Alarm false alarm reduction system and method based on service self-learning

Abstract

The invention relates to the technical field of service self-learning, and discloses an alarm false alarm reduction system and method based on service self-learning, and the method comprises the following steps: obtaining a task index and resource time sequence data in a service change log, and carrying out the service intention perception based on the task index and the resource time sequence data; obtaining a forward feature of business intention perception, and obtaining a reverse feature based on manual annotation and a weight reduction feature of adversarial training weight reduction; and constructing a learning cooperative training model according to the forward feature, the reverse feature and the weight reduction feature. According to the method, task indexes and resource time sequence data in a business change log are analyzed, BERT semantic recognition and LSTM periodic analysis technologies are combined, and an intention vector of a quantitative business target is dynamically generated. According to the method, the limitation of a static alarm threshold value is overcome, and the system can sense the real intention of service operation in real time, so that normal service fluctuation and real abnormity are distinguished more accurately, and the false alarm rate caused by service scene change is remarkably reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of business self-learning, and in particular to a system and method for reducing false alarms based on business self-learning. Background Art

[0002] The business self-learning-based alarm and false alarm reduction system utilizes machine learning technology to automatically understand and learn the dynamic behavior patterns of monitored businesses during normal operation. Based on this, it triggers alarms through intelligent, correlated, and context-aware anomaly detection methods. Its core goal is to accurately identify anomalies that truly impact the business while minimizing the number of disruptive false alarms, thereby significantly improving operational efficiency and reliability.

[0003] An existing patent discloses a self-learning method and system for intelligent task alarm rules based on priority support (CN119441832A), involving the field of intelligent technology. This involves building a bidirectional feature extraction network to collect task operation data and generating a task anomaly association model based on historical alarm data. This model is then mapped to a business scenario knowledge base using a transfer learning algorithm to generate quantitative indicators of task priority and construct an adaptive priority scoring system. This existing technology relies on a static business knowledge base and preset alarm rules (e.g., transfer learning mapping fixed business scenarios). It lacks the ability to understand the intent of real-time business changes (e.g., indicator fluctuations caused by promotional activities). Furthermore, its false alarm handling relies solely on optimizing rules based on historical alarm data, without establishing a closed-loop learning mechanism driven by human feedback. Summary of the Invention

[0004] In order to solve the existing technical problems, the present invention provides an alarm false alarm reduction system and method based on business self-learning, which solves the problems of high false alarm rate and rigid rules caused by the lack of business context in existing business self-learning.

[0005] To solve the above technical problems, according to one aspect of the present invention, more specifically, a method for reducing false alarms based on business self-learning includes the following steps:

[0006] S1. Obtain task indicators and resource time series data from the business change log, and perform business intent perception based on the task indicators and resource time series data;

[0007] S2. Obtaining positive features of business intent perception, obtaining negative features based on manual annotation, and de-weighted features obtained through adversarial training; wherein the de-weighted features are used to quantify the actual deviation between the positive features and the negative features;

[0008] S3. Based on the collaborative relationship among positive features, negative features, and weighted features, a learning collaborative training model is constructed. The collaborative relationship includes:

[0009] 1) The relationship between the false alarm degree of the alarm business in the reverse feature of the existing data in the database and the growth rate of the business status and business duration in the positive feature;

[0010] 2) The relationship between the false alarm degree of the alarm business and the demotion feature in the reverse feature of the existing data in the database;

[0011] S4. Generate different priority alarm thresholds based on the dynamic business intent vector and the business correction coefficient output by the learning collaborative training model;

[0012] S5. Alert services that exceed the priority alarm threshold and manually mark the services with alarms as false alarms or true status;

[0013] S6. Storing services with false alarm information, their dynamic service intent vectors, and priority alarm thresholds in a sample database;

[0014] S7. Adjust the sensitivity of the collaborative training model based on the business correction coefficient.

[0015] Furthermore, in step S1, the specific processing steps for performing business intent perception based on the task indicators and resource time series data are as follows:

[0016] 1) Input business change logs and resource time series data;

[0017] 2) It undergoes BERT intent recognition and LSTM cycle analysis processing in sequence;

[0018] 3) Output dynamic business intent vector.

[0019] Furthermore, in step S1, the task indicators include service duration and service status.

[0020] Furthermore, the positive features include a business status growth rate and a business duration growth rate;

[0021] The reverse feature indicates the false alarm degree of the alarm service;

[0022] The downgrade feature indicates the actual deviation between the falsely reported alarm service and the alarm service.

