{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T15:21:58Z","timestamp":1781018518342,"version":"3.54.1"},"reference-count":75,"publisher":"Frontiers Media SA","license":[{"start":{"date-parts":[[2023,7,6]],"date-time":"2023-07-06T00:00:00Z","timestamp":1688601600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100021171","name":"Basic and Applied Basic Research Foundation of Guangdong Province","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100021171","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["frontiersin.org"],"crossmark-restriction":true},"short-container-title":["Front. Comput. Sci."],"abstract":"<jats:p>With the growing demand for data computation and communication, the size and complexity of communication networks have grown significantly. However, due to hardware and software problems, in a large-scale communication network (e.g., telecommunication network), the daily alarm events are massive, e.g., millions of alarms occur in a serious failure, which contains crucial information such as the time, content, and device of exceptions. With the expansion of the communication network, the number of components and their interactions become more complex, leading to numerous alarm events and complex alarm propagation. Moreover, these alarm events are redundant and consume much effort to resolve. To reduce alarms and pinpoint root causes from them, we propose a data-driven and unsupervised alarm analysis framework, which can effectively compress massive alarm events and improve the efficiency of root cause localization. In our framework, an offline learning procedure obtains results of association reduction based on a period of historical alarms. Then, an online analysis procedure matches and compresses real-time alarms and generates root cause groups. The evaluation is based on real communication network alarms from telecom operators, and the results show that our method can associate and reduce communication network alarms with an accuracy of more than 91%, reducing more than 62% of redundant alarms. In addition, we validate it on fault data coming from a microservices system, and it achieves an accuracy of 95% in root cause location. Compared with existing methods, the proposed method is more suitable for operation and maintenance analysis in communication networks.<\/jats:p>","DOI":"10.3389\/fcomp.2023.1211739","type":"journal-article","created":{"date-parts":[[2023,7,6]],"date-time":"2023-07-06T12:58:40Z","timestamp":1688648320000},"update-policy":"https:\/\/doi.org\/10.3389\/crossmark-policy","source":"Crossref","is-referenced-by-count":9,"title":["Alarm reduction and root cause inference based on association mining in communication network"],"prefix":"10.3389","volume":"5","author":[{"given":"Min","family":"Li","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mengyuan","family":"Yang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Pengfei","family":"Chen","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1965","published-online":{"date-parts":[[2023,7,6]]},"reference":[{"key":"B1","doi-asserted-by":"publisher","first-page":"1843","DOI":"10.3182\/20130619-3-RU-3018.00057","article-title":"Combining knowledge modeling and machine learning for alarm root cause analysis","volume":"46","author":"Abele","year":"2013","journal-title":"IFAC Proc"},{"key":"B2","first-page":"610","article-title":"\u201cRule-based expert systems,\u201d","author":"Abraham","year":"1988","journal-title":"Proceedings of the International Conference on Systems, Man and Cybernetics"},{"key":"B3","first-page":"18","article-title":"On clustering massive data streams: a summarization paradigm","volume":"32","author":"Aggarwal","year":"2003","journal-title":"SIGMOD Record"},{"key":"B4","doi-asserted-by":"publisher","DOI":"10.1016\/j.cherd.2022.10.041","article-title":"A review of alarm root cause analysis in process industries: common methods, recent research status and challenges","author":"Alinezhad","year":"2022","journal-title":"Chem. Eng. Res. Design"},{"key":"B5","doi-asserted-by":"publisher","DOI":"10.1016\/j.compchemeng.2020.106786","article-title":"Multiclass data classification using fault detection-based techniques","author":"Basha","year":"2020","journal-title":"Comp. Chem. Eng"},{"key":"B6","doi-asserted-by":"publisher","first-page":"73","DOI":"10.1080\/15427951.2005.10129098","article-title":"A survey on pagerank computing","volume":"2","author":"Berkhin","year":"2005","journal-title":"Int. Math"},{"key":"B7","author":"Bernardo","year":"2009","journal-title":"Bayesian