Alarm processing method and device, equipment, storage medium and program product

Abstract

The invention provides an alarm processing method and device, equipment, a storage medium and a program product, and relates to the field of artificial intelligence. The method comprises the following steps: extracting a plurality of alarms in a historical time period based on a preset time window size to obtain a historical alarm transaction corresponding to each time window in a plurality of time windows; wherein the alarms comprise event type alarms and business index type alarms, and the event type alarms and the business index type alarms respectively comprise a plurality of alarm types; determining a frequent item set combination according to the historical alarm transaction corresponding to each time window in the plurality of time windows, and constructing an alarm association knowledge graph; wherein the alarm association knowledge graph comprises a plurality of nodes, and each node corresponds to one alarm type; according to the to-be-queried current event type alarm set, the alarm association knowledge graph is queried, and the business index type alarm corresponding to each event type alarm in the current event type alarm set is determined, so that the business index influenced by the system fault is accurately determined.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence, and in particular to an alarm processing method, apparatus, device, storage medium, and program product. Background Art

[0002] For enterprises, information systems are used to collect, store, process, transmit, and analyze enterprise-related information, supporting their decision-making, management, and operational activities. Information systems can include business systems and alarm platforms. Business systems are application systems used to support the enterprise's business activities or functions, while alarm platforms are maintenance support systems used to collect, notify, process, and close alarms. When an information system fails, it may impact the business system. This requires timely assessment of the impact of the failure on the business system so that emergency measures can be implemented based on the impact of the failure on the business system, thereby ensuring the stability of the business system and mitigating the negative impact of the failure on the business.

[0003] Business systems contain a variety of business indicators. Business indicators are metrics used to measure the status of business systems, such as transaction volume, business success rate, and transaction response time. Business indicator alerts are issued when a business indicator fails to meet preset indicator value conditions. For example, an alert is issued for the transaction volume business indicator when transaction volume falls below a certain value or decreases by a certain percentage. Estimating the impact of a system failure on a business system can be viewed as estimating the impact of a system failure on business indicators. Existing technologies, based on monitoring systems and alarm platforms, track business indicators in real time. When a system failure occurs, real-time indicator data is compared with historical data to estimate the impact of the system failure on business indicators.

[0004] System failures may affect one or more business indicators. Accurately identifying the relationship between system failures and business indicators remains a challenge, especially in complex business environments. In the aforementioned prior art, when estimating or predicting the impact of system failures on business indicators, it is difficult to accurately determine which business indicators are affected by the system failure. Summary of the Invention

[0005] The present application provides an alarm processing method, apparatus, device, storage medium, and program product for accurately determining business indicators affected by system failures.

[0006] In a first aspect, the present application provides an alarm processing method, including:

[0007] Based on a preset time window size, multiple alarms within a historical period are extracted to obtain historical alarm transactions corresponding to each of the multiple time windows; wherein the multiple alarms include at least one event-type alarm and at least one business indicator-type alarm, each of the event-type alarm and the business indicator-type alarm corresponds to multiple alarm types, and the historical alarm transactions corresponding to the time window include at least one alarm within the time window; wherein the event-type alarm is used to indicate a system failure in an information system, and the business indicator-type alarm is used to indicate an abnormality in an indicator of a transaction business implemented based on the information system;

[0008] Determine a frequent item set combination based on historical alarm transactions corresponding to each time window in the multiple time windows, and construct an alarm-related knowledge graph based on the frequent item set combination; wherein the frequent item set combination includes multiple frequent item sets, the frequent item sets include at least one alarm type, and any node in the alarm-related knowledge graph corresponds to an alarm type in the frequent item set combination;

[0009] According to the current event-type alarm set to be queried, the alarm-related knowledge graph is queried to determine the business indicator-type alarm corresponding to each event-type alarm in the current event-type alarm set.

