Novel alarm correlation analysis system based on association rules mining in telecommunication networks

Alarm correlation analysis system is an useful method and tool for analyzing alarms and finding the root cause of faults in telecommunication networks. Recently, the application of association rules mining becomes an important research area in alarm correlation analysis.In this paper, we propose a novel Association Rules Mining based Alarm Correlation Analysis System (ARM-ACAS) to find interesting association rules between alarm events. In order to mine some infrequent but important items, ARM-ACAS first uses neural network to classify the alarms with different levels. In addition, ARM-ACAS also exploits an optimization technique with the weighted frequent pattern tree structure to improve the mining efficiency. The system is both efficient and practical in discovering significant relationships of alarms as illustrated by experiments performed on simulated and real-world datasets.     

一种基于关联规则的分布式入侵检测模型

高虚警率和漏警率是当前入侵检测系统(IDS)的主要问题。采用基于CBW关联规则的数据挖掘算法,提出了一种新的分布式入侵检测模型,并分析了各模块的具体功能与实现。经实验分析,本模型可以有效降低虚警率和漏警率,同时在一定程度上实现各分节点间的快速协作检测能力。     

无项头表的FP-Growth算法

针对FP-Growth算法中频繁模式树的遍历低效问题,提出了一种无项头表的频繁模式增长算法。该算法利用递归回溯的方式遍历频繁模式树以求取条件模式基,解决了对同一树路径多次重复遍历的问题。从理论分析和实际挖掘能力两方面,将新算法与FP-Growth算法进行了对比。结果表明,新算法有效减少了条件模式基的搜索开销,使频繁模式挖掘的效率提高了2~5倍,在时间和空间性能上均优于FP-Growth算法。将该算法应用于通信告警关联规则挖掘,较快地挖掘出了关联规则结果,且正确规则的覆盖率达到了83.3%。     

基于关联规则的通信网络告警相关性分析模型

在通信网络运行过程中．每天都会产生大量告警，将数据挖掘中的关联规则发现技术用于分析历史告警数据，可发现告警相关性规则。这些规则可辅助故障定位和告警过滤，以减轻网络管理员的工作强度，提高工作效率。本文分析了通信网络原始告警信息的特点，提出了一个基于关联规则的通信网络告警相关性分析模型，该模型通遏对原始告警数据进行预处理，不仅有效地解决了网络告警时间不同步问题，使得处理后的告警数据可直接用一般的关联规则挖掘工具发现告警相关规则，还大大地压缩了挖掘结果，提高了规则的准确率。初步的实验表明这种分析模型具有实用价值。     

Interactive exploration of interesting findings in the Telecommunication Network Alarm Sequence Analyzer (TASA)

In this paper we describe the final version of a knowledge discovery system, Telecommunication Network Alarm Sequence Analyzer (TASA), for telecommunication networks alarm data analysis. The system is based on the discovery of recurrent, temporal patterns of alarms in databases; these patterns, episode rules, can be used in the construction of real-time alarm correlation systems. Also association rules are used for identifying relationships between alarm properties. TASA uses a methodology for knowledge discovery in databases (KDD) where one first discovers large collections of patterns at once, and then performs interactive retrievals from the collection of patterns. The proposed methodology suits very well such KDD formalisms as association and episode rules, where large collections of potentially interesting rules can be found efficiently. When searching for the most interesting rules, simple threshold-like restrictions, such as rule frequency and confidence may satisfy a large number of rules. In TASA, this problem can be alleviated by templates and pattern expressions that describe the form of rules that are to be selected or rejected. Using templates the user can flexibly specify the focus of interest, and also iteratively refine it. Different versions of TASA have been in prototype use in four telecommunication companies since the beginning of 1995. TASA has been found useful in, e.g. finding long-term, rather frequently occurring dependencies, creating an overview of a short-term alarm sequence, and evaluating the alarm data base consistency and correctness.     

