Alarm transaction extracting method and system

[0031] The technical solutions of the present invention will be described in detail below with reference to the accompanying drawings and preferred embodiments.

[0032] In one embodiment, see figure 1 The schematic flowchart of the method for extracting an alarm transaction is shown, and the method specifically includes the following steps:

[0033] S100 divides the alarm time series into several time periods;

[0034] The alarm time series is the set of time points when the alarm occurs in the original alarm data in the network, that is, the alarm time series is composed of the alarm time or the alarm time point, for example, the alarm time series V={t i},i=1,2,...,K, where t i Indicates the moment when the i-th alarm occurs, and there are K alarms in the alarm time series. The so-called division of alarm time series refers to using a certain algorithm to cluster each alarm time into several times according to the distribution characteristics of the alarm time series. part.

[0035] S110 determines the inter-segment difference of the alarm time series according to the central time point of each adjacent time period, and simultaneously determines the intra-segment difference of the alarm time series according to each time point in each time period;

[0036] The inter-segment difference of the alarm time series is to characterize the isolation of each time segment obtained after the alarm time series is divided, and the intra-segment difference is a physical quantity that characterizes the cohesion of each time segment. When there is a difference, a variety of calculation methods can actually be used, and as a preferred embodiment, the present invention proposes to determine the inter-segment difference of the alarm time series according to the central time point of each adjacent time period, and according to the The calculation method of the intra-segment difference of the alarm time series is determined at each time point, as follows:

[0037] As a specific implementation manner, the inter-segment difference is the average value of the distance between the central time points of each adjacent time segment. If a formula is used to express the inter-segment difference I 0 (t), as shown in formula (1)

[0038] I 0 ( t ) = 1 k - 1 Σ i = 1 k - 1 | t ‾ i + 1 - t ‾ i | - - - ( 1 )

[0039] Among them, k is the number of time periods divided by the alarm time series, is the central time point of the i-th time period, The calculation formula is

[0040] t ‾ i = 1 N i Σ j = 1 N i t i j - - - ( 2 )

[0041] Among them, N i is the total number of alarms in the ith time period, t ij is the moment when the jth alarm occurs in the ith time period. In this embodiment, the central time point of each time period obtained after dividing the alarm time series is obtained, the average value is obtained for the central time point of each time period, and the average value is used as the inter-segment difference of the alarm time series, which not only can It characterizes the isolation of the time period, and avoids the problem of repeated calculation of the time distance, and improves the efficiency of the quality evaluation of the time period division of the alarm time series.

[0042] As a specific implementation manner, the intra-segment difference is the average of the average distances of each time period, and the average distance of each time period is the average distance from each time point in the time period to the central time point of the time period . If the intra-segment difference C is expressed as a formula 0 (t), see equation (3)

[0043] C 0 ( t ) = 1 k Σ i = 1 k 1 N i Σ j = 1 N i | t i j - t ‾ i | - - - ( 3 )

[0044] Among them, k is the number of time periods divided by the alarm time series, N i is the total number of alarms in the ith time period, t ij is the moment when the jth alarm occurs in the ith time period, is the central time point of the ith time period, see formula (2). In this embodiment, the average distance from each time point in each time period, that is, the alarm time to the central time point of the time period, is obtained, and the average distance represents the distribution of each time point in the time period relative to the central time point. degree, that is, the smaller the average distance, the closer each time point is to the central time point, and the more concentrated the distribution relative to the central time point; secondly, on the basis of obtaining the average distance, each time period corresponds to a Therefore, in order to characterize the introversion of the time period of the alarm time series, formula (3) calculates the average value of the average distance of each time period, and uses the average value as the intra-segment difference of the alarm time series, which can not only characterize the time period It also avoids the problem of repeated calculation of the time distance, and improves the efficiency of the quality evaluation of the time segment division of the alarm time series.

[0045] S120 determines the optimal division of the alarm time series according to the ratio of the inter-segment difference and the intra-segment difference.