Theory, Vol. 405"},{"key":"B8","first-page":"111","article-title":"\u201cA fast apriori implementation,\u201d","author":"Bodon","year":"2000","journal-title":"European Conference on Principles of Data Mining and Knowledge Discovery"},{"key":"B9","first-page":"1","article-title":"\u201cAn implementation of the FPGrowth algorithm in C++,\u201d","author":"Borgelt","year":"2005","journal-title":"Proceedings of the 1st International Workshop on Open Source Data Mining: Frequent Pattern Mining Implementations"},{"key":"B10","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/1541880.1541882","article-title":"Anomaly detection: a survey","volume":"41","author":"Chandola","year":"2009","journal-title":"ACM Comp. Surv"},{"key":"B11","doi-asserted-by":"publisher","first-page":"1341","DOI":"10.1016\/j.comcom.2004.04.009","article-title":"An alarm management framework for automated network fault identification","volume":"27","author":"Chao","year":"2004","journal-title":"Comput. Commun"},{"key":"B12","doi-asserted-by":"publisher","first-page":"43413","DOI":"10.1109\/ACCESS.2020.2977464","article-title":"A framework of virtual war room and matrix sketch-based streaming anomaly detection for microservice systems","volume":"8","author":"Chen","year":"2020","journal-title":"IEEE Access"},{"key":"B13","first-page":"2758","article-title":"\u201cEntity embedding based anomaly detection for heterogeneous categorical events,\u201d","author":"Chen","year":"2019","journal-title":"Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining."},{"key":"B14","first-page":"219","article-title":"Graph-based incident aggregation for large-scale online service systems","volume":"14","author":"Chen","year":"2021","journal-title":"IEEE Trans. Serv. Comput."},{"key":"B15","doi-asserted-by":"publisher","first-page":"512","DOI":"10.1002\/sam.10133","article-title":"A classification for community discovery methods in complex networks","volume":"4","author":"Coscia","year":"2011","journal-title":"Stat. Anal. Data Mining"},{"key":"B16","first-page":"3732","article-title":"Online fault detection based on typicality and eccentricity data analytics","volume":"6","author":"Costa","year":"2019","journal-title":"IEEE Trans. Indust. Informat."},{"key":"B17","first-page":"32","article-title":"\u201cGeneralized Louvain method for community detection in large networks,\u201d","author":"De Meo","year":"2011","journal-title":"International Conference on Advances in Social Networks Analysis and Mining"},{"key":"B18","doi-asserted-by":"publisher","first-page":"15365","DOI":"10.1109\/ACCESS.2018.2797247","article-title":"Sequence mining based alarm suppression","volume":"6","author":"Dorgo","year":"2018","journal-title":"IEEE Access"},{"key":"B19","first-page":"1095","article-title":"\u201cModeling the intensity function of point process via recurrent neural networks,\u201d","author":"Du","year":"2016","journal-title":"2016 IEEE International Conference on Data Mining (ICDM)"},{"key":"B20","first-page":"240","article-title":"Density-based spatial clustering of applications with noise","volume":"6","author":"Ester","year":"1996","journal-title":"In Int. Conf. Knowl. Discov. Data Mining"},{"key":"B21","first-page":"215","article-title":"\u201cPrefixspan: mining sequential patterns efficiently by prefix-projected pattern growth,\u201d","author":"Han","year":"2001","journal-title":"Proceedings of the 17th International Conference on Data Engineering"},{"key":"B22","doi-asserted-by":"publisher","first-page":"100","DOI":"10.2307\/2346830","article-title":"Algorithm as 136: a k-means clustering algorithm","volume":"28","author":"Hartigan","year":"1979","journal-title":"J. R. Stat. Soc. Ser. C"},{"key":"B23","doi-asserted-by":"publisher","DOI":"10.1088\/1742-6596\/1693\/1\/012082","article-title":"Research on alarm association mechanism of information system based on fp-growth algorithm","author":"He","year":"2020","journal-title":"J. Phys. Conf. Ser"},{"key":"B24","doi-asserted-by":"publisher","first-page":"971","DOI":"10.1109\/TCST.2017.2695169","article-title":"Discovering association rules of mode-dependent alarms from alarm and event logs","volume":"26","author":"Hu","year":"2017","journal-title":"IEEE Transact. Cont. Syst. Technol"},{"key":"B25","first-page":"1","article-title":"\u201cSequencegram: n-gram modeling of system calls for program based anomaly detection,\u201d","author":"Hubballi","year":"2011","journal-title":"2011 Third International Conference on Communication Systems and Networks (COMSNETS 2011)"},{"key":"B26","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2022.109485","article-title":"Apgnn: alarm propagation graph neural network for fault detection and alarm root cause analysis","author":"Jiang","year":"2023","journal-title":"Comp. Netw"},{"key":"B27","unstructured":"2020"},{"key":"B28","first-page":"2381","article-title":"Spatio-temporal factorization of log data for understanding network events","volume":"27","author":"Kimura","year":"2015","journal-title":"IEEE Trans. Knowl. Data Engg."