Expert Systems with Applications 38 (2011) 1709–1715

Contents lists available at ScienceDirect

Expert Systems with Applications

journal homepage: www.elsevier .com/locate /eswa

Preprocessing expert system for mining association rulesin telecommunication networks

Tong-Yan Li a,⇑, Xing-Ming Li b

a Department of Communication Engineering, Chengdu University of Information Technology, Chengdu 610225, Chinab Key Laboratory of Broadband Optical Fiber Transmission and Communication Networks of Ministry of Education, UESTC, Chengdu 610054, China

a r t i c l e i n f o

Keywords:Alarm correlation analysisPreprocessing expert systemAssociation rules miningNeural networkWeighted association rules

0957-4174/$ - see front matter � 2010 Elsevier Ltd. Adoi:10.1016/j.eswa.2010.07.096

⇑ Corresponding author.E-mail address: sunny60138800@yahoo.com.cn (T

a b s t r a c t

Recently, the application of association rules mining becomes an important research area in alarm corre-lation analysis. However, the original alarms in the telecommunication networks cannot be used to mineassociation rules directly. This paper proposes a novel preprocessing expert system model to deal withthe original alarms. This model uses two important techniques, of which the time window techniqueis used for converting original alarms into transactions, and the neural network technique can classifythe alarms with different levels according to the characteristics of telecommunication networks in orderto mine the weighted association rules. Simulation results and the real-world applications demonstratethe effectiveness and practicality of this preprocessing expert system.

� 2010 Elsevier Ltd. All rights reserved.

1. Introduction

Recent global expansion in the demand for telecommunicationsservices has resulted in a considerable growth of networks in termsof size, complexity and bandwidth. Networks often consist of hun-dreds or even thousands of interconnected nodes from differentmanufacturers using various transport mediums and systems. Asa result, when a network problem or failure occurs, it is possiblethat a very large volume of alarms are generated. These alarms de-scribe lots of detailed but very fragmented information about theproblems. Typically, alarm flow is useful to find and isolate faults.However, it is also very difficult to determine the root cause of thefaults. As we know, Alarm correlation is used to be helpful in thefaults diagnosis and localization (Amani, Fathi, & Dehghan, 2005;Hou & Zhang, 2008; Tang, Al-Shaer, & Boutaba, 2008). In the past,the knowledge of alarm correlation was mainly obtained by net-work experts. With the development of telecommunication net-works, it increasingly difficult for experts to keep up with therapid change of networks and discover the real useful knowledgefrom alarms. Therefore, researchers adopt many advanced meth-ods including data mining to analyze alarm correlation. Data min-ing is a science of extracting implicit, previously unknown, andpotentially useful information from large data sets or databases,also known as knowledge discovery in databases (KDD). Telecom-munication alarm correlation analysis based on data mining is nowplaying an important part in current research and drawing moreand more attentions.

ll rights reserved.

.-Y. Li).

An alarm correlation system should be adapted to the fastchanging technical advances in the telecommunication domain. Itis well known that TASA (Telecommunication Alarm SequenceAnalyzer) (Hatonen et al., 1996a, 1996b; Klemettinen, Mannila, &Toivonen, 1999) is a classical knowledge discovery system for ana-lyzing large alarm databases from telecommunication networks.TASA supports two central phase of the knowledge discovery pro-cess: the pattern discovery process and the rules presentationphase. In the first process, TASA finds automatically episode rulesand association rules, and in the rule presentation phase, somepowerful pruning, ordering, and grouping tools are used to supportlarge sets of rules. Obviously, the algorithms of TASA in pattern dis-covery process are based on the Apriori algorithm (Agrawal &Srikant, 1994; Ng, Lakshmanan, Han, & Pang, 1998; Sarawagi,Thomas, & Agrawal, 1998; Srikant, Vu, & Agrawal, 1997), it failsto reflect some characteristics of alarms effectively. For example,alarms from telecommunication network are always consideredinequity, and they are usually made of short messages with generaltextual formats. In particular, such massage includes informationabout the creation time of alarm, the observed symptom of faultand the device issuing the alarm. Therefore, we consider that theitems should be given different weights to reflect their importancein alarm correlation analysis. On the other hand, the strategy offinding frequent items would prune off infrequent items whichmay include some useful relationships of association patterns. Infact, although rare events do not happen often or regularly, they of-ten have special meaning or play an important role in some situa-tion as predicting telecommunication equipment failures. It turnsout that the alarm with weight can help find the rare but importantinformation. In addition, alarms in the telecommunication

