基于模糊關聯(lián)規(guī)則的網(wǎng)絡故障診斷研究
發(fā)布時間：2018-09-05 11:16
【摘要】：當網(wǎng)絡節(jié)點因為異�；蛘吖收闲纬删W(wǎng)絡告警時,往往其周邊的網(wǎng)絡節(jié)點也會有相當數(shù)量的網(wǎng)絡告警出現(xiàn),這些告警信息之間往往存在著某種相關性。如何找到這些告警的相關性,從而準確地定位根源告警是網(wǎng)絡故障診斷的核心重點,也是難點。最初,專家系統(tǒng)在網(wǎng)絡故障診斷中得到了廣泛的研究與應用,但其在知識庫建立和自學習上存在不足。隨著數(shù)據(jù)挖掘技術在各個研究領域的廣泛應用,并且取得了大量的研究成果,于是相關研究人員嘗試著在網(wǎng)絡故障診斷領域內(nèi)探索其應用,大量研究了基于關聯(lián)規(guī)則挖掘的網(wǎng)絡故障診斷技術,將專家系統(tǒng)和數(shù)據(jù)挖掘技術結(jié)合起來,從而解決知識和自學習問題,最終獲得了較大的成功。雖然在網(wǎng)絡故障診斷中引入關聯(lián)規(guī)則挖掘,取得了較大的成功,但是仍然存在一些不足之處:一方面,由于網(wǎng)絡告警和網(wǎng)絡告警根源之間存在著一種模糊關系,并非簡單的確定性映射關系,而在此之前的處理方法忽略了這一點,僅僅是強硬劃分網(wǎng)絡告警和網(wǎng)絡告警根源之間的對應關系,這勢必會對后期的網(wǎng)絡根源告警定位診斷的準確性產(chǎn)生一定的影響。另一方面,因為網(wǎng)絡具有分層的特點,所以網(wǎng)絡告警在進行傳播的過程中受到網(wǎng)絡分層的影響,先前的方法未曾考慮到網(wǎng)絡告警和網(wǎng)絡各層次間的關系。與此同時,由于網(wǎng)絡設備供應商的不同,網(wǎng)絡設備產(chǎn)生的網(wǎng)絡告警在內(nèi)容和格式上存在一定的差異,在一定程度上影響了網(wǎng)絡告警相關性分析。此外,因為基于關聯(lián)規(guī)則挖掘算法所處理的數(shù)據(jù)對象必須是事務化的數(shù)據(jù),所以如果需要對網(wǎng)絡告警信息進行關聯(lián)規(guī)則挖掘,就需要事先對相關的數(shù)據(jù)進行處理。針對上述問題,本文在關聯(lián)規(guī)則挖掘技術的基礎之上,結(jié)合相關的模糊理論和模糊推理控制技術,研究了基于模糊關聯(lián)規(guī)則挖掘的網(wǎng)絡告警根源診斷,論文的主要內(nèi)容有如下幾點:1.針對網(wǎng)絡告警信息之間的不確定性以及信息的不統(tǒng)一,需要建立統(tǒng)一的全局網(wǎng)絡告警信息模型:分析網(wǎng)絡告警中各個屬性字段的含義,以及網(wǎng)絡告警中存在的不確定性,依據(jù)網(wǎng)絡告警的特征和相關的規(guī)則提取并量化關鍵屬性,建立網(wǎng)絡告警信息模型。同時為了體現(xiàn)告警受網(wǎng)絡層次的影響,引入告警類型屬性Alarm Type,并對各個層次的告警進行細分羅列編號,本文將網(wǎng)絡分為三層。2.針對傳統(tǒng)的模糊聚類算法FCM在進行網(wǎng)絡告警信息模糊化處理時,由于聚類中心是通過隨機初始化生成,使得聚類中心取值不合理,從而容易導致算法陷入局部最優(yōu)以及模糊網(wǎng)絡告警的模糊評價區(qū)間不一致的問題。為此,通過對初始化聚類中心矩陣的生成策略進行改進,從而優(yōu)化FCM算法。利用改進的FCM,對網(wǎng)絡告警進行模糊化處理,最終形成模糊化告警模型。通過引入的模糊隸屬度來描述網(wǎng)絡告警之間的模糊性關系,從而有別于傳統(tǒng)的布爾型邏輯表示。3.由于本文是基于模糊關聯(lián)規(guī)則進行規(guī)則挖掘分析網(wǎng)絡告警,但是關聯(lián)規(guī)則挖掘算法處理的數(shù)據(jù)對象要求是事務化的數(shù)據(jù),所以需要事先對前面獲得的模糊化網(wǎng)絡告警進行事務化處理。本文擬通過滑動窗口機制進行事務化處理,以滿足規(guī)則挖掘分析的需要,形成模糊告警事務庫。4.針對在模糊關聯(lián)規(guī)則挖掘過程中,隨著向高次項頻繁集進行挖掘,會出現(xiàn)模糊支持度計數(shù)驟減的現(xiàn)象,如果仍然采用靜態(tài)的最小支持度F_MIN_SUP,就會使得部分頻繁項被遺漏,從而丟失部分強關聯(lián)規(guī)則。為此,本文引入動態(tài)更新最小支持度的思想,實現(xiàn)DFARM(動態(tài)最小支持度模糊關聯(lián)規(guī)則挖掘)算法。最后,結(jié)合布爾型關聯(lián)規(guī)則挖掘算法BARM,通過模糊化和非模糊化兩種告警事務庫進行實驗仿真,進行性能對比分析,突出硬劃分問題。5.詳細研究分析模糊推理模塊的各個重要組成部分,著重分析了正向推理驅(qū)動策略和反向推理驅(qū)動策略,以及反模糊化對推理結(jié)果的解釋。最終通過相關的實驗,進行各種推理組合的性能測試,最后獲得最優(yōu)的推理組合模糊匹配算子Hamming和合成方法Trip-I,配合正向推理驅(qū)動策略。最終通過測試,可以準確對網(wǎng)絡故障告警的根源節(jié)點進行定位。
[Abstract]:When a network alarm is formed by abnormal or faulty network nodes, a considerable number of network alarms will appear in the network nodes around the network nodes, and there is often some correlation between these alarm information. Initially, expert system has been widely studied and applied in network fault diagnosis, but it has some shortcomings in knowledge base building and self-learning. With the wide application of data mining technology in various research fields, and has made a lot of research results, so related researchers try to network fault diagnosis field. In order to solve the problem of knowledge and self-learning, a great deal of network fault diagnosis technology based on association rule mining is studied. The expert system and data mining technology are combined to solve the problem of knowledge and self-learning. Finally, the application of association rule mining in network fault diagnosis is successful, but it still exists. There are some shortcomings: on the one hand, because there is a fuzzy relationship between network alarm and the root of network alarm, it is not a simple deterministic mapping relationship, but the previous processing methods neglected this point, only a hard division of the corresponding relationship between network alarm and the root of network alarm, which is bound to later network. On the other hand, network alarms are affected by network layering because of the layered nature of the network. Previous methods have not considered the relationship between network alarms and network layers. Similarly, there are some differences in content and format of network alarms produced by network devices, which affect the correlation analysis of network alarms to a certain extent. In view of the above problems, this paper, on the basis of