警的相关性,从而准确地定位根源告警是网络故障诊断的核心重点,也是难点。最初,专家系统在网络故障诊断中得到了广泛的研究与应用,但其在知识库建立和自学习上存在不足。随着数据挖掘技术在各个研究领域的广泛应用,并且取得了大量的研究成果,于是相关研究人员尝试着在网络故障诊断领域内探索其应用,大量研究了基于关联规则挖掘的网络故障诊断技术,将专家系统和数据挖掘技术结合起来,从而解决知识和自学习问题,最终获得了较大的成功。虽然在网络故障诊断中引入关联规则挖掘,取得了较大的成功,但是仍然存在一些不足之处:一方面,由于网络告警和网络告警根源之间存在着一种模糊关系,并非简单的确定性映射关系,而在此之前的处理方法忽略了这一点,仅仅是强硬划分网络告警和网络告警根源之间的对应关系,这势必会对后期的网络根源告警定位诊断的准确性产生一定的影响。另一方面,因为网络具有分层的特点,所以网络告警在进行传播的过程中受到网络分层的影响,先前的方法未曾考虑到网络告警和网络各层次间的关系。与此同时,由于网络设备供应商的不同,网络设备产生的网络告警在内容和格式上存在一定的差异,在一定程度上影响了网络告警相关性分析。此外,因为基于关联规则挖掘算法所处理的数据对象必须是事务化的数据,所以如果需要对网络告警信息进行关联规则挖掘,就需要事先对相关的数据进行处理。针对上述问题,本文在关联规则挖掘技术的基础之上,结合相关的模糊理论和模糊推理控制技术,研究了基于模糊关联规则挖掘的网络告警根源诊断,论文的主要内容有如下几点:1.针对网络告警信息之间的不确定性以及信息的不统一,需要建立统一的全局网络告警信息模型:分析网络告警中各个属性字段的含义,以及网络告警中存在的不确定性,依据网络告警的特征和相关的规则提取并量化关键属性,建立网络告警信息模型。同时为了体现告警受网络层次的影响,引入告警类型属性Alarm Type,并对各个层次的告警进行细分罗列编号,本文将网络分为三层。2.针对传统的模糊聚类算法FCM在进行网络告警信息模糊化处理时,由于聚类中心是通过随机初始化生成,使得聚类中心取值不合理,从而容易导致算法陷入局部最优以及模糊网络告警的模糊评价区间不一致的问题。为此,通过对初始化聚类中心矩阵的生成策略进行改进,从而优化FCM算法。利用改进的FCM,对网络告警进行模糊化处理,最终形成模糊化告警模型。通过引入的模糊隶属度来描述网络告警之间的模糊性关系,从而有别于传统的布尔型逻辑表示。3.由于本文是基于模糊关联规则进行规则挖掘分析网络告警,但是关联规则挖掘算法处理的数据对象要求是事务化的数据,所以需要事先对前面获得的模糊化网络告警进行事务化处理。本文拟通过滑动窗口机制进行事务化处理,以满足规则挖掘分析的需要,形成模糊告警事务库。4.针对在模糊关联规则挖掘过程中,随着向高次项频繁集进行挖掘,会出现模糊支持度计数骤减的现象,如果仍然采用静态的最小支持度F_MIN_SUP,就会使得部分频繁项被遗漏,从而丢失部分强关联规则。为此,本文引入动态更新最小支持度的思想,实现DFARM(动态最小支持度模糊关联规则挖掘)算法。最后,结合布尔型关联规则挖掘算法BARM,通过模糊化和非模糊化两种告警事务库进行实验仿真,进行性能对比分析,突出硬划分问题。5.详细研究分析模糊推理模块的各个重要组成部分,着重分析了正向推理驱动策略和反向推理驱动策略,以及反模糊化对推理结果的解释。最终通过相关的实验,进行各种推理组合的性能测试,最后获得最优的推理组合模糊匹配算子Hamming和合成方法Trip-I,配合正向推理驱动策略。最终通过测试,可以准确对网络故障告警的根源节点进行定位。
[Abstract]:When a network alarm is formed by abnormal or faulty network nodes, a considerable number of network alarms will appear in the network nodes around the network nodes, and there is often some correlation between these alarm information. Initially, expert system has been widely studied and applied in network fault diagnosis, but it has some shortcomings in knowledge base building and self-learning. With the wide application of data mining technology in various research fields, and has made a lot of research results, so related researchers try to network fault diagnosis field. In order to solve the problem of knowledge and self-learning, a great deal of network fault diagnosis technology based on association rule mining is studied. The expert system and data mining technology are combined to solve the problem of knowledge and self-learning. Finally, the application of association rule mining in network fault diagnosis is successful, but it still exists. There are some shortcomings: on the one hand, because there is a fuzzy relationship between network alarm and the root of network alarm, it is not a simple deterministic mapping relationship, but the previous processing methods neglected this point, only a hard division of the corresponding relationship between network alarm and the root of network alarm, which is bound to later network. On the other hand, network alarms are affected by network layering because of the layered nature of the network. Previous methods have not considered the relationship between network alarms and network layers. Similarly, there are some differences in content and format of network alarms produced by network devices, which affect the correlation analysis of network alarms to a certain extent. In view of the