多维频繁情节挖掘在电信告警信息分析中的应用

电信网络每天都要产生大量的告警信息,这些信息中隐藏着网络结构相关的有用知识。基于对电信网络告警信息的特点的分析和针对现有挖掘方式的不足,论文提出一种从电信网络告警信息中挖掘频发的模式知识的思想方法———多维频繁情节挖掘。挖掘的多维频繁情节可以帮助网络管理人员分析告警信息和诊断故障。     

关联规则挖掘在煤矿安全监测中的应用

为了从大量的煤矿安全监测数据中获取有用的知识,来指导煤矿安全预警工作,本文将关联规则挖掘算法应用于安全监测数据的数据挖掘。根据数据的特点,对数据进行了预处理后,采用了多维关联规则挖掘算法。文章设计并实现了安全监测数据的关联规则挖掘系统。通过该系统,用户在设置最小支持度和最小置信度阈值后,就可以挖掘出关联规则。     

A computational paradigm that integrates rule-based and model-based reasoning in expert systems

This article presents a new computational paradigm that integrates rule-based and model-based reasoning in expert systems. Our experience in expert systems research and development indicates that the rule-based technique is simple, elegant, and efficient; whereas the model-based approach is complex but powerful, CPU-consuming but robust. Combining both the rule-based and the model-based methods into one paradigm means having the best of both worlds. to achieve this goal, we have extended the Prolog unification algorithm to accommodate semantic unification. the resulting computational procedure is named R.M. This new inference procedure uses rule-based reasoning by default, and it automatically invokes model-based reasoning when all the rules become inapplicable, but it returns to rule-based reasoning whenever the rules become usable again. the idea behind this problem-solving strategy is to achieve maximum efficiency as well as robustness in expert systems. Examples are used throughout the article to illustrate our notions. the article also sketches an application in the domain of telecommunication networks maintenance and describes our experimental results.     

时序规则挖掘

提出了新颖的时间序列模式和规则挖掘技术。该技术先把待挖掘的时间序列转换成子时间序列数据,然后利用子时间序列所隐藏的知识,来指导对原时间序列的挖掘,从中提取模式或规则。给出了时间序列模式和规则的挖掘算法,并举例说明该算法是有效和可行的。     

An intelligent system for distributed control of an anaerobic wastewater treatment process

This paper describes the design and implementation of an intelligent system by means of which multiple anaerobic systems for wastewater treatment are controlled individually by local controllers which are linked to a common remote central supervisor via wide area networks in a client/server network architecture. The local control systems have a hybrid structure, comprising both algorithmic routines for data acquisition, signal preprocessing, calculation of plant operation parameters, etc., and an expert system based on production rules embodying non-mathematical or semiquantitative knowledge of the unit’s operation. The system shows a modular structure, which allows for easy modification or updating with improved versions. The expert system starts up faster than a human operator and maintains the stability of the biological process by modifications in the operating conditions of the plants, reporting warnings and alarms to the central system. The central supervisor acquires, analyses, interprets and stores the data sent by the on-site bioreactor control systems in a relational database, allowing remote specification of plant operating setpoints and continual development of the system. The database is linked with the expert system in order to extend the working memory to the database, allowing its use as an information source. The client/server architecture has been analysed using two different aspects. Firstly, different operating systems were under consideration in the local equipment, in order to determine the networking, multitasking and temporal behaviour. Secondly, different implementations of the network communication were taken into account to make it more flexible, and to allow better adaptation to the communication infrastructure.     

基于DM的网络教学资源的反馈跟踪系统

网络教学资源的反馈跟踪系统是促进教学质量不断提高的重要手段,从以学生为主体的理念出发。研究设计了网络教学资源的反馈跟踪系统。该系统采用DM（Data Mining,数据挖掘）技术中的粗糙集和关联规则对学生在线学习等行为特征数据进行数据收集、数据预处理、构造决策表、基于粗糙集的关联规则的提取,最终得出跟踪反馈的结果,对于推进教学现代化,提高教材质量有重要的意义。     

利用关联规则建立专家系统的知识库

数据挖掘和专家系统同属人工智能领域。关联规则是数据挖掘的一种方法,它的最典型的应用是超市的购物篮分析。专家系统主要解决的是智能推理问题而关联规则侧重于各个数据项之间有价值的联系。通过对关联规则的Apriori算法及规则的产生方法进行改动,挖掘出可应用于专家系统的知识库中的决策规则,从而找出了利用关联规则挖掘出用于决策的规则的方法。     

Neural networks and adaptive expert systems in the CSA approach

According to many authors, neural networks and adaptive expert systems may provide the foundations of sixth-generation computers. Neural networks use lower hardware-like concepts and they are based on continuous and numeric type computation. On the other hand, adaptive expert systems use inference rules and perform high-level symbolic computations. the approaches may seem to be totally different, but they do exhibit similar properties: learning, flexibility, parallel search, generalization, and association. This article takes up the problem of the design of a common model for neural networks and adaptive expert systems. For this purpose the Calculus of Self-Modifiable Algorithms, a general tool for problem solving, is used. This joint approach to expert systems and neural networks emphasize their analogies, rather than their differences. © 1993 John Wiley & Sons, Inc.     

