## 6 Fault Location Based on Map Addressing and Alarm Commonality Analysis  
This section enriches the information of the associated objects in the alarm sequence flow table by querying the dynamic operation and maintenance map in real-time, and performs commonality analysis on them to obtain the final ranking of the fault objects.  
Considering that the map is 2D, it primarily comprises nodes and edges. Nodes represent entities such as containers, virtual machines, servers, databases, and switches, uniquely identified by IP addresses. Edges represent various relationships including access, operation, and dependency. Map addressing refers to the process of querying the map based on an alarm IP to obtain associated node IPs, thereby enriching the alarm flow table.  
The input for commonality analysis is the enriched alarm flow table. Drawing inspiration from word frequency statistics, a sliding window approach is adopted to conduct statistical analysis based on the frequency of IP occurrences, outputting the top-ranked IPs. These IPs are then checked for alarms, and if any are found, the final localization ranking is the output. See Algorithm 1 for details.  
\begin{table}
\begin{tabular}{c c} \hline
**Field** & **Meaning** \\ \hline Timestamp & Sliding window timestamp \\ \hline Alarming IP & The IP address where the alarm occurred \\ \hline Application of & The application to which the alarm IP address belongs \\ \hline Container vessel IP & Container IP address \\ \hline virtual machine IP & Virtual machine IP address \\ \hline host machine IP & IP address of the host \\ \hline Storage pool ID & Distributed storage information associated with the \\  & virtual machine \\ \hline Information of the leaf switch connected to the application server & \\   SW1 IP & Uplink switch of application server \\ \hline Database accessed by the application server IP & Database information accessed by the application server \\ \hline Uplink leaf switch information of the accessed database server & \\   SW2 IP & The uplink switch of the database being accessed \\ \hline SW1 is directly connected to spine switch SW3 IP & Spine switchboard SW3 \\ \hline SW2 is directly connected to spine switch SW4 IP & Spine switchboard SW4 \\ \hline Cache database accessed by application server IP & Redis \\ \hline Message-oriented middleware accessed by application servers IP & Kafka \\ \hline \end{tabular}
\end{table}
Table 2: Multi-dimensional feature table field.  
```
0: Original alarm flow table: T\({}_{origin}\);  Dynamic operation and maintenance map: M;  Time window: W;  The number of common value columns to be detected: \(n\) Output: Abnormal IP ranking collection
1. Initialization: Before each round of algorithm iteration, initialize the alarm flow table with some field alarm table sets in T\({}_{ini}<\) = T\({}_{origin}\)
2. while True do
3. Take the initialized original alarm flow table T\({}_{ini}\) at the current time
4. Extract the \"IP address\" field of the alarm in the alarm flow table T
5. Query the dynamic operation and maintenance map based on the \"IP address\" field of the alarm, and obtain the associated information table.
6. Combine the original alarm flow table T\({}_{ini}\) and the associated information table T\({}_{relational}\) to obtain T\({}_{all}\)
7. According to the time window W
8. For \(i=1\) to \(n\) do
9. Query the common value of each attribute from the merged alarm flow table T\({}_{all}\), and obtain the set attribute: attribute1, IP: count,..., attribute: attribute \(n\), IP: count S.
10. For the set S, for attributes 1 to \(n\), find out whether the corresponding IP address appears in the alarm IP
11. If it exists, it hits an exception
12. For the results with abnormal hits, the ranking of abnormality degree is based on the number of times the IP appears
13. end for return Abnormal IP ranking collection
```  
**Algorithm 1** Common point analysis of map addressing and alarming