[0010] In a second aspect, the present application provides an alarm processing device, comprising:

[0011] A historical alarm transaction determination module is configured to extract, based on a preset time window size, multiple alarms within a historical period to obtain historical alarm transactions corresponding to each of the multiple time windows; wherein the multiple alarms include at least one event-type alarm and at least one business indicator-type alarm, each of which corresponds to multiple alarm types, and the historical alarm transactions corresponding to the time window include at least one alarm within the time window; wherein the event-type alarm is used to indicate a system failure in the information system, and the business indicator-type alarm is used to indicate an anomaly in an indicator of a transaction business implemented based on the information system;

[0012] an alarm-associated knowledge graph construction module, configured to determine a frequent item set combination based on historical alarm transactions corresponding to each of the multiple time windows, and to construct an alarm-associated knowledge graph based on the frequent item set combination; wherein the frequent item set combination includes multiple frequent item sets, each of which includes at least one alarm type, and any node in the alarm-associated knowledge graph corresponds to an alarm type in the frequent item set combination;

[0013] The query module is used to query the alarm-related knowledge graph based on the current event-type alarm set to be queried, and determine the business indicator-type alarm corresponding to each event-type alarm in the current event-type alarm set.

[0014] In a third aspect, the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0015] The memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method according to the first aspect.

[0016] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the method described in the first aspect.

[0017] In a fifth aspect, the present application provides a computer program product, comprising a computer program, which implements the method described in the first aspect when executed by a processor.

[0018] The present application provides an alarm processing method, apparatus, device, storage medium, and program product. The method extracts multiple alarms within a historical period based on a preset time window size to obtain historical alarm transactions corresponding to each time window in multiple time windows; wherein the alarms include event-type alarms and business indicator-type alarms, and the event-type alarms and business indicator-type alarms each include multiple alarm types. Based on the historical alarm transactions corresponding to each time window in the multiple time windows, a frequent item set combination is determined; wherein the alarm types contained in any frequent item set in the frequent item set combination are considered to frequently appear together in the historical alarm transactions, indicating that the alarm types contained in the frequent item set are associated. When one alarm type in the frequent item set occurs, other alarm types in the frequent item set are likely to also occur. Based on the frequent item set combination, an alarm association knowledge graph is constructed; wherein the alarm association knowledge graph includes multiple nodes, each node corresponds to an alarm type in the frequent item set combination, and contains the association relationship between the alarm types in the frequent item set combination. According to the current event-type alarm set to be queried, the alarm-related knowledge graph is queried to determine the business indicator-type alarm corresponding to each event-type alarm (i.e., system failure) in the current event-type alarm set, thereby accurately determining the business indicators affected by the system failure. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0020] Figure 1 A flowchart of an alarm processing method provided in an embodiment of the present application;

[0021] Figure 2A schematic diagram of extracting alarms using a time window provided in an embodiment of the present application;

[0022] Figure 3 A flowchart of a method for determining frequent item set combinations provided in an embodiment of the present application;

[0023] Figure 4 A flowchart of a method for constructing an alarm-related knowledge graph provided in an embodiment of the present application;

[0024] Figure 5 A flowchart of another method for constructing an alarm-related knowledge graph provided in an embodiment of the present application;

[0025] Figure 6 A schematic diagram of the structure of an alarm processing device provided in an embodiment of the present application;

[0026] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0027] The above drawings illustrate specific embodiments of the present application, which will be described in more detail below. These drawings and the textual description are not intended to limit the scope of the present application in any way, but rather to illustrate the concepts of the present application to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0028] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0029] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0030] In addition, this application involves conducting big data analysis of user information (including but not limited to personal biometrics, identity data, consumption data, asset data, electronic terminal operation data, etc.), and using artificial intelligence technology to make automated decisions, and making technical solutions that have a significant impact on personal rights and interests based on the results of automated decisions. The application provides users with corresponding operation entrances for them to choose to agree or reject the results of automated decisions; if the user chooses to reject, the expert decision-making process will be entered.

[0031] It should be noted that the alarm processing method, device, equipment, storage medium and program product provided in this application can be used in the field of artificial intelligence, and can also be used in any field other than the field of artificial intelligence. This application does not limit the application field of the alarm processing method, device, equipment, storage medium and program product.