1710 T.-Y. Li, X.-M. Li / Expert Systems with Applications 38 (2011) 1709–1715

networks are massive, bursting and intermittent. Although manymethods (Bouloustas, Calo, & Finkel, 1994; Marilly, Aghasaryan,Betgé-Brezetz, O’Martinot, & Delègue, 2002; Weiss & Hirsh, 1998)have been proposed to analyze the alarm correlation, few methodstook account of how to deal with the original alarm data.

In this paper, we propose a novel preprocessing expert systemto resolve above problems. In order to find out the root cause ofalarms and locate the faults accurately by using alarm correlationanalysis, the processing time should be shortened for the need ofboth intelligent network management and automation. Duringthe process of data preprocessing, the framework of the knowledgediscovery task will be formalized and the alarm weights will bedetermined. Meanwhile, we design a binary neural network, ofwhich the input vector are some key elements that can representalarms. After the course of sample data training, alarms with thesimilar weights will be divided into the same class. The weightsof the neural network may not only reflect the knowledge of theexperts but also change automatically when the input change.

This paper is organized as follows: In Section 2, we introduceour system model and its operation process. Section 3 shows theexperimental platform and experimental results in telecommuni-cation network environment. Finally a conclusion is drawn inSection 4.

2. Preprocessing experts system proposed

2.1. Problem description of the original alarms

In the process of data preprocessing, we are interested in mak-ing the original alarms clean and useful. The preprocessing in-cludes alarm data collection and data cleaning (cleaning meansadding with the missing data, discarding the redundant data andreducing the volume of data). By preprocessing, we can convertoriginal alarm data into alarm transactions.

Alarms are short messages, generally of textual format, that aresymptomatic of a change in condition (often an abnormality) in asystem. According to X.733 protocol of the ITU-T standard recom-mendations, an alarm typically contain several fields giving infor-mation about the following attributes: Equipment name, devicetype, equipment address, interface types, alarm level, alarm types,alarm status, and alarm time, etc.

Unfortunately, the alarm does not usually contain significantinformation of network fault. When a network fault appears, it willtrigger a series of alarms subsequently, but not all alarms have cor-relation with the fault. As a matter of fact, it is necessary to analyzeall alarms to find out the relationship of alarms and determine theroot cause of the fault.

As we know, original alarms from the actual network oftenmeet several major problems such as information redundancy,incomplete, time synchronization, a lot of noise that has no rela-tionship with the association rules, and different attributes. Con-sidering these reasons, ARM-ACAS can not deal with the originalalarms directly. In order to be suitable for data mining, originalalarms must be converted into transactions and distributed withdifferent weights. In general, the main problems of the originalalarms are described as follows:

� A fault often triggers many alarms: It has been observed that inmost cases faults occur in bursts because any change of thebehavior of a single node of a complex network can perturb,and therefore may cause faults in other nodes of the same net-work. As a result, equipment faults may occur intermittentlyand cause multiple alarms.� An alarm typically contains many attributes, some of which are

failed to mine the association rules. Only a part of the attributes

can be extracted to form alarm events for mining weightedassociation rules.� Incomplete data: in some special circumstances, some informa-

tion may be lost for lack of some alarm data. Both network man-agement channels interrupted and information transmittedunsuccessfully may lead to this problem.� Noise in the data: in the mining process, the data which is unre-

lated to fault diagnosis can be called noise. Noise has greatinterference with alarm correlation analysis, for instance, itmust be removed in preprocessing.� Time non-synchronous: in a large network, the same equip-

ments usually can’t be standardized in common so that the timeshows different. It is therefore no surprise that so many timeerrors can make the mining very difficult.� Alarm data, which are made of short messages, generally tex-

tual formats, and typically several fields including informationcreation time, location and some alarm conditions, can be con-sidered inequity. These items should be given different weightsto reflect their different importance.