[0046] Due to the ideal time segment division of the alarm time series, the time distance between the central time points of each time segment should be as large as possible, that is, the isolation of the time segment is strong, and each time point in each time segment reaches the The time distance between the central time points of the time period is as small as possible, that is, the introversion of the time period is strong. When extracting alarm transactions from an alarm time series, only the time period can be used to extract alarm transactions, while ignoring empty alarm time periods without alarms. Therefore, the efficiency of alarm correlation analysis can be greatly improved, thereby further improving the accuracy of positioning network. efficiency of failure. Therefore, in this embodiment, the ratio of the inter-segment difference and the intra-segment difference of the alarm time series is used as a parameter for evaluating the quality of the time-segment division of the alarm time series. For example, according to the inter-segment difference I of the alarm time series 0 (t) and intra-segment difference C 0 (t) Constructing the division quality evaluation function Q, as shown in formula (4), according to the division quality evaluation function to determine the optimal division of the alarm time series, which can make the evaluation result of the time segment division quality of the alarm time series more reasonable, and at the same time Since the division quality evaluation function is suitable for evaluating different division algorithms, the adaptability of the time segment division quality evaluation of the alarm time series is enhanced.

[0047] Q = I 0 ( t ) C 0 ( t ) - - - ( 4 )

[0048] S130 uses the sliding time window method to extract the alarm transactions in each time period under the optimal division.

[0049] In this embodiment, the optimal division is first determined by using the ratio of the inter-segment difference and the intra-segment difference of the alarm time series, that is, according to the maximum value of the ratio of the inter-segment difference and the intra-segment difference of the alarm time series, the corresponding time segment is determined. The division corresponding to the number of time periods is the optimal division of the time period. Then, under the optimal division, the sliding time window method is used to extract the alarm transactions in each time period. Specifically, the window width of the time window The value range of w is p max ≤w≤Δw, the value range of the sliding step size of the time window is Q min ≤s≤Δw, where Δw is the width of the time period, p max is the maximum value of the maximum distance between different alarm scenarios in the time period, Q min It is the minimum value of the minimum distance between different alarm scenarios in the time period; after setting the window width and sliding step size of the time window that meets the above conditions, the alarms of each time period are extracted according to the set window width and sliding step size Transaction, that is, sliding the time window forward in sequence, the time length of each sliding is the distance of the sliding step, and each time the time window is sliding, all alarm events in this time window are regarded as an alarm transaction, until the time window traverses In all time periods, the extraction of the alarm transaction of the alarm time series is completed. The method for extracting the alarm transaction of the alarm time series proposed by the present invention, before extracting the alarm transaction, firstly evaluates the time segment division quality of the alarm time sequence, so as to obtain the time points that can concentrate all the alarm occurrence time points in certain time segments. At the same time, the sliding time window is used to extract alarm transactions for each time period under the optimal division, which can not only extract frequently occurring alarms from the alarm time series, but also By setting the sliding step size, all alarm information can be converted into alarm transactions, thus providing strong support for alarm analysis.

[0050] The feasibility of using the sliding time window method to extract the alarm transaction cases in each time period under the optimal division will be described in detail below with reference to an example. An alarm time series V={1, 2, 3, 4, 6, 10, 11, 12, 15, 17, 18, 19, 20, 23, 24, 25, 27, 38 arbitrarily obtained from the original alarm data ,40,41,42,43,44,45,46}, see figure 2 As shown in the figure, the alarm time series contains 25 alarm time points, among which A, B, C, and D respectively represent different alarm events; the alarm time series V is divided into time by the double-constraint division algorithm and the K-average division algorithm. The division of the segment, the simulation calculation results are as follows image 3 shown, by image 3 It can be seen from the graph of the quality evaluation curve of the division under different division algorithms shown that the Q value is the maximum value when k=3 based on the double-constrained division algorithm, indicating that k=3 is the number of time periods obtained by the optimal division; according to k=3 Based on the dual-constraint partition algorithm, the alarm time series V is divided into three time periods, such as Figure 4 shown, respectively T 1 ={1,2,3,4,6,10,11,12}, T 2 = {15, 17, 18, 19, 20, 23, 24, 25, 27} and T 3 = {38, 40, 41, 42, 43, 44, 45, 46}; after determining each time period obtained by the optimal division, use the sliding time window method to extract the alarm transactions in each time period obtained by the optimal division, For example, when the window width of the set time window is 6 seconds and the sliding step is 4 seconds, the time period T is extracted with this time window 1 = {1, 2, 3, 4, 6, 10, 11, 12} alarm transactions, the extracted alarm transactions are ABC and AB; when the window width of the time window is set to 5 seconds and the sliding step is 2 seconds, Extract the time period T with this time window 2 = {15, 17, 18, 19, 20, 23, 24, 25, 27} alarm transactions, the extracted alarm transactions are ABCD, ACD, AB and ABC, and the time period T is also extracted from this time window 3 = {38, 40, 41, 42, 43, 44, 45, 46} alarm transactions, the extracted alarm transactions are ABD and ABCD, and the extraction results of the alarm transactions are shown in Table 1.