above problems, this paper, on the basis of association rules mining technology, combines fuzzy theory and fuzzy inference control technology, studies the diagnosis of network alarm roots based on fuzzy association rules mining. The main contents of this paper are as follows: 1. It is necessary to establish a unified global network alarm information model because of the uncertainty and inconsistency of the information between the two alarms. It analyzes the meaning of each attribute field in the network alarm and the uncertainty in the network alarm. It extracts and quantifies the key attributes according to the characteristics of the network alarm and relevant rules, and establishes the network alarm information model. In order to show that alarms are affected by network hierarchy, the Alarm Type is introduced and the alarms of each hierarchy are subdivided into three layers. 2. For the traditional fuzzy clustering algorithm FCM, the clustering center is generated by random initialization, which makes the network alarm information fuzzy. The unreasonable value of clustering center leads to the problem that the algorithm falls into local optimum and the fuzzy evaluation interval of fuzzy network alarm is inconsistent. To this end, the FCM algorithm is optimized by improving the generation strategy of the initial clustering center matrix. The network alarm is fuzzified by the improved FCM, and the model is finally formed. Fuzzy membership is introduced to describe the fuzzy relationship between network alarms, which is different from the traditional Boolean logic representation. 3. Because this paper is based on fuzzy association rules for rule mining and analysis of network alarms, but association rules mining algorithm processing data objects require transactional data. In order to satisfy the requirement of rule mining and analysis, a fuzzy alarm transaction database is formed. 4. In the process of mining fuzzy association rules, the fuzzy alarm transaction database will appear when mining frequent sets of high-order items. If the static minimum support F_MIN_SUP is still used, some frequent items will be omitted and some strong association rules will be lost. Therefore, the idea of dynamic updating minimum support is introduced to realize DFARM (dynamic minimum support fuzzy association rules mining). Finally, the Boolean algorithm is combined. Association rules mining algorithm BARM, through fuzzy and non-fuzzy alarm transaction database for experimental simulation, performance comparison analysis, highlighting the hard partitioning problem. 5. Detailed study and analysis of the important components of fuzzy reasoning module, focusing on the analysis of forward reasoning driving strategy and backward reasoning driving strategy, as well as anti-fuzzy reasoning strategy. Finally, through the relevant experiments, the performance of various combinations of reasoning is tested. Finally, the optimal combinations of reasoning fuzzy matching operator Hamming and synthesis method Trip-I are obtained, which are combined with the forward reasoning driving strategy. Finally, through the test, the root node of network fault alarm can be accurately located.
【学位授予单位】：江西农业大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP311.13;TP393.06

【参考文献】