From above analysis of the problems in alarm correlation anal-ysis, it is well known that the extraction and the time synchroniza-tion of alarms are two most important factors in datapreprocessing. The methods to resolve the two problems will beprovided in Section 3.2.

2.2. Alarm extraction and time synchronization

All the analysis methods need history logs about alarm data.However, we do not need any information about the topology ofnetworks. In this respect, the analysis system can be used in differ-ent networks. We extracts alarm time, alarm level, alarm sort andequipment address to form an alarm event and marks it as a 4-tu-ple (a, s, l, t).The four attributes are so important that can representthe alarm. Fig. 1 shows the information extraction process.

Time synchronization problem exists in the original alarms.Some alarms may happen in one or two seconds, and sometimessome alarms even occur at the same time. The mining efficiencyis too low to mine the original alarms directly. In order to deal withthis problem, we should converse the original alarms into theappropriate alarm affairs by examining the original data over auser-specified time window.

Definition 1. Given a set E, the alarm sequence S = {s, Ts, Te} is anascending sequence occurring in the time interval [Ts, Te],Sw = {w, ts, te} is a time window of the sequence S, in which ts > Ts,te < Te, w ¼ fw # Sjts < t < teg. te � ts is the width of the window, asW.

Definition 2. Given the time window width W and the windowsliding step s, the starting time of the sequence is Ti, and the endingtime is Te, the time span Te � Ti = W is called the width of the win-dow. The alarm in a window started at Ti + s and ended at Te + s.

Fig. 2 shows the time widow, of which the alarm sequence is{A, C, . . . , A, F}, the width of the window is 5 and the sliding stepis 2.

Define a transaction time interval to deal with the asynchro-nous problem of alarms. The alarms with the values of ‘‘alarmtime” within the same time window may be incurred by the samefault. Combine all the alarms with the following conditions to forman alarm transaction:

(1) The values of alarm time are within the same time interval.(2) The values of cleared time are within the same time interval.(3) The orders of alarms in the time interval are the same.

Fig. 1. Information extraction.

Fig. 2. An example of the time window.

T.-Y. Li, X.-M. Li / Expert Systems with Applications 38 (2011) 1709–1715 1711

Over the time window operation, the original alarms will beconverted into transactions. The ultimate goal of using time win-dow is to improve the mining efficiency, to obtain the locationquickly and to predict the severe network faults accurately.

2.3. Neural network proposed for confirming alarm weights

An artificial neural network is an information processing para-digm that is inspired by the way biological nervous systems suchas the brain, process information. Neural network, with its remark-able ability to derive meaning from complicated or imprecise data,which can be used to extract patterns and detect that are too com-plex to be noticed by either humans or other computer techniques.

There are already many methods for weights analysis in miningassociation rules, but they are unfit for the alarm weights confir-mation in telecommunication networks. Using neural networkcan handle alarm weights well (Li & Li, 2007). In this paper, we pro-pose a binary neural network to confirm the weights of alarm dataeffectively. During the course of the neural network training, wecan determine a set of link weights which reduces the system erroras close to zero as possible. In this case, relevant data are enteredinto the neural network in order to identify patterns automatically.When the neural network has been trained successfully, we canuse it to determine the alarm weights.

2.3.1. Design the neural networkIn the neural network, the inputs have three key factors which

influence the alarm weights, and the outputs are different classifi-cations of alarms. Considering a binary neuron neural network, thelearning process can be accomplished to divide the alarms into

Fig. 3. Binary neural n

four classes. The model can be seen as the simplest kind of feed-forward neural network which contains three inputs, six linkweights, two neuron and two outputs.

