基于Rete规则推理的告警关联性分析

doi:10.13190/j.jbupt.2019-113

北京邮电大学学报 ›› 2020, Vol. 43 ›› Issue (2): 23-28.doi: 10.13190/j.jbupt.2019-113

基于Rete规则推理的告警关联性分析

杨杨¹, 石晓丹¹, 宋双¹, 霍永华², 陈连栋³

1. 北京邮电大学网络与交换技术国家重点实验室, 北京 100876;
2. 中国电子科技集团公司第五十四研究所, 石家庄 050000;
3. 国网河北省电力有限公司信息通信分公司, 石家庄 050022

收稿日期:2019-06-13 发布日期:2020-04-28
作者简介:杨杨(1981-),女,副教授,E-mail:yyang@bupt.edu.cn.
基金资助:
国家重点研发计划项目（2019YFB2103200）；中央高校基本科研业务费资助项目（500419319 2019PTB-019）；2018年工业互联网创新发展工程项目

Alarm Correlation Analysis Based on Rete Rule Reasoning

YANG Yang¹, SHI Xiao-dan¹, SONG Shuang¹, HUO Yong-hua², CHEN Lian-dong³

1. State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing 100876, China;
2. The 54 th Research Institute of CETC, Shijiazhuang 050000, China;
3. State Grid Hebei Electric Power Company Limited Information and Telecommunication Branch, Shijiazhuang 050022, China

Received:2019-06-13 Published:2020-04-28

摘要/Abstract

摘要： 针对现有规则推理算法无法实现在当前大规模复杂多变的网络环境中准确、实时地推理告警规则的问题，提出了一种改进的规则推理算法Im_Rete.该算法结合网络告警数据的特点，采用面向告警缺失的模糊推理策略和基于概率关联模型的事实传播策略，在提高推理准确性的同时平衡推理速度，能够更加有效地对告警进行关联分析.通过仿真实验进行对比分析，结果表明Im_Rete算法在推理速度和准确性方面均具有较好的性能.

关键词: 告警, 关联性, 规则推理, 模糊逻辑

Abstract: With the continuous development of networks, alarm correlation analysis has received extensive attention as an important means of fault diagnosis. However, in a complex network environment, problems such as link interruption, congestion caused by network faults may result in the loss of alarm data, and the amount of transient alarms caused by fault propagation may be massive. These problems make existing rule-based reasoning algorithms are difficult to meet the accuracy and real-time requirements of root cause alarm reasoning. The algorithm based on the characteristics of network alarm uses fuzzy logic-based reasoning strategies and fact-based communication strategies based on probabilistic association models to balance the speed of reasoning while improving the accuracy of reasoning. The algorithm can more effectively correlate alarms. Finally, through simulation experiments, the experimental results show that the Im_Rete algorithm has better performance in terms of speed and accuracy.

Key words: alarm, correlation, rule reasoning, fuzzy logic

中图分类号:

TP393.0

杨杨, 石晓丹, 宋双, 霍永华, 陈连栋. 基于Rete规则推理的告警关联性分析[J]. 北京邮电大学学报, 2020, 43(2): 23-28.

YANG Yang, SHI Xiao-dan, SONG Shuang, HUO Yong-hua, CHEN Lian-dong. Alarm Correlation Analysis Based on Rete Rule Reasoning[J]. Journal of Beijing University of Posts and Telecommunications, 2020, 43(2): 23-28.