},{"key":"B29","author":"Kolodner","year":"2014","journal-title":"Case-Based Reasoning"},{"key":"B30","first-page":"377","article-title":"Evaluation of multicast and unicast routing protocols performance for group communication with QoS constraints in 802.11 mobile ad-hoc networks","volume":"39","author":"Ksentini","year":"2006","journal-title":"Wireless Pers. Commun."},{"key":"B31","first-page":"1384","article-title":"\u201cStudy of alarm pretreatment based on double constraint sliding time window,\u201d","author":"Li","year":"2015","journal-title":"2015 IEEE International Conference on Cyber Technology in Automation, Control, and Intelligent Systems (CYBER)"},{"key":"B32","first-page":"681","article-title":"Word embedding for understanding natural language: a survey","volume":"12","author":"Li","year":"2018","journal-title":"Front. Comput. Sci."},{"key":"B33","first-page":"951","article-title":"Application of Winepi mining algorithm in IDS","volume":"6","author":"Li","year":"2010","journal-title":"J. Comput. Infm. Syst."},{"key":"B34","first-page":"1","article-title":"\u201cDcsa: using density-based clustering and sequential association analysis to predict alarms in telecommunication networks,\u201d","author":"Lin","year":"2019","journal-title":"2019 IEEE 25th International Conference on Parallel and Distributed Systems (ICPADS)"},{"key":"B35","article-title":"Collaborative alerts ranking for anomaly detection","author":"Lin","year":"2018","journal-title":"arXiv [Preprint]."},{"key":"B36","article-title":"\u201cIncident-aware duplicate ticket aggregation for cloud systems,\u201d","author":"Liu","year":"2023","journal-title":"arXiv [Preprint]."},{"key":"B37","doi-asserted-by":"publisher","first-page":"45","DOI":"10.1016\/j.jprocont.2020.09.006","article-title":"Simplified granger causality map for data-driven root cause diagnosis of process disturbances","volume":"95","author":"Liu","year":"2020","journal-title":"J. Process Control"},{"key":"B38","first-page":"1","article-title":"\u201cTowards the use of lstm-based neural network for industrial alarm systems,\u201d","author":"Liu","year":"2018","journal-title":"2018 IEEE International Conference on Prognostics and Health Management (ICPHM)"},{"key":"B39","first-page":"012028","article-title":"Cloud native intelligent operation and maintenance technology","volume":"1645","author":"Long","year":"2020","journal-title":"J. Phys. Conf. Ser."},{"key":"B40","first-page":"1741","article-title":"\u201cMS-Rank: Multi-metric and self-adaptive root cause diagnosis for microservice applications,\u201d","author":"Ma","year":"2019","journal-title":"Proceedings of the 2019 ACM SIGMOD International Conference on Management of Data"},{"key":"B41","doi-asserted-by":"crossref","first-page":"219","DOI":"10.1109\/SCAM55253.2022.00031","article-title":"\u201cAn empirical assessment on merging and repositioning of static analysis alarms,\u201d","author":"Mansoor","year":"2022","journal-title":"2022 IEEE 22nd International Working Conference on Source Code Analysis and Manipulation (SCAM)"},{"key":"B42","first-page":"1","article-title":"An anomaly event correlation engine: Identifying root causes, bottlenecks, and black swans in IT environments","volume":"57","author":"Marvasti","year":"2015","journal-title":"J. Netw. Comput. Appl."},{"key":"B43","first-page":"6274","article-title":"The neural hawkes process: A neurally self-modulating multivariate point process","volume":"18","author":"Mei","year":"2017","journal-title":"J. Mach. Learn. Res."