[0023] Furthermore, in step S3, the specific steps of constructing the learning collaborative training model are:

[0024] S301. Ranking the false alarm services in the reverse feature according to the degree of false alarm;

[0025] S302. Equivalently represent the ranking of the false alarm degree as a business correction coefficient;

[0026] S303: Constructing a state training model based on the relationship between the business correction coefficient and the business state growth rate in the positive feature;

[0027] S304: Constructing a duration training model based on the relationship between the service correction coefficient and the service duration growth rate in the positive feature;

[0028] S305: Fit and generate a learning collaborative training model based on the state training model and the duration training model.

[0029] Furthermore, the specific formula for outputting the service correction coefficient by the learning collaborative training model according to the service state growth rate and the service duration growth rate is:

[0030] ;

[0031] Where, Indicates the current service correction coefficient. The larger the current service correction coefficient, the lower the priority of the alarm threshold needs to be. a indicates the growth rate of the current service status. m indicates the growth rate of the current service duration. 、 、 They are used to adjust a, m, Sensitivity parameter.

[0032] Furthermore, in step S303, the parameters in the state training model are adjusted based on the de-weighted features so that the output value of the state training model and the business correction coefficient tend to be equal.

[0033] Furthermore, in step S304, the parameters in the duration training model are adjusted based on the de-weighted feature to make the output value of the duration training model tend to be equal to the output value of the business correction coefficient and the state training model.

[0034] Furthermore, the alarm and false alarm reduction system based on business self-learning includes:

[0035] The business intent perception module is responsible for parsing task indicators and resource time series data in business change logs, and outputs dynamic business intent vectors through BERT semantic recognition and LSTM cycle analysis;

[0036] The feature extraction and annotation module is used to extract positive features from business intent and combine them with manually annotated negative features and weighted features to construct multi-dimensional input data;

[0037] The learning collaborative training model construction module associates positive features with false alarm degree rankings based on business correction coefficients, builds state training models and duration training models, dynamically corrects parameters through de-weighted features, and fits and outputs a collaborative training model that can quantify false alarm risks;

[0038] The dynamic alarm threshold generation module receives the service intention vector and the service correction coefficient output by the model, and dynamically calculates the multi-level priority alarm threshold;

[0039] The model sensitivity self-adjustment module is used to reversely adjust the sensitivity parameters of the collaborative training model according to the business correction coefficient, so that the model is less sensitive to high-frequency false alarm business.

[0040] The system and method for reducing false alarms based on business self-learning provided by the present invention have the following advantages over the prior art:

[0041] 1. This paper analyzes task metrics and resource time series data in business change logs, combining BERT semantic recognition with LSTM cycle analysis technology to dynamically generate intent vectors that quantify business goals. This method overcomes the limitations of static alarm thresholds, enabling the system to perceive the true intent of business operations in real time, thereby more accurately distinguishing normal business fluctuations from true anomalies and significantly reducing false alarm rates caused by changes in business scenarios.

[0042] 2. This invention integrates positive features, manually annotated negative features, and de-weighted features to construct a collaborative learning training model. By establishing a mathematical relationship between business correction coefficients and features and dynamically correcting sub-model parameters using de-weighted features, the model can quantify false positive risk and adapt to different business scenarios (such as warning of loss of promotional products), effectively improving the contextual awareness of anomaly detection.

[0043] 3. This invention stores manually annotated false alarm cases, their dynamic business intent vectors, and alarm thresholds in a sample library and reversely adjusts the model sensitivity based on the business correction coefficient. This closed-loop "alarm-feedback-learning-optimization" mechanism continuously accumulates a knowledge base of false alarm patterns, enabling the model to proactively suppress repeated false alarms and improve alarm accuracy over the long term.

