Abstract: Aiming at the problem of network anomaly cause analysis in communication networks, we proposed  a method of alarm data feature analysis based on decision trees.  Firstly, the alarm data generated by network devices were mostly untagged data, and the alarm data was analyzed based on the correlation analysis of geographical and temporal features to obtain root  information and add tags, and  then the  alarm data  features were multi-dimensional. Secondly, the importance of various features and their impact on accuracy were analyzed by the decision tree method, and  the computational burden on time was reduced by pruning.  The experimental results of alarm data in each region show that the alarm compression rate is about 70% and 90% after pre-processing and correlation analysis, respectively. The impact of alarm object type and alarm logic classification features on network anomalies is stable, and  the importance degree is above 0.25, among them,  the root alarm mostly belongs to communication alarm in the alarm logic classification. This method can help network managers to identify the main alarm data features to a certain extent, and  recover the network first according to  the data features.

Key words: communication network, data processing, decision tree, root information, alarm feature analysis