In this neural network model, three parameters should be con-firmed: (1) the ration of description for the inputs; (2) the linkweights of the neural network and (3) the transfer function.

In our study, input datasets are alarm data in telecommunica-tion network. Alarm attributes contain many factors, four of whichincluding the node degree of the alarm equipment, alarm level thatmay reflect the severity and the alarm type influence the telecom-munication network most, so that they should be chosen as the in-puts of the neural network. The outputs of the neural network arethe alarm classes we need. Alarms with the similar importance willbe divided into the same category, and different classes will havedifferent weight values. At first, we input the sample values withthe experience of experts. After training the link weights of neuralnetwork with two neurons, we will get the neural network model.The construction process of the neural network displays in Fig. 3.

Select the sample {p1, q1}, . . . , {pn, qn}, where P1 = (a11, . . . ,a1m)T, . . . , Pn = (an1, . . . , anm)T (p is input vector, q is output vector),define the original value of link weight as w0

1; . . . ;w0m

� �. Alarm data

entry are multidimensional, the dimensional vectors can be ex-pressed as n �m. The link weights of the neural network can be ex-pressed as m � 1 dimension vectors, neural networks are designedby vector multiplication and the output dimensional vector can beexpressed as n � 1. Specifics as follows.

The inputs of the neural network are given as P1 = [a11, . . . ,

a1m]T, . . . , Pn = [an1, ... , anm]T, where an�m ¼a11 � � � a1m

..

. ...

an1 � � � anm

264

375 ¼

PT1

..

.

PTn

264

375:The link weights are shown as Wm�1 = [w1, ... , wm]T.

Pure inputs of the neural network are written asn = a �W + b = [P1, . . . , Pn] � [w1, . . . , wm] + b.

The output can be written as Q ¼ f ðnÞ ¼ f ða �W þ bÞ ¼ f ðan�m�Wm�1 þ bÞ ¼ f ð½P1; . . . ; Pn� � ½w1; . . . ;wm� þ bÞ;, where f shows thetransfer function of the neural network, b is the external input.

etwork classifiers.

1712 T.-Y. Li, X.-M. Li / Expert Systems with Applications 38 (2011) 1709–1715

Output vectors Q1, Q2 have two values �1, 1, respectively. Inputvectors can be divided into four classes: (�1, �1) (�1, 1) (1, �1)(1, 1), and sample values are caught with the experience. Afterclassified by the neural network, alarms with the similar impor-tance will get the same weights.

How to choose the transfer function is a crucial step in the neu-ral network design process. In our design, according to the charac-teristics of alarm data transmission, the input value is set as �1 or1, and the transfer function can be chosen as hard limiting functionhardlim.

The hard limiting function hardlim is given as

f ðvÞ ¼�1; v < 01; v P 0

�ð1Þ

2.3.2. Training process of the link weightsAfter the course of samples studying and link weights training,

the data will achieve linear classified. Training the link weights ofneural networks includes the steps described below. Let a(n) de-note input vectors, Q(n) represent the actual output vectors; q(n)are output values in theory; g means learning step, which is a po-sitive integer below 1 (the descriptions of the symbols are as thesame as before).

(1) Choose the sample data {p1, q1}, . . . , {pn, qn}, whereP1 = (a11, . . . , a1m)T, . . . , Pn = (an1, . . . , anm)T (p denote theinput elements, q denote the output elements).

(2) Setting the initial values of the link weights as w01; . . . ;w0

m

� �.

(3) In step n (n = 0, 1, 2, . . .), input the vector a(n), calculate theactual output Q(n) = f(a(n) + b).

(4) Adjustment rules of the link weights, in which e denotes thesystem error:

wðnþ 1Þ ¼ wðnÞ þ g½qðnÞ � QðnÞ�aðnÞ ð2Þe ¼ qðnÞ � QðnÞ ð3Þ

(5) Set n = n + 1, if |e| P e, back to the step (4), else if |e| < e, end(e is a specified small positive value).