[0044] 4. This invention dynamically generates multi-level priority alarm thresholds based on the service intent vector and the service correction coefficients output by the model. This design allows the system to prioritize alerts for high-risk services while reducing the frequency of alerts for low-risk scenarios. This strategy reduces the time operations personnel spend processing invalid alerts and improves the response time to critical alerts. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 is a flow chart of the present invention;

[0046] Figure 2 is the business correction coefficient in the present invention Relationship graph with the growth rate a of business status;

[0047] Figure 3 is the business correction coefficient in the present invention Relationship graph with the growth rate m of business duration;

[0048] Figure 4 This is a relationship diagram between the growth rate a of the service status and the growth rate m of the service duration in the present invention. DETAILED DESCRIPTION

[0049] In order to make the technical solution of the present invention clearer, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0050] Example 1

[0051] like Figure 1 As shown, according to one aspect of the present invention, a method for reducing false alarms based on business self-learning is provided, which includes obtaining task indicators (task indicators include business duration and business status) and resource time series data in the business change log, and performing business intent perception based on the task indicators and resource time series data; wherein the specific processing steps for performing business intent perception based on the task indicators and resource time series data are as follows:

[0052] 1) Input business change logs and resource time series data;

[0053] 2) It undergoes BERT intent recognition and LSTM cycle analysis processing in sequence;

[0054] 3) Output dynamic business intent vector.

[0055] S2. Obtain positive features of business intent perception, negative features based on manual annotation, and de-weighted features of adversarial training de-weighting; positive features include business status growth rate and business duration growth rate; negative features indicate the false alarm degree of the alarm business; de-weighted features indicate the actual deviation between the false alarm business and the alarm business.

[0056] By analyzing task metrics (such as business duration and status) and resource time series data in business change logs, we use BERT intent recognition (semantically understanding the purpose of the business change) and LSTM cycle analysis (identifying time series patterns) to generate a dynamic business intent vector (quantifying the business goal). We then extract positive features (business status / duration growth rate), negative features (the degree of manually annotated false positives), and devaluation features (the deviation between false positive warnings and actual values).

[0057] Dynamically perceive business intent to avoid the limitations of static thresholds; multi-dimensional feature fusion improves the contextual awareness of anomaly detection and provides accurate input for subsequent models.

[0058] Example 2

[0059] For example, a company has launched a new promotional program. During this period, it needs to calculate the promotion level of each product and issue alerts for excessive promotion (which could result in losses for a particular product category). The existing solution issues alerts when the profit margin falls below 5%. However, this approach fails to consider the product's size, floor space, or popularity. Using a single 5% threshold alone can result in actual losses far exceeding this threshold. In this case, the alert priority needs to be increased and the threshold raised.

[0060] Then, based on the collaborative relationship between positive features, negative features, and de-weighted features, a learning collaborative training model is constructed. This collaborative relationship includes: the relationship between the false alarm level of the alarm business in the negative features of the existing data in the database and the business status growth rate and business duration growth rate in the positive features; and the relationship between the false alarm level of the alarm business in the negative features of the existing data in the database and the de-weighted features. Then, the specific steps for constructing the learning collaborative training model are:

[0061] S301. Ranking the false alarm services in the reverse feature according to the degree of false alarm;

[0062] S302. Equivalently represent the ranking of the false alarm degree as a business correction coefficient;

[0063] For example, if the commodity business data after 100 alarms is collected, if the loss of commodity business data after a certain alarm exceeds the data of the other 50 commodity businesses through manual evaluation, then the commodity business correction coefficient after the alarm is =50%.

[0064] S303. Construct a state training model based on the relationship between the business correction coefficient and the business state growth rate in the positive feature; adjust the parameters in the state training model based on the de-weighted feature to make the output value of the state training model tend to be equal to the business correction coefficient.

[0065] Business correction factor Establish a mathematical model of the relationship between the growth rate a of the business status (such as Figure 2 As shown in the figure, the red dots are the distribution of the 100 samples collected), then:

[0066] (Formula 1);

[0067] In the above formula 1, For control is a constant that is close to the deviation rate g. And by Figure 2 The data in can determine When It is close to the deviation rate g.

[0068] S304. Construct a duration training model based on the relationship between the business correction coefficient and the business duration growth rate in the positive feature; adjust the parameters in the duration training model based on the de-weighted feature to make the output value of the duration training model tend to be equal to the output value of the business correction coefficient and the state training model.

[0069] Business correction factor Establish a mathematical model of the relationship between the growth rate m of the business duration (such as Figure 3 As shown in the figure, the blue dots are the distribution of the 100 samples collected), then:

[0070] (Formula 2);

[0071] In the above formula 2, k is used to control is a constant that is close to the deviation rate g. And by Figure 3 The data in can determine When The value is consistent with Formula 1 The values ​​are approximately the same.

[0072] S305: Fit and generate a learning collaborative training model based on the state training model and the duration training model.