[0051]

[0052] Table 1

[0053] As a specific implementation manner, the number of time segments corresponds to the ratio of the inter-segment difference to the intra-segment difference, and when the ratio is the maximum value, the number of time segments corresponding to the maximum value is the number of time segments obtained by optimal division. When using the division algorithm to divide the alarm time series into several time segments, the number of time segments can be different, and the number of time segments has an important impact on the quality of time segment division. Therefore, in this implementation manner, when the alarm time series is divided into different number of time periods by using the division algorithm, since each division corresponds to the inter-segment difference and the intra-segment difference of an alarm time series, the actual time The number of segments corresponds to the ratio between the difference between the segments and the difference within the segment. When the ratio between the difference between the segments and the difference within the segment is the maximum value, the number of time segments corresponding to the maximum value is obtained by the optimal division. The number of time periods, that is, each time period obtained by dividing the alarm time series according to the optimal division, is ideal compared to other division methods. At this time, the alarm time series under this optimal division is most conducive to improving the Extraction efficiency of alert transactions.

[0054] In order to further illustrate the alarm transaction extraction method proposed by the present invention, and to check the rationality and correctness of the method provided by the present invention, the following will give a complete and detailed example of the technical solution of the present invention on the basis of the MATLAB2011b numerical simulation platform illustrate.

[0055] First of all, in order to facilitate the inspection of the method provided by the present invention, three groups of alarm time series with obvious characteristics are respectively taken, and recorded as alarm time series I ( Figure 5 ), alarm time series II ( Image 6 ) and the alarm time series III ( Figure 7 ), Figure 5 to Figure 7 The ordinates of are all alarm attributes, indicating that an alarm occurs at a certain moment, and its attribute is set to 1. Alarm time series I, alarm time series II, and alarm time series III respectively include 30, 40, and 50 alarm time points, which are defined by Figure 5 to Figure 7 It can be seen that for alarm time series I, alarm time series II and alarm time series III, when the number of divided time periods is 3, 4 and 5 respectively, the obtained time period division result is the optimal division result, because At this time, each time period has been well clustered, and it is most in line with the actual situation.

[0056] Next, taking two commonly used time segment division algorithms—the double-constrained division algorithm and the K-average division algorithm as examples, the two division algorithms are used to divide the time segment of the alarm time series I for multiple times, respectively, to obtain different time segments. The division results of the number of time periods, for different numbers of time periods, calculate the corresponding division quality evaluation function (hereinafter referred to as the evaluation function), and draw the division quality evaluation curve that the value of the division quality evaluation function changes with the number of time periods. On the basis of the division quality evaluation curve, the differences in the time period division quality evaluation by different division quality evaluation functions are analyzed.

[0057] For the partition algorithm based on double constraints, a partition quality evaluation function is

[0058] M = L ( t ) W ( t ) - - - ( 5 )

[0059] in, L ( t ) = Σ 1 ≤ l ≤ j ≤ k d ( t ‾ j , t ‾ l ) 2 , W ( t ) = Σ j = 1 k W ( t j ) = Σ j = 1 k Σ t ∈ t j d ( t , t ‾ j ) 2 , k is the number of time periods divided by the alarm time series, is the central time point of the jth time period, is the central time point of the l-th time period.