Adjust the link weights by making the error achieve the systemerror tolerance e, and then repeat the process of training until allthe patterns are trained completely. The training process of the linkweights is shown in Fig. 4.

2.3.3. Convergence analysis of the design

Proof. Select sample data as {p1, q1}, . . . , {pn, qn}, in which theexpectation of output are qn with the value 1 or �1Let X = [P b]T bethe input vector, where b is an external input value. Here set the linkweight vector Y = [W1]T, make 1 as its offset value. It is well knownthat the pure input of the neural network is n = PTW + b = XTY andthe update rule of the link weights is described as Ynew = Yold + Xq,let e = q(n) � Q(n) be the error of the true output value and the

Fig. 4. Training process

target value, and the adjustment rule can be shown as

e > 0 Ynew ¼ Yold þ Xe < 0 Ynew ¼ Yold � Xe ¼ 0 Ynew ¼ Yold

8<: ; let q ¼ ge ¼ 1 e ¼ 0; fracekeke –f 0; :;

it is proved that if there exists a weight value, it can be converged tothe expectant value.Weight vector after kth iteration is

YðkÞ ¼ Yðk� 1Þ þ X 0ðk� 1Þ ð4Þ

in which X0(k � 1) is an element of the following set:{X1, X2, . . . , XQ, �X1, . . . , �XQ}.Assume that the vector can classifythe Qth input correctly, described as Y*, assume that

tq ¼ 1; X�TXq > d > 0 ð5Þtq ¼ 0; X�TXq < �d < 0 ð6Þ

In order to prove the convergence of the rules, the upper and lowerlimits of each vector are needed.

Set the initial weight vector 0, as Y(0) = 0.Weight after kth iteration is

YðkÞ ¼ Yðk� 1Þ þ X 0ðk� 1Þ ¼ X0ð0Þ þ X0ð1Þ þ � � � þ X0ðk� 1Þ ð7Þ

Inner product can be concluded as

Y�T YðkÞ ¼ Y�T X 0ð0Þ þ Y�T X0ð1Þ þ � � � þ Y 0T X0ðk� 1Þ: ð8Þ*Y�T Xq > d

)Y�T X 0ðjÞ > d

)Y�T YðkÞ > kd ð9Þ

By the Cauchy–Schwarz inequality,

ðY�T YðkÞÞ2 6 kY�Tk2kYðkÞk2 ð10Þ

in which ||Y(k)||2 = YT(k)Y(k).From (9) and (10) we can conclude that

kYðkÞk2 PðY�T YðkÞÞ2

kY�k2 >ðkdÞ2

kY�k2 : ð11Þ

*kYðkÞk2 ¼ YTðkÞYðkÞ¼ ½Yðk� 1Þ þ X0ðk� 1Þ�T ½Yðk� 1Þ þ X 0ðk� 1Þ�¼ YTðk� 1ÞYðk� 1Þ þ 2YTðk� 1ÞX0ðk� 1Þ ð12Þþ X 0Tðk� 1ÞX 0ðk� 1Þ:

When the classification is wrong, the weights need update, andin this case the two symbols are contrary, so as toYT(k � 1)X0(k � 1) 6 0. So (12) can be simplified to||Y(k)||2

6 ||Y(k � 1)||2 + ||X0(k � 1)||2.After repeated iterations, it isgiven by

kYðkÞk26 kX 0ð0Þk2 þ kX0ð1Þk2 þ � � � þ kX0ðk� 1Þk2 ð13Þ

Let u = max{||X0(j)||2}, and it can satisfy

kYðkÞk26 k/ ð14Þ

of the link weights.

Fig. 5. Preprocessing expert system model.