[0073] Based on the correlation between the growth rate a of the business status and the growth rate m of the business duration, we can determine the connection between the state training model and the duration training model, and then build a learning collaborative training model. Then we have:

[0074] (Formula 3);

[0075] And by Figure 4 The data in can determine When The value is the same as in Formula 2 Value, Formula 1 The values ​​are approximately the same.

[0076] Then, the specific formula for the collaborative learning training model to output the business correction coefficient based on the business status growth rate and the business duration growth rate is:

[0077] ;

[0078] Where, Indicates the current service correction coefficient. The larger the current service correction coefficient, the lower the priority of the alarm threshold needs to be. a indicates the growth rate of the current service status. m indicates the growth rate of the current service duration. 、 、 They are used to adjust a, m, Sensitivity parameters

[0079] Explanation of the above model formula:

[0080] The growth rate a of the current business status refers to the instantaneous rate of change of key performance indicators (such as request throughput) relative to the baseline value during business operation, reflecting the intensity of business load fluctuations.

[0081] .

[0082] The growth rate m of the current business duration refers to the deviation rate of the actual business running time relative to the expected running time, indicating abnormal business execution efficiency (such as task delays or early termination).

[0083] .

[0084] Example of the above model formula:

[0085] So, the sales growth rate of a certain product series in the current business during the promotion period is a=14%; the sales growth rate of this product series during the promotion period is m=25%, so:

[0086] ;

[0087] According to the above calculation, the business correction coefficient of this series of products in the promotion state is . In the formula, multiple sets of data are collected:

[0088] Table 1 Business data of some commodities and their extent of loss

[0089]

[0090] According to the data in Table 1 above, we can know that in the promotion business of this enterprise, when the sample data area is infinite, the correction coefficient The value of can determine the profit or loss of the promotional product, that is, when When , it means that a serious loss has occurred in this promotion business, and it is necessary to stop the promotion of this series of products or increase the promotion price.

[0091] Different priority alarm thresholds are generated based on the dynamic business intention vector and the business correction coefficient output by the learning collaborative training model; that is, the larger the current business correction coefficient is, the more the priority of the alarm threshold needs to be lowered.

[0092] Example 3

[0093] Alarms are issued for services that exceed the priority alarm threshold, and services with alarms are manually marked as false alarms or true conditions; services with false alarm information, their dynamic service intent vectors, and priority alarm thresholds are stored in the sample library; the sensitivity of the collaborative training model is adjusted based on the service correction coefficient; the alarm of this service and its explanation information are pushed by the service push end.

[0094] Manually mark the false alarm / true status of over-threshold alarms, store false alarm cases and their dynamic business intent vectors and thresholds in the sample library; reversely adjust the model sensitivity (such as reducing the detection sensitivity of high-frequency false alarm businesses) based on the business correction coefficient α (such as α=59.4%, the threshold priority needs to be lowered).

[0095] Form a closed-loop learning mechanism: manual feedback drives model iteration, the sample library continuously accumulates false alarm patterns, and the sensitivity self-adjustment significantly reduces repeated false alarms and improves alarm accuracy.

[0096] Example 4

[0097] The alarm and false alarm reduction system based on business self-learning includes:

[0098] The business intent perception module is responsible for parsing task indicators and resource time series data in business change logs, and outputs dynamic business intent vectors through BERT semantic recognition and LSTM cycle analysis.

[0099] The feature extraction and annotation module is used to extract positive features from business intent and combine them with manually annotated negative features and weighted features to construct multi-dimensional input data.

[0100] The learning collaborative training model construction module associates positive features with false alarm degree rankings based on business correction coefficients, builds state training models and duration training models, dynamically corrects parameters through de-weighted features, and fits and outputs a collaborative training model that can quantify false alarm risks.

[0101] The dynamic alarm threshold generation module receives the business intention vector and the business correction coefficient output by the model, and dynamically calculates the multi-level priority alarm threshold.

[0102] The model sensitivity self-adjustment module is used to reversely adjust the sensitivity parameters of the collaborative training model according to the business correction coefficient, so that the model is less sensitive to high-frequency false alarm business.

[0103] The above-described embodiments merely illustrate several implementations of the present invention, and while their descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art would be able to make numerous variations and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.