[0060] In general, the larger the value of M, the better the result of time segment division. After numerical simulation, the following Figures 8 to 9 The division quality evaluation curve of the division quality evaluation function value as a function of the number of time periods is shown, where Figure 8 is the division quality evaluation curve obtained by formula (5), Figure 9 is the division quality evaluation curve obtained by using the formula (4) proposed by the present invention. from Figure 8 It can be seen from the simulation results that the division quality evaluation function M increases with the increase of the value of the number of time periods k, and the value of M is not the maximum value when k=3. The reason is that the formula (5) shows The division quality evaluation function of , considers the distance between each time period and the central time point of other time periods, which greatly increases the inter-segment difference, while the intra-segment difference decreases with the increase of k, so M It has been on an upward trend, which means that the larger the number of time period divisions, the better the division results, which is obviously related to Figure 5 The actual situation shown is inconsistent, which further illustrates that the division quality evaluation function shown in formula (5) does not have good adaptability to the division of the time period of the alarm time series. In fact, the division of alarm time series can be abstracted into one-dimensional data clustering, while the division quality evaluation function shown in formula (5) is more suitable for use in two-dimensional and high-dimensional data. It is also based on the double-constraint division algorithm to divide the number of different time periods. Using the division quality evaluation function proposed by the present invention, the following results are obtained: Figure 9 The partition quality evaluation curve shown in Figure 9It can be seen that the Q value increases first and then decreases with the increase of the k value, and reaches the maximum when k = 3, indicating that the division result at this time is optimal, which is consistent with the actual situation of the alarm time series I. At the same time, since the calculation of the difference between segments in the division quality evaluation function provided by the present invention weakens its growth rate in Q, so that Q achieves the maximum value under a reasonable number of division time segments, which is well in line with the time segment division. In actual situations, it has better adaptability to the time segment division of the alarm time series.

[0061] In the K-average division algorithm, the distance cost function F is usually used as the division quality evaluation function, and the number of time periods under the optimal division is obtained according to the minimum distance cost criterion, that is, the optimal choice of the number of time periods k is: The specific calculation method of the distance cost function F is:

[0062] F=L+D(6)

[0063] in, is the distance between segments, is the intra-segment distance, k is the number of time segments divided by the alarm time series, is the central time point of the jth time period, t 0 It is the central time point of all alarm time points in the alarm time series.

[0064] After numerical simulation, the following Figure 10 to Figure 11 The division quality evaluation curve of the division quality evaluation function value as a function of the number of time periods is shown, where Figure 10 is the division quality evaluation curve obtained by formula (6), Figure 11 is the division quality evaluation curve obtained by using the formula (4) proposed by the present invention. from Figure 10 It can be seen from the simulation results that the F value shows an unstable trend with the increase of the k value of the number of divided time periods. When k=3, the F value is not the minimum value, that is, the division quality evaluation function is in the alarm time series. In the quality evaluation of time period division, the effect is not optimal. And using the division quality evaluation function proposed by the present invention, the following Figure 11 The partition quality evaluation curve shown in Figure 11 It can be seen that the Q value increases first and then decreases with the increase of the k value, and reaches the maximum when k = 3, indicating that the division result at this time is optimal, which is consistent with the actual situation of the alarm time series A, and also It is illustrated that the division quality evaluation function proposed by the present invention has better adaptability to the division of the time period of the alarm time series.

[0065] In addition to using the dual-constraint division algorithm and the K-average division algorithm to divide the alarm time series I into time segments, the numerical simulation results of different division quality evaluation functions are obtained, and the performance of the time segment division quality evaluation function proposed by the present invention is explained. In addition to the advantages, the present invention also carries out numerical simulations on the alarm time series II and the alarm time series III respectively. According to the division quality evaluation function proposed by the present invention, the following Figure 12 to Figure 13 The division quality evaluation curve shown in the figure, where, Figure 12 is a numerical simulation of the division results of different numbers of time periods of the alarm time series II based on the above two division algorithms, Figure 13 Numerical simulation of the division results of different numbers of time periods of the alarm time series III based on the above two division algorithms. It can be seen from the simulation results that the Q value shows an unstable trend rather than an increasing trend with the increase of the k value of the number of divided time periods. Figure 12 where k=4 and Figure 13 When k=5, Q reaches the maximum value, that is, k=4 and k=5 are the optimal division of alarm time series II and alarm time series III respectively, which is consistent with the actual situation of alarm time series II and alarm time series III, It also further illustrates that the quality evaluation method of the time segment division of the alarm time series proposed by the present invention has certain universality.