参考文献

[1] Forgy C L. Rete:a fast algorithm for the many pattern/many object pattern match problem[J]//Expert systems. IEEE Computer Society Press, 1991:547-559.
[2] 李文璟, 王智立. 网络管理原理及技术[M]. 北京:人民邮电出版社, 2008.
[3] Xiaodong G, Yang G, Jun H. Rete algorithm:current issues and future challenge[J]. Computer Science, IEEE, 2012, 39(11):8-12.
[4] 顾小东. 基于Rete算法的大规模规则推理引擎研究与应用[D]. 南京:南京大学, 2013.
[5] 王瑞. 规则推理在故障诊断中的应用研究[D]. 福州:福州大学, 2013.
[6] Sottara D, Mello P, Proctor M. A configurable Rete-OO engine for reasoning with different types of imperfect information[J]. IEEE Transactions on Knowledge & Data Engineering, 2010, 22(11):1535-1548.
[7] Xiao D, Zhong X. Improving Rete algorithm to enhance performance of rule engine systems[C]//International Conference on Computer Design and Applications.[S. l.]:IEEE, 2010:572-575.
[8] Cheng L W, Xin W. Distributed Rete algorithm in smart environment[J]. Journal of Computer Applications, 2016, 36(7):1893-1898.
[9] Sun X, Yan X M, Shang Y M, et al. An improved Rete algorithm using shared degree model[J]. Acta Automatica Sinica, 2017, 43(9):1571-1579.
[10] Guo C, Xiong W, Hao L. An improved Rete algorithm with branch filtration[J]. Procedia Engineering, 2017, 174:767-772.
[11] Yao J. An efficient approach for rule matching in production system based on multi-agent[C]//International Conference on Systems and Informatics.[S. l.]:IEEE, 2017:378-381.
[12] Guo J Y, Hwang C, Chen M S. Using GPU to shorten the match time of rule reasoning based on Rete algorithm[C]//International Symposium on Computer, Consumer and Control.[S. l.]:IEEE, 2016:883-886.
[13] Zhang Y H. Design and implementation of telecommunication network alarm analysis based on big data technology association[J]. Telecom Engineering Technics and Standardization, 2016, 29(4):18-23.
[14] Huang Q. Research on alarm correlation analysis model of IT centralized monitoring system[J]. Science and technology products, 2017(5):179-179.
[15] Qu G X. Research and practice on correlation analysis technology based on fuzzy scene[J]. Wireless Internet Technology, 2016(14):115-118.
[16] Zhao N, Bai L F. Research of the rule engine based on XML[J]. AER-Advances in Engineering Research, 2016, 67:1787-1793.
[17] 刘珍. 多域分布式网络的告警模糊关联规则挖掘[D]. 成都;电子科技大学, 2015.

基于Rete规则推理的告警关联性分析

Alarm Correlation Analysis Based on Rete Rule Reasoning

PDF

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 15

编辑推荐

Metrics

本文评价

[1]	高月红, 杨昊天, 陈露, 杨鸿文, 尹宁. 基于模糊逻辑的eMBB/URLLC复用机制选择算法[J]. 北京邮电大学学报, 2021, 44(3): 15-20,34.
[2]	彭聪, 孙岩, 戚鹏. 基于标签关联性的多标签Scratch分类算法[J]. 北京邮电大学学报, 2019, 42(6): 134-141.
[3]	陈墨, 金磊, 龚向阳, 满毅. 面向5G海量网管数据的故障溯源技术[J]. 北京邮电大学学报, 2018, 41(5): 131-136,142.
[4]	饶志宏, 徐锐, 刘方, 杨春亮, 方恩博. 基于改进隐马尔可夫模型的复合攻击预测方法[J]. 北京邮电大学学报, 2017, 40(s1): 15-19.
[5]	王茜, 高志鹏, 邱雪松, 王兴斌. 基于频繁项挖掘的空间关联性子簇形成算法[J]. 北京邮电大学学报, 2015, 38(s1): 20-23.
[6]	袁俊，王莹，张平. 单业务多连接承载方式下的业务分割方法[J]. 北京邮电大学学报, 2011, 34(s1): 73-76.
[7]	徐前方,肖波,郭军. 挖掘电信告警关联模式方法[J]. 北京邮电大学学报, 2011, 34(2): 85-89.
[8]	龙门,夏靖波,张子阳,郭戎潇. 节点相关的隐马尔可夫模型的网络安全评估[J]. 北京邮电大学学报, 2010, 33(6): 121-124.
[9]	陈兴渝;钟朝亮. 基于Web的告警实时显示系统的设计与实现[J]. 北京邮电大学学报, 2009, 32(s1): 115-119.
[10]	武斌, 郑康锋, 杨义先. Honeynet中的告警日志分析[J]. 北京邮电大学学报, 2008, 31(6): 63-66.
[11]	张龙1, 刘民2，吴澄2. 求解较大规模JSSP的自适应混合遗传算法[J]. 北京邮电大学学报, 2007, 30(6): 5-9.
[12]	王朝翔1,2，苗建松2，丁炜2. 模糊逻辑控制的MAC协议[J]. 北京邮电大学学报, 2007, 30(6): 131-134.
[13]	邹卫霞1，聂晶1,2，周正1. 一种基于模糊逻辑的安全Ad hoc路由协议[J]. 北京邮电大学学报, 2006, 29(6): 111-114.
[14]	邓歆，孟洛明. 告警相关性分析模型在通信网故障诊断中的应用[J]. 北京邮电大学学报, 2006, 29(3): 66-69.
[15]	张岗山, 李建东, 吴宇红. 基于SNMP故障管理中的告警振荡和[J]. 北京邮电大学学报, 2004, 27(6): 31-35.