完全加权关联规则挖掘及其在查询扩展中的应用*

为了将完全加权关联规则挖掘技术应用于查询扩展,提出面向查询扩展的基于多种剪枝策略的完全加权词间关联规则挖掘算法,该算法能够极大地提高挖掘效率;提出了一种新的查询扩展模型和扩展词权重计算方法,使扩展词权值更加合理,在此基础上提出一种新的基于局部反馈的查询扩展算法,该算法利用完全加权关联规则挖掘算法自动从局部反馈的前列初检文档中挖掘与原查询相关的完全加权关联规则,构建规则库,从中提取与原查询相关的扩展词,实现查询扩展。实验结果表明,查询扩展算法的检索性能确实得到了很好的改善和提高,与现有查询扩展算法比较,在相同的查全率水平级下其平均查准率有了明显的提高。     

An expert system for diagnosis of coronary artery stenosis based on 201Tl scintigrams using the Dempster-Shafer theory of evidence

An expert system for the diagnosis of stenoses in the three main coronary arteries (left anterior descending, right coronary artery and circumflex) is described. First, the knowledge base domain--201Tl scintigrams--is explained and the method of preprocessing the original heart images is given. Next, the method of dealing with the uncertainties present both in the cardiologist-specified rules and the data using the Dempster-Shafer theory of evidence is explained. Finally, the constructed expert system and the results are discussed and several graphical examples are shown.     

数据挖掘在电信业中的应用

介绍了应用于移动通信业的数据挖掘系统，以一些实际数据说明了关联规则挖掘和分类模型挖掘在电信业务中的具体应用。     

Gravitational search algorithm–optimized neural misuse detector with selected features by fuzzy grids–based association rules mining

Feature selection is one of the most important techniques for data preprocessing in classification problems. In this paper, fuzzy grids–based association rules mining, as an effective data mining technique, is used for feature selection in misuse detection application in computer networks. The main idea of this algorithm is to find the relationships between items in large datasets so that it detects correlations between inputs of the system and then eliminates the redundant inputs. To classify the attacks, a fuzzy ARTMAP neural network is employed whose training parameters are optimized by gravitational search algorithm. The performance of the proposed system is compared with some other machine learning methods in the same application. Experimental results show that the proposed system, when choosing optimum “feature subset size-adjustment” parameter, performs better in terms of detection rate, false alarm rate, and cost per example in classification problems. In addition, employing the reduced-size feature set results in more than 8.4 percent reduction in computational complexity.     

基于关联分析的高校校园网告警系统

随着高校校区的扩大,网络规模越来越大,结构也趋于复杂、异构,这就需要对网络进行有效的管理以维持其可靠性和可用性.告警相关性分析作为网络故障管理中的重要内容,有助于处理冗余告警、定位故障及预防故障的发生.提出使用关联规则分析的告警系统,这些规则可以作为先验知识来指导网络智能化故障定位、诊断和预测.     

A Closed-Loop Automatic Data-Mining Approach for Preventive Network Monitoring

As telecommunication networks grow in size and complexity, monitoring systems need to scale up accordingly. Alarm data generated in a large network are often highly correlated. These correlations can be explored to simplify the process of network fault management, by reducing the number of alarms presented to the network-monitoring operator. This makes it easier to react to network failures. But in some scenarios, it is highly desired to prevent the occurrence of these failures by predicting the occurrence of alarms before hand. This work investigates the usage of data mining methods to generate knowledge from historical alarm data, and using such knowledge to train a machine learning system, in order to predict the occurrence of the most relevant alarms in the network. The learning system was designed to be retrained periodically in order to keep an updated knowledge base.