Claims

1. The method for reducing false alarms based on business self-learning is characterized by: The following steps are involved: S1. Obtain task indicators and resource time series data from the business change log, and perform business intent perception based on the task indicators and resource time series data; S2. Obtaining positive features of business intent perception, obtaining negative features based on manual annotation, and de-weighted features obtained through adversarial training; wherein the de-weighted features are used to quantify the actual deviation between the positive features and the negative features; S3. Based on the collaborative relationship among positive features, negative features, and weighted features, a learning collaborative training model is constructed. The collaborative relationship includes: 1) The relationship between the false alarm degree of the alarm business in the reverse feature of the existing data in the database and the growth rate of the business status and business duration in the positive feature; 2) The relationship between the false alarm degree of the alarm business and the demotion feature in the reverse feature of the existing data in the database; S4. Generate different priority alarm thresholds based on the dynamic business intent vector and the business correction coefficient output by the learning collaborative training model; S5. Alert services that exceed the priority alarm threshold and manually mark the services with alarms as false alarms or true status; S6. Storing services with false alarm information, their dynamic service intent vectors, and priority alarm thresholds in a sample database; S7. Adjust the sensitivity of the collaborative training model based on the business correction coefficient.

2. The method for reducing false alarms based on business self-learning according to claim 1 is characterized in that: In step S1, the specific processing steps for business intention perception based on the task indicators and resource time series data are as follows: 1) Input business change logs and resource time series data; 2) It undergoes BERT intent recognition and LSTM cycle analysis processing in sequence; 3) Output dynamic business intent vector.

3. The method for reducing false alarms based on business self-learning according to claim 1 is characterized in that: In step S1, the task indicators include service duration and service status.

4. The method for reducing false alarms based on business self-learning according to claim 1 is characterized in that: The positive features include the business status growth rate and the business duration growth rate; The reverse feature indicates the false alarm degree of the alarm service; The downgrade feature indicates the actual deviation between the falsely reported alarm service and the alarm service.

5. The method for reducing false alarms based on business self-learning according to claim 1 is characterized in that: In step S3, the specific steps of constructing the learning collaborative training model are: S301. Ranking the false alarm services in the reverse feature according to the degree of false alarm; S302. Equivalently represent the ranking of the false alarm degree as a business correction coefficient; S303: Constructing a state training model based on the relationship between the business correction coefficient and the business state growth rate in the positive feature; S304: Constructing a duration training model based on the relationship between the service correction coefficient and the service duration growth rate in the positive feature; S305: Fit and generate a learning collaborative training model based on the state training model and the duration training model.

6. The method for reducing false alarms based on business self-learning according to claim 5, characterized in that: The specific formula for outputting the service correction coefficient by the learning collaborative training model according to the service state growth rate and the service duration growth rate is: ； Where, Indicates the current business correction coefficient. The larger the current business correction coefficient is, the lower the priority of the alarm threshold needs to be. a represents the growth rate of the current business status; m represents the growth rate of the current business duration; 、 、 They are used to adjust a, m, Sensitivity parameter.

7. The method for reducing false alarms based on business self-learning according to claim 5, characterized in that: In step S303, the parameters in the state training model are adjusted based on the de-weighted features to make the output value of the state training model and the business correction coefficient tend to be equal.

8. The method for reducing false alarms based on business self-learning according to claim 5, characterized in that: In step S304, the parameters in the duration training model are adjusted based on the de-weighted feature to make the output value of the duration training model tend to be equal to the output value of the service correction coefficient and the state training model.

9. The alarm and false alarm reduction system based on business self-learning is characterized by: The method for reducing false alarms based on business self-learning according to any one of claims 1 to 8, wherein the system for reducing false alarms based on business self-learning comprises: The business intent perception module is responsible for parsing task indicators and resource time series data in business change logs, and outputs dynamic business intent vectors through BERT semantic recognition and LSTM cycle analysis; The feature extraction and annotation module is used to extract positive features from business intent and combine them with manually annotated negative features and weighted features to construct multi-dimensional input data; The learning collaborative training model construction module associates positive features with false alarm degree rankings based on business correction coefficients, builds state training models and duration training models, dynamically corrects parameters through de-weighted features, and fits and outputs a collaborative training model that can quantify false alarm risks; The dynamic alarm threshold generation module receives the service intention vector and the service correction coefficient output by the model, and dynamically calculates the multi-level priority alarm threshold; The model sensitivity self-adjustment module is used to reversely adjust the sensitivity parameters of the collaborative training model according to the business correction coefficient, so that the model is less sensitive to high-frequency false alarm business.

Images