[0066] Correspondingly, the present invention also provides an alarm transaction extraction system, in one of the embodiments, refer to Figure 14 , the alarm transaction extraction system includes a division unit 1400, a calculation unit 1410, a judgment unit 1420 and an extraction unit 1430, and each unit is described below:

[0067] a dividing unit 1400, configured to divide the alarm time series into several time periods;

[0068] The alarm time series is the set of time points when the alarm occurs in the original alarm data in the network, that is, the alarm time series is composed of the alarm time or the alarm time point, for example, the alarm time series V={t i},i=1,2,...,K, where t i Indicates the moment when the i-th alarm occurs, and there are K alarms in the alarm time series. The so-called division of the alarm time series by the division unit 1400 means that the division unit 1400 uses a certain algorithm to divide the alarm time series according to the distribution characteristics of the alarm time series. Alarm moments are clustered into several time periods.

[0069] a calculation unit 1410, configured to determine the inter-segment difference of the alarm time series according to the central time point of each adjacent time period, and at the same time determine the intra-segment difference of the alarm time series according to each time point in each time period;

[0070] The inter-segment difference of the alarm time series represents the isolation of each time segment obtained by dividing the alarm time series by the dividing unit 1400, and the intra-segment difference represents the cohesion of each time segment. The calculation unit 1410 is calculating the alarm time series. When the inter-segment difference and the intra-segment difference are different, a variety of calculation methods can actually be used, and as a preferred embodiment, the calculation unit 1410 determines the inter-segment difference of the alarm time series according to the central time point of each adjacent time segment, and Determine the calculation method of the intra-segment difference of the alarm time series according to each time point in each time period, as follows:

[0071] As a specific implementation manner, the inter-segment difference determined by the calculation unit 1410 is the average value of the distance between the central time points of each adjacent time segment, as shown in formula (1). In this embodiment, the central time point of each time period obtained after dividing the alarm time series is obtained, the average value is obtained for the central time point of each time period, and the average value is used as the inter-segment difference of the alarm time series, which not only can It characterizes the isolation of the time period, and avoids the problem of repeated calculation of the time distance, and improves the efficiency of the quality evaluation of the time period division of the alarm time series.

[0072] As a specific implementation manner, the intra-segment difference determined by the calculation unit 1410 is the average value of the average distances of each time period, and the average distance of each time period is the center of the time period from each time point in the time period The average distance of time points is shown in formula (3). In this embodiment, the average distance from each time point in each time period, that is, the alarm time to the central time point of the time period, is obtained, and the average distance represents the distribution of each time point in the time period relative to the central time point. degree, that is, the smaller the average distance, the closer each time point is to the central time point, and the more concentrated the distribution relative to the central time point; secondly, on the basis of obtaining the average distance, each time period corresponds to a Therefore, in order to characterize the introversion of the time period of the alarm time series, formula (3) calculates the average value of the average distance of each time period, and uses the average value as the intra-segment difference of the alarm time series, which can not only characterize the time period It also avoids the problem of repeated calculation of the time distance, and improves the efficiency of the quality evaluation of the time segment division of the alarm time series.

[0073] The judgment unit 1420 is configured to determine the optimal division of the alarm time series according to the ratio of the inter-segment difference and the intra-segment difference.

[0074] Due to the ideal time segment division of the alarm time series, the time distance between the central time points of each time segment should be as large as possible, that is, the isolation of the time segment is strong, and each time point in each time segment reaches the The time distance between the central time points of the time period is as small as possible, that is, the introversion of the time period is strong. When extracting alarm transactions from an alarm time series, only the time period can be used to extract alarm transactions, while ignoring empty alarm time periods without alarms. Therefore, the efficiency of alarm correlation analysis can be greatly improved, thereby further improving the accuracy of positioning network. efficiency of failure. Therefore, in this embodiment, the judging unit 1420 takes the ratio of the inter-segment difference and the intra-segment difference of the alarm time series as a parameter for evaluating the quality of the time-segment division of the alarm time series. For example, according to the inter-segment difference I of the alarm time series 0 (t) and intra-segment difference C 0 (t) Construct the division quality evaluation function Q, as shown in formula (4), determine the optimal division of the alarm time series according to the division quality evaluation function, so that the evaluation result of the time segment division quality of the alarm time series is more reasonable, and at the same time Since the division quality evaluation function is suitable for evaluating different division algorithms, the adaptability of the time segment division quality evaluation of the alarm time series is enhanced.