T.-Y. Li, X.-M. Li / Expert Systems with Applications 38 (2011) 1709–1715 1713

The upper and lower limits of weight vector can be denoted as

ðkdÞ2

kY�k2 < kYðkÞk26 k/: ð15Þ

Therefore we have

k </kY�k2

d2 : ð16Þ

Eq. (16) proves that the count of updating is limited, therefore thetraining algorithm is convergence. It shows that after limited timestraining, we will get the neural network we need. Proof is end. h

Fig. 6. The topology

2.4. Preprocessing expert system modeling

Based on the above descriptions, our proposed preprocessingexpert system model maintains two parts: the time window pro-cessing and the neural network processing. In this whole system,time window processing module handles the original alarms first,and then input the cleaned data into the neural network to gettheir weights. Fig. 5 shows the working process of the preprocess-ing expert system.

From this figure, we can see that alarm processing expert sys-tem is an expert system which is based on the rules, and each mod-ule has its own man-machine interface.

of the network.

Table 1The preprocessing of the alarms.

Time window is 5 s, the sliding step is 3 sThe number of original alarms 1000 2000 3000 4000 5000 6000 7000 8000 9000 10,000The number of transactions 350 715 1064 1372 1739 2077 2404 2728 3093 3538

Time window is 10 s, the sliding step is 3 sThe number of original alarms 1000 2000 3000 4000 5000 6000 7000 8000 9000 10,000The number of transactions 369 721 1041 1369 1716 2084 2396 2784 3106 3482

Time window is 10 s, the sliding step is 6 sThe number of original alarms 1000 2000 3000 4000 5000 6000 7000 8000 9000 10,000The number of transactions 166 355 523 678 875 1037 1205 1384 1547 1725

1714 T.-Y. Li, X.-M. Li / Expert Systems with Applications 38 (2011) 1709–1715

The time window part has four Independent modules, and eachmodule has its own rules. For example, time synchronization ishandled by the rules of the time synchronization, and extractingalarm transactions must follow the rules of extracting alarm trans-actions. Meanwhile, the neural network processing part is in accor-dance with the rules for setting the alarm weight.

The rules of the system shows as P P Q or IF P THEN Q, in whichP is the prerequisite and Q is the conclusion. For the whole system,the rules of each part are given by the network management ex-pert. For example, the sliding step and the time window widthare given by the experience of the experts for different networks,and the learning samples of the neural network are also set bythe experts.

As we know, the preprocessing expert system is an importantpart of the whole mining system, for it can provide clean andappropriate data to find alarm association rules.

3. Experiments and results

3.1. The experimental setup

A series of experiments have been done to show the perfor-mance of our system on AMD Sempron (tm) Processor 2800+ ma-chine with 512MB of main memory, running Microsoft WindowsXP Professional operation system. All codes and interfaces are writ-ten in JAVA. We can get the alarm data from the simulated tele-communication network in some principles. Fig. 6 shows thetopology of real-world network with twenty nodes, there are threeroot nodes 1, 10, 18 among them, while alarms of other nodes aretriggered by these three root nodes. The bandwidth of root nodesare 8M, the other link bandwidth is 2M and the link is finally con-nected to the entire CHINANET with 100M bandwidth.

3.2. Simulation principle

A method for simulating the occurrence of alarms is also incor-porated in the simulation. We construct the network and producealarms in order to make sure that our algorithm is correct and effi-cient. Based on the characteristics of telecommunication networks,we generate original alarms using the following principles:

� Alarms in lower level of arbitrary node cause correspondingalarms in upper lever of the same node.� Alarms of the edge node may be transmitted to the center node

which connects with a probability p.� Alarms of the center node will be transmitted to one of the edge

node which connects randomly.� Alarms of the center node will be transmitted to all center

nodes which they connect with.

Using above principles, the original alarms can reflect relation-ships of network elements truthfully. In this case, the alarm gener-ated from edge node may have correlation with the alarms thatgenerated from the center node.