association rules mining technology, combines fuzzy theory and fuzzy inference control technology, studies the diagnosis of network alarm roots based on fuzzy association rules mining. The main contents of this paper are as follows: 1. It is necessary to establish a unified global network alarm information model because of the uncertainty and inconsistency of the information between the two alarms. It analyzes the meaning of each attribute field in the network alarm and the uncertainty in the network alarm. It extracts and quantifies the key attributes according to the characteristics of the network alarm and relevant rules, and establishes the network alarm information model. In order to show that alarms are affected by network hierarchy, the Alarm Type is introduced and the alarms of each hierarchy are subdivided into three layers. 2. For the traditional fuzzy clustering algorithm FCM, the clustering center is generated by random initialization, which makes the network alarm information fuzzy. The unreasonable value of clustering center leads to the problem that the algorithm falls into local optimum and the fuzzy evaluation interval of fuzzy network alarm is inconsistent. To this end, the FCM algorithm is optimized by improving the generation strategy of the initial clustering center matrix. The network alarm is fuzzified by the improved FCM, and the model is finally formed. Fuzzy membership is introduced to describe the fuzzy relationship between network alarms, which is different from the traditional Boolean logic representation. 3. Because this paper is based on fuzzy association rules for rule mining and analysis of network alarms, but association rules mining algorithm processing data objects require transactional data. In order to satisfy the requirement of rule mining and analysis, a fuzzy alarm transaction database is formed. 4. In the process of mining fuzzy association rules, the fuzzy alarm transaction database will appear when mining frequent sets of high-order items. If the static minimum support F_MIN_SUP is still used, some frequent items will be omitted and some strong association rules will be lost. Therefore, the idea of dynamic updating minimum support is introduced to realize DFARM (dynamic minimum support fuzzy association rules mining). Finally, the Boolean algorithm is combined. Association rules mining algorithm BARM, through fuzzy and non-fuzzy alarm transaction database for experimental simulation, performance comparison analysis, highlighting the hard partitioning problem. 5. Detailed study and analysis of the important components of fuzzy reasoning module, focusing on the analysis of forward reasoning driving strategy and backward reasoning driving strategy, as well as anti-fuzzy reasoning strategy. Finally, through the relevant experiments, the performance of various combinations of reasoning is tested. Finally, the optimal combinations of reasoning fuzzy matching operator Hamming and synthesis method Trip-I are obtained, which are combined with the forward reasoning driving strategy. Finally, through the test, the root node of network fault alarm can be accurately located.
【學位授予單位】：江西農(nóng)業(yè)大學
【學位級別】：碩士
【學位授予年份】：2017
【分類號】：TP311.13;TP393.06
本文編號：2224108
[Abstract]:When a network alarm is formed by abnormal or faulty network nodes, a considerable number of network alarms will appear in the network nodes around the network nodes, and there is often some correlation between these alarm information. Initially, expert system has been widely studied and applied in network fault diagnosis, but it has some shortcomings in knowledge base building and self-learning. With the wide application of data mining technology in various research fields, and has made a lot of research results, so related researchers try to network fault diagnosis field. In order to solve the problem of knowledge and self-learning, a great deal of network fault diagnosis technology based on association rule mining is studied. The expert system and data mining technology are combined to solve the problem of knowledge and self-learning. Finally, the