},{"key":"B44","first-page":"1","article-title":"\u201cA semantic-aware representation framework for online log analysis,\u201d","author":"Meng","year":"2020","journal-title":"2020 29th International Conference on Computer Communications and Networks (ICCCN)"},{"key":"B45","doi-asserted-by":"publisher","first-page":"1934","DOI":"10.1109\/TNSM.2020.3039938","article-title":"Supervised and semi-supervised learning for failure identification in microwave networks","volume":"18","author":"Musumeci","year":"2020","journal-title":"IEEE Transact. Netw. Serv. Manag"},{"key":"B46","doi-asserted-by":"crossref","first-page":"552","DOI":"10.1109\/DSN48063.2020.00067","article-title":"\u201cMining multivariate discrete event sequences for knowledge discovery and anomaly detection,\u201d","author":"Nie","year":"2020","journal-title":"2020 50th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN)"},{"key":"B47","first-page":"380","article-title":"\u201cUsing of jaccard coefficient for keywords similarity,\u201d","author":"Niwattanakul","year":"2013","journal-title":"Proceedings of the International Multiconference of Engineers and Computer Scientists"},{"key":"B48","doi-asserted-by":"publisher","first-page":"287","DOI":"10.1016\/j.isatra.2018.12.050","article-title":"Pattern mining in alarm flood sequences using a modified prefixspan algorithm","volume":"90","author":"Niyazmand","year":"2019","journal-title":"ISA Trans"},{"key":"B49","first-page":"1","article-title":"The PageRank citation ranking: Bringing order to the web","volume":"1","author":"Page","year":"1999","journal-title":"Stanford InfoLab."},{"key":"B50","doi-asserted-by":"publisher","first-page":"289","DOI":"10.1093\/bioinformatics\/btg412","article-title":"Ape: analyses of phylogenetics and evolution in r language","volume":"20","author":"Paradis","year":"2004","journal-title":"Bioinformatics"},{"key":"B51","doi-asserted-by":"crossref","first-page":"1137","DOI":"10.1145\/1645953.1646098","article-title":"\u201cTime sequence summarization to scale up chronology-dependent applications,\u201d","author":"Pham","year":"2009","journal-title":"Proceedings of the 18th ACM Conference on Information and Knowledge Management"},{"key":"B52","doi-asserted-by":"publisher","first-page":"1118","DOI":"10.1073\/pnas.0706851105","article-title":"Maps of random walks on complex networks reveal community structure","volume":"105","author":"Rosvall","year":"2008","journal-title":"Proc. Nat. Acad. Sci. U. S. A"},{"key":"B53","doi-asserted-by":"publisher","first-page":"1667","DOI":"10.4249\/scholarpedia.1667","article-title":"Granger causality","volume":"2","author":"Seth","year":"2007","journal-title":"Scholarpedia"},{"key":"B54","first-page":"117","article-title":"\u201cPower wireless heterogeneous network management system based on big data technology,\u201d","author":"Shuiyao","year":"2020","journal-title":"2020 IEEE International Conference on Power, Intelligent Computing and Systems (ICPICS)"},{"key":"B55","doi-asserted-by":"publisher","DOI":"10.1016\/j.amc.2020.125676","article-title":"An algorithm for ranking the nodes of multiplex networks with data based on the pagerank concept","author":"Tortosa","year":"2021","journal-title":"Appl. Math. Comput"},{"key":"B56","doi-asserted-by":"crossref","first-page":"480","DOI":"10.1007\/978-3-540-77048-0_37","article-title":"\u201cApplication of the pagerank algorithm to alarm graphs,\u201d","author":"Treinen","year":"2007","journal-title":"Information and Communications Security: 9th International Conference, ICICS 2007, Zhengzhou, China, December 12-15, 2007. Proceedings 9"},{"key":"B57","doi-asserted-by":"publisher","first-page":"988","DOI":"10.1109\/72.788640","article-title":"An overview of statistical learning theory","volume":"10","author":"Vapnik","year":"1999","journal-title":"IEEE Transact. Neural Netw"},{"key":"B58","doi-asserted-by":"crossref","first-page":"492","DOI":"10.1109\/CCGRID.2018.00076","article-title":"\u201cCloudranger: root cause identification for cloud native systems,\u201d","author":"Wang","year":"2018","journal-title":"2018 18th IEEE\/ACM International Symposium on Cluster, Cloud and Grid Computing (CCGRID)"},{"key":"B59","first-page":"1","article-title":"\u201cAn efficient method to discover association rules of mode-dependent alarms based on the fp-growth algorithm,\u201d","author":"Wang","year":"2020","journal-title":"2020 IEEE Electric Power and Energy Conference (EPEC)"},{"key":"B60","first-page":"327","article-title":"System optimization strategy of alarm storm","volume":"12","author":"Wen","year":"2015","journal-title":"J. Comput. Theoret. Nanosci."