Preprocessing process works on the simulated alarm datasets. Inthe experiments, we selected three time windows to deal with dif-ferent number of original alarms ranging from 1000 to 10,000, andthen the transactions would be generated and stored to mine theassociation rules. After the preprocessing, we reduced more thanhalf number of the original alarms. Table 1 shows not only the pre-processing results of the original alarms, but also how great thetime window width have influence on a number of frequent items.In the first test, we set the time window for 5 s and sliding step for3 s. Original alarms can be converted to smaller number of transac-tions by the preprocessing expert system. From the table we canfind that the number of transactions is nearly 1/3 of the originalalarms. For example, when the number of original alarms is up to10,000, we have only 3538 transactions. In the second test, wechange the time window to 10 s, but keep the sliding step 3 s. Com-parison of the first test indicates that when the alarms have smallnumber, the number of transactions is little bigger than the firsttesting. But, when the number of original alarms increases, the dif-ference is not obvious. In the final test, we double the value of thetime window and the sliding step used in the first test. Correspond-ingly, the number of transactions is almost half of the first test. Inassociation rules mining, the number of transactions in the thirdtest is too small to find enough correlated rules. With comprehen-sive consideration, we decide to use the first test setting in our sim-ulation. Because the results show that when the window is 5 s, andthe sliding step is 3 s, the number of transaction changes very sta-ble. In this situation, we will get enough transactions to find associ-ation rules and make sure the pretreatment has high efficiency.

3.3. The test of training neural network

In order to determine the alarm weights, we must first sort thealarm data. Classification is based on the three important attri-butes of the alarms: the node degree of network equipment, thealarm level and the alarm type. Before input the data to the neuralnetwork, the three attributes of the alarms must be processed intoa triple (a, s, l), and the description attributes will be quantified. Gi-ven a topology structure of the communication network, we canget the node degree, and then classify the alarm into 4 levels: (1)serious alarm, quantified as 1; (2) major alarm, quantified as 2;(3) minor alarm, quantified as 3; (4) indicative alarm, quantifiedas 4. According to the network topology, the node which is directlylinked to the root node and has more than 4 node degree generatesserious alarms; the node generates major alarms when it directlylinks to the root nodes and has the number of node degree between2 and 4; the node generates minor alarms must meet one of thefollowing conditions: has less than 2 node degree but directly linksto the root node, or has more than 3 node degree but indirectlylinks to the root node; the node generate indicative alarms in othersituations. Alarm types are divided into five categories: (1) com-munication alarms, quantified as 1; (2) device alarm, quantifiedas 2; (3) environmental alarms, quantified as 3; (4) running alarm,quantified as 4; (5) service alarm, quantified as 5.

T.-Y. Li, X.-M. Li / Expert Systems with Applications 38 (2011) 1709–1715 1715

This neural network has three layers: the first layer is the inputlayer. On this layer, the vectors are input to the neural networkafter quantified according to the principle of the quantification;the second layer is the middle layer of the neural network, and itconsists two neurons; the third layer is the output layer, outputthe values of the classification. According to the various attributesof the alarms, we divide the alarms into 4 categories with the valueof 0.1, 0.2, 0.3 and 0.4. The neural network is convergence whenthe learning error square of the sample is less than 0.0001. After47 iterations, the test meets the convergence condition and theneural network has been constructed completely. Finally, we canget the weights of all the alarms.

4. Conclusions

The application of association rules mining in telecommunica-tion network is an important area. In the special telecommunica-tion environment, fault management and alarm correlationanalysis are critical but difficult tasks, for a large number of alarmshave their own characteristics. Therefore, dealing with thesealarms flexibly and automatically are necessary and practical.The preprocessing expert system proposed in this paper is basedon the time window technology and the neural network technol-ogy. Different from the traditional expert systems, our system isthought to be a more flexible approach with higher operating effi-ciency. By using our system, we can quickly change the originalalarms into the proper form that we need for the association rulesmining. Totally speaking, this preprocessing expert system has fol-lowing improvements and innovations:

(1) In telecommunication networks, alarms have quantities anddynamic changes. Preprocessing process helps turn thealarms to the unified framework which is suitable for min-ing. There are a lot of things to do in this process, of whichextracting useful elements of alarms and selecting propertime window to resolve the original alarms are mostimportant.