application of association rule mining in network fault diagnosis is successful, but it still exists. There are some shortcomings: on the one hand, because there is a fuzzy relationship between network alarm and the root of network alarm, it is not a simple deterministic mapping relationship, but the previous processing methods neglected this point, only a hard division of the corresponding relationship between network alarm and the root of network alarm, which is bound to later network. On the other hand, network alarms are affected by network layering because of the layered nature of the network. Previous methods have not considered the relationship between network alarms and network layers. Similarly, there are some differences in content and format of network alarms produced by network devices, which affect the correlation analysis of network alarms to a certain extent. In view of the above problems, this paper, on the basis of association rules mining technology, combines fuzzy theory and fuzzy inference control technology, studies the diagnosis of network alarm roots based on fuzzy association rules mining. The main contents of this paper are as follows: 1. It is necessary to establish a unified global network alarm information model because of the uncertainty and inconsistency of the information between the two alarms. It analyzes the meaning of each attribute field in the network alarm and the uncertainty in the network alarm. It extracts and quantifies the key attributes according to the characteristics of the network alarm and relevant rules, and establishes the network alarm information model. In order to show that alarms are affected by network hierarchy, the Alarm Type is introduced and the alarms of each hierarchy are subdivided into three layers. 2. For the traditional fuzzy clustering algorithm FCM, the clustering center is generated by random initialization, which makes the network alarm information fuzzy. The unreasonable value of clustering center leads to the problem that the algorithm falls into local optimum and the fuzzy evaluation interval of fuzzy network alarm is inconsistent. To this end, the FCM algorithm is optimized by improving the generation strategy of the initial clustering center matrix. The network alarm is fuzzified by the improved FCM, and the model is finally formed. Fuzzy membership is introduced to describe the fuzzy relationship between network alarms, which is different from the traditional Boolean logic representation. 3. Because this paper is based on fuzzy association rules for rule mining and analysis of network alarms, but association rules mining algorithm processing data objects require transactional data. In order to satisfy the requirement of rule mining and analysis, a fuzzy alarm transaction database is formed. 4. In the process of mining fuzzy association rules, the fuzzy alarm transaction database will appear when mining frequent sets of high-order items. If the static minimum support F_MIN_SUP is still used, some frequent items will be omitted and some strong association rules will be lost. Therefore, the idea of dynamic updating minimum support is introduced to realize DFARM (dynamic minimum support fuzzy association rules mining). Finally, the Boolean algorithm is combined. Association rules mining algorithm BARM, through fuzzy and non-fuzzy alarm transaction database for experimental simulation, performance comparison analysis, highlighting the hard partitioning problem. 5. Detailed study and analysis of the important components of fuzzy reasoning module, focusing on the analysis of forward reasoning driving strategy and backward reasoning driving strategy, as well as anti-fuzzy reasoning strategy. Finally, through the relevant experiments, the performance of various combinations of reasoning is tested. Finally, the optimal combinations of reasoning fuzzy matching operator Hamming and synthesis method Trip-I are obtained, which are combined with the forward reasoning driving strategy. Finally, through the test, the root node of network fault alarm can be accurately located.