[0075] Q = I 0 ( t ) C 0 ( t ) - - - ( 4 )

[0076] The extracting unit 1430 is configured to extract the alarm transactions in each time period under the optimal division algorithm by using the sliding time window method.

[0077] In this embodiment, the judgment unit 1420 first determines the optimal division by using the ratio of the inter-segment difference and the intra-segment difference of the alarm time series, that is, according to the maximum value of the ratio of the inter-segment difference and the intra-segment difference of the alarm time series The number of time periods, the division corresponding to the number of time periods is the most division of the time period; under the optimal division, the extraction unit 1430 uses the sliding time window method to extract the alarm transactions in each time period, specifically, the time period The value range of the window width w of the window is p max ≤w≤Δw, the value range of the sliding step size of the time window is Q min ≤s≤Δw, where Δw is the width of the time period, p max is the maximum value of the maximum distance between different alarm scenarios in the time period, Q min is the minimum value of the minimum distance between different alarm scenarios in the time period; after setting the window width and sliding step size of the time window that satisfies the above conditions, the extraction unit 1430 extracts each time according to the set window width and sliding step size The alarm transaction of the segment, that is, sliding the time window forward in turn, the time length of each sliding is the distance of the sliding step, and each time the time window is sliding, all alarm events in this time window are regarded as an alarm transaction, until The time window traverses all time periods, and the extraction unit 1430 completes the extraction of the alarm transaction of the alarm time series. In the alarm transaction extraction system of the alarm time series proposed by the present invention, before the extraction unit 1430 extracts the alarm transaction, the judgment unit 1420 evaluates the time segment division quality of the alarm time series, so as to obtain the optimal division result of the alarm time series, and The time points when alarms occur are all concentrated in certain time periods, thereby improving the efficiency of alarm transaction extraction. At the same time, the extraction unit 1430 uses a sliding time window to extract alarm transactions for each time period under the optimal division, which can not only extract the alarm transactions that occur frequently. The alarms are extracted from the alarm time series, and all alarm information can be converted into alarm transactions through the setting of the sliding step, thus providing strong support for alarm analysis.

[0078]As a specific implementation, the number of time segments corresponds to the ratio of the difference between segments and the difference within segments, and when the ratio is the maximum value, the judgment unit determines that the number of time segments corresponding to the maximum value is the time segment obtained by optimal division quantity. When the division unit uses the division algorithm to divide the alarm time series into several time segments, the number of time segments can be different, and the number of time segments has an important impact on the quality of time segment division. Usually, the number of time segments is different, and the time segment division The quality is also different. Therefore, in this embodiment, when the division unit divides the alarm time series into different number of time segments by using the division algorithm, since each division corresponds to the inter-segment difference and the intra-segment difference of an alarm time series, Therefore, in fact, the number of time periods corresponds to the ratio between the difference between the segments and the difference within the segment. When the ratio between the difference between the segments and the difference within the segment is the maximum value, the judgment unit determines the number of time periods corresponding to the maximum value. , is the number of time periods obtained by the optimal division, that is, each time period obtained by dividing the alarm time series by the division unit according to the optimal division, which is ideal compared to other division methods. The divided alarm time series is most beneficial to improve the extraction efficiency of alarm transactions.

[0079] The technical features of the above-described embodiments can be combined arbitrarily. For the sake of brevity, all possible combinations of the technical features in the above-described embodiments are not described. However, as long as there is no contradiction between the combinations of these technical features, All should be regarded as the scope described in this specification.

[0080] The above-mentioned embodiments only represent several embodiments of the present invention, and the descriptions thereof are specific and detailed, but should not be construed as a limitation on the scope of the invention patent. It should be noted that, for those skilled in the art, without departing from the concept of the present invention, several modifications and improvements can be made, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention should be subject to the appended claims.