(2) The weight determination can influence the mining effi-ciency. In this presentation, we have described a feed-for-ward neural network model to determine the alarmweights according to the features of alarms and telecommu-nication network topologies. Based on some typical samplevalues of an actual network, the link weights of neural net-work model have been fixed to stable values after trainingcertain times. The application of neural network to deter-mine the alarm weights can not only reflect the experienceand knowledge of experts, but also make full use of thealarm attributes accurately. Meanwhile, the changes of net-

work topology can be rapid realized by adjusting theweights so as to make the weighted association rules miningmore scientific and effective.

Experimental results show that this preprocessing expert sys-tem plays a most important part in the whole mining process forfinding association rules and locating the root cause of faults.

Acknowledgment

This work is supported by Natural Science Foundation of China(NSFC 60572091).

References

Agrawal, R., & Srikant, R. (1994). Fast algorithm for mining association rules. InProceeding of the 20th VLDB conference (pp. 487–499).

Amani, N., Fathi, M., & Dehghan, M. (2005). A case-based reasoning method foralarm filtering and correlation in telecommunication networks. In Proceeding ofthe Canadian conference on electrical and computer engineering (pp. 2182–2186).

Bouloustas, A. T., Calo, S. B., & Finkel, A. (1994). Alarm correlation and faultidentification in communication networks. IEEE Transactions onCommunications, 42(234), 523–533.

Hatonen, K., Klemettinen, M., Mannila, H., Ronkainen, P., & Toivonen, H. (1996).TASA: Telecommunication alarm sequence analyzer or how to enjoy faults inyour network. In Proceeding of IEEE network operations and managementsymposium, 1996 (pp. 520–529).

Hatonen, K., Klemettinen, M., Mannila, H., Ronkainen, P., & Toivonen, H. (1996).Knowledge discovery from telecommunication network alarm databases. InProceeding of 12th international conference on data engineering (ICDE’96), NewOrleans (pp. 115–122).

Hou, S. Z., & Zhang, X. F. (2008). Analysis and research for network managementalarms correlation based on sequence clustering algorithm. In Proceeding ofICICTA’2008 (pp. 982–986).

Klemettinen, M., Mannila, H., & Toivonen, H. (1999). Rule discovery intelecommunication alarm data. Network and Systems Management Journal,7(4), 395–423.

Li, T. Y., & Li, X. M. (2007). The study of the neural network applied to weightedassociation rules mining. In Proceedings of the international conferenceICWAPR2007 (pp. 742–745).

Marilly, E., Aghasaryan, A., Betgé-Brezetz, S., O’Martinot, O., & Delègue, G. (2002).Alarm correlation for complex telecommunication networks using neuralnetworks and signal processing. In IEEE workshop on IP operations andmanagement (pp. 3–7).

Ng, R., Lakshmanan, L. V. S., Han, J., & Pang, A. (1998). Exploratory mining andpruning optimizations of constrained association rules. In Proceedings of theSIGMOD’98 (pp. 13–24).

Sarawagi, S., Thomas, S., & Agrawal, R. (1998). Integrating association rule miningwith relational database system: Alternatives and implications. In Proceedings ofthe SIGMOD’98 (pp. 343–354).

Srikant, R., Vu, Q., & Agrawal, R. (1997). Mining association rules with itemconstraints. In Proceedings of the KDD’97 (pp. 67–73).

Tang, Y. N., Al-Shaer, E., & Boutaba, R. (2008). Efficient fault diagnosis usingincremental alarm correlation and active investigation for internet and overlaynetworks. IEEE Transactions on Network and Service Management, 5(1), 36–49.

Weiss, G. M., & Hirsh, H. (1998). Learning to predict rare events in event sequences.In Proceedings of the 4th international conference on knowledge discovery and datamining (pp. 359–363). AAAI Press.