},{"key":"B61","doi-asserted-by":"publisher","first-page":"1646","DOI":"10.1109\/TNET.2018.2843805","article-title":"Root cause analysis of anomalies of multitier services in public clouds","volume":"26","author":"Weng","year":"2018","journal-title":"IEEE\/ACM Transact. Netw"},{"key":"B62","doi-asserted-by":"crossref","first-page":"600","DOI":"10.1109\/ICDM.2014.45","article-title":"\u201cRs-forest: a rapid density estimator for streaming anomaly detection,\u201d","author":"Wu","year":"2014","journal-title":"2014 IEEE International Conference on Data Mining"},{"key":"B63","first-page":"1","article-title":"\u201cStructure learning methods for bayesian networks to reduce alarm floods by identifying the root cause,\u201d","author":"Wunderlich","year":"2017","journal-title":"2017 22nd IEEE International Conference on Emerging Technologies and Factory Automation (ETFA)"},{"key":"B64","first-page":"1","article-title":"\u201cImpacttracer: root cause localization in microservices based on fault propagation modeling,\u201d","author":"Xie","year":"2023","journal-title":"2023 Design, Automation"},{"key":"B65","doi-asserted-by":"publisher","DOI":"10.1088\/1742-6596\/1774\/1\/012001","article-title":"Identification of key nodes in abnormal fund trading network based on improved pagerank algorithm","author":"Xiong","year":"2021","journal-title":"J. Phys. Conf. Ser"},{"key":"B66","doi-asserted-by":"crossref","first-page":"57","DOI":"10.1109\/DASC.2014.19","article-title":"\u201cAn approach of discovering causal knowledge for alert correlating based on data mining,\u201d","author":"Xuewei","year":"2014","journal-title":"2014 IEEE 12th International Conference on Dependable, Autonomic and Secure Computing"},{"key":"B67","first-page":"98","article-title":"Recent advance in temporal point process: A review from a machine learning perspective","volume":"335","author":"Yan","year":"2019","journal-title":"Neurocomputing."},{"key":"B68","doi-asserted-by":"publisher","first-page":"1235","DOI":"10.1162\/neco_a_01199","article-title":"A review of recurrent neural networks: Lstm cells and network architectures","volume":"31","author":"Yu","year":"2019","journal-title":"Neural Comput"},{"key":"B69","doi-asserted-by":"crossref","first-page":"984","DOI":"10.1145\/3219819.3219922","article-title":"\u201cHetero-convlstm: a deep learning approach to traffic accident prediction on heterogeneous spatio-temporal data,\u201d","author":"Yuan","year":"2018","journal-title":"Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery"},{"key":"B70","doi-asserted-by":"crossref","first-page":"261","DOI":"10.1145\/3092703.3092731","article-title":"\u201cBoosting spectrum-based fault localization using pagerank,\u201d","author":"Zhang","year":"2017","journal-title":"Proceedings of the 26th ACM SIGSOFT International Symposium on Software Testing and analysis"},{"key":"B71","first-page":"1","article-title":"\u201cMachine learning based alarm analysis and failure forecast in optical networks,\u201d","author":"Zhang","year":"2019","journal-title":"2019 24th OptoElectronics and Communications Conference (OECC) and 2019 International Conference on Photonics in Switching and Computing (PSC)"},{"key":"B72","first-page":"162","article-title":"\u201cUnderstanding and handling alert storm for online service systems,\u201d","author":"Zhao","year":"2020","journal-title":"2020 IEEE\/ACM 42nd International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP)"},{"key":"B73","doi-asserted-by":"publisher","first-page":"84","DOI":"10.1016\/j.comcom.2020.08.012","article-title":"Application of data mining technology in alarm analysis of communication network","volume":"163","author":"Zheng","year":"2020","journal-title":"Comput. Commun"},{"key":"B74","doi-asserted-by":"publisher","first-page":"53","DOI":"10.4018\/IJITWE.2020100104","article-title":"Implementation of web log mining device under apriori algorithm improvement and confidence formula optimization","volume":"15","author":"Zhu","year":"2020","journal-title":"Int. J. Inf. Technol. Web Eng"},{"key":"B75","first-page":"912","article-title":"\u201cLearning from labeled and unlabeled data with label propagation,\u201d","author":"Zhu","year":"2003","journal-title":"Proceedings of the 20th International Conference on Machine Learning (ICML-03)"}],"container-title":["Frontiers in Computer Science"],"original-title":[],"link":[{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/fcomp.2023.1211739\/full","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,7,6]],"date-time":"2023-07-06T12:59:33Z","timestamp":1688648373000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/fcomp.2023.1211739\/full"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,7,6]]},"references-count":75,"alternative-id":["10.3389\/fcomp.2023.1211739"],"URL":"https:\/\/doi.org\/10.3389\/fcomp.2023.1211739","relation":{},"ISSN":["2624-9898"],"issn-type":[{"value":"2624-9898","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,7,6]]},"article-number":"1211739"}}