【學位授予單位】：江西農(nóng)業(yè)大學
【學位級別】：碩士
【學位授予年份】：2017
【分類號】：TP311.13;TP393.06
【參考文獻】
相關期刊論文 前10條
1 魏念忠;;基于模糊關聯(lián)規(guī)則挖掘的網(wǎng)絡入侵檢測研究[J];微電子學與計算機;2008年09期
2 張東波;王耀南;;FCM聚類算法和粗糙集在醫(yī)療圖像分割中的應用[J];儀器儀表學報;2006年12期
3 李洪興;;Fuzzy系統(tǒng)的概率表示[J];中國科學E輯:信息科學;2006年04期
4 尤飛,馮艷賓,王加銀,李洪興;模糊蘊涵算子及其構(gòu)造(Ⅱ)——模糊蘊涵算子的伴隨對及其圈乘算子[J];北京師范大學學報(自然科學版);2004年02期
5 沈海瀾,王加陽,蔣外文,陳再良;模糊關聯(lián)規(guī)則挖掘在電力負荷預測中的應用[J];計算機工程;2003年15期
6 陳建明,張仲義;模糊方法在信息系統(tǒng)評價中的應用[J];中國管理科學;2000年01期
7 王國俊;模糊推理的一個新方法[J];模糊系統(tǒng)與數(shù)學;1999年03期
8 王國俊;模糊推理的全蘊涵三I算法[J];中國科學E輯:技術科學;1999年01期
9 李洪興;從模糊控制的數(shù)學本質(zhì)看模糊邏輯的成功──關于“關于模糊邏輯似是而非的爭論”的似是而非的介入[J];模糊系統(tǒng)與數(shù)學;1995年04期
10 汪培莊，李洪興;fuzzy計算機的設計思想（Ⅰ）[J];北京師范大學學報(自然科學版);1995年02期
相關博士學位論文 前1條
1 吳簡;面向業(yè)務的基于模糊關聯(lián)規(guī)則挖掘的網(wǎng)絡故障診斷[D];電子科技大學;2012年
相關碩士學位論文 前6條
1 劉盼;基于多層模糊關聯(lián)規(guī)則挖掘的網(wǎng)絡告警相關性分析[D];電子科技大學;2013年
2 袁靜;面向設備故障診斷的數(shù)據(jù)挖掘關鍵技術研究與實現(xiàn)[D];西安電子科技大學;2012年
3 羅紅偉;基于數(shù)據(jù)挖掘的移動網(wǎng)絡故障檢測系統(tǒng)[D];天津理工大學;2011年
4 王文熙;模糊關聯(lián)規(guī)則挖掘算法的研究與應用[D];國防科學技術大學;2010年
5 李佳;增量式優(yōu)化關聯(lián)規(guī)則算法研究及應用[D];江蘇科技大學;2010年
6 王連波;模糊推理在網(wǎng)絡故障診斷中的應用研究[D];電子科技大學;2007年
，本文編號：2224108
本文鏈接：http://sikaile.net/guanlilunwen/ydhl/2224108.html
最近更新
教材專著