[0032] In order to solve the above technical problems, an embodiment of the present application proposes an alarm processing method, which extracts multiple alarms within a historical period based on a preset time window size to obtain historical alarm transactions corresponding to each time window in multiple time windows; wherein the alarms include event-type alarms and business indicator-type alarms, and the event-type alarms and business indicator-type alarms respectively include multiple alarm types. Based on the historical alarm transactions corresponding to each time window in the multiple time windows, a frequent item set combination is determined; wherein the alarm types contained in any frequent item set in the frequent item set combination are considered to frequently appear together in the historical alarm transactions, indicating that the alarm types contained in the frequent item set are associated, and when one alarm type in the frequent item set occurs, other alarm types in the frequent item set are likely to occur as well. Based on the frequent item set combination, an alarm association knowledge graph is constructed; wherein the alarm association knowledge graph includes multiple nodes, each node corresponds to an alarm type in the frequent item set combination, and contains the association relationship between the various alarm types in the frequent item set combination. According to the current event-type alarm set to be queried, the alarm-related knowledge graph is queried to determine the business indicator-type alarm corresponding to each event-type alarm (i.e., system failure) in the current event-type alarm set, thereby accurately determining the business indicators affected by the system failure.

[0033] In this embodiment, alarms include event-type alarms and indicator-type alarms, and indicator-type alarms include business indicator-type alarms and resource indicator-type alarms. Among them, event-type alarms are used to indicate that there is a system failure in the information system, such as process memory overflow, network interruption, interface unavailability, etc. Resource indicator-type alarms are used to indicate that there is an abnormality in the resource indicators of the information system (such as the value of a certain resource indicator is less than or greater than the preset threshold of the resource indicator). Resource indicators may include but are not limited to system success rate, CPU (Central Processing Unit, central processing unit) utilization rate, memory utilization rate, and file system utilization rate. Business indicator-type alarms are used to indicate that there is an abnormality in the indicators of transaction business implemented based on the information system (such as the value of a certain business indicator is less than or greater than the preset threshold of the business indicator). Business indicators may include but are not limited to transaction volume, business success rate, and transaction response time.

[0034] In this embodiment, system failures are abstracted into event-type alarms, and abnormalities in business indicators are abstracted into business indicator-type alarms. This embodiment aims to determine the business indicators affected by system failures by determining the business indicator-type alarms affected by event-type alarms.

[0035] The following specific embodiments describe in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0036] Figure 1 This is a flow chart of an alarm processing method provided in an embodiment of the present application. The execution subject of the method can be an electronic device for implementing the alarm processing method, which is implemented by software and hardware, and can specifically be a server deployed locally or in the cloud. The specific steps of the method are as follows:

[0037] S101. Based on a preset time window size, multiple alarms within a historical period are extracted to obtain historical alarm transactions corresponding to each of the multiple time windows; wherein the multiple alarms include at least one event-type alarm and at least one business indicator-type alarm, and both the event-type alarm and the business indicator-type alarm correspond to multiple alarm types, and the historical alarm transactions corresponding to the time window include at least one alarm within the time window; wherein, the event-type alarm is used to indicate that there is a system failure in the information system, and the business indicator-type alarm is used to indicate that there is an abnormality in the indicators of the transaction business implemented based on the information system.

[0038] In this embodiment, the alarm information is recorded in chronological order of the alarm occurrence. The alarm information may include but is not limited to the time of the alarm occurrence, the alarm type, etc. If the alarm is a business indicator type alarm, the alarm information may also include the value of the business indicator.

[0039] In this step, using a preset time window size and sliding step size, the system slides across the time dimension to extract the alarm types of event-based alarms and business indicator-based alarms within the historical period, obtaining a set of alarm types corresponding to each of multiple time windows. For any time window, the set of alarm types corresponding to that time window is considered a historical alarm transaction, resulting in the corresponding historical alarm transactions for each of the multiple time windows (i.e., multiple historical alarm transactions).

[0040] The preset time window size and the preset sliding step can be set according to actual application needs, and this embodiment does not limit this. For example, the preset time window size can be 10 minutes, and the sliding step can be 3 minutes.

[0041] For example, Figure 2 This is a schematic diagram of extracting alarms using a time window provided in an embodiment of the present application. Figure 2 As shown, the x-axis represents a historical period, W1-W4 are four time windows, and in each window, capital letters are used to represent event-type alarms, and lowercase letters are used to represent indicator-type alarms, that is, in Figure 2 In this example, A, B, C, D, E, and H are event-based alarms of different alarm types, and a, d, f, s, g, and k are business indicator-based alarms of different alarm types. For the W1 time window, this window contains three event-based alarms, A, C, and D, and two business indicator-based alarms, a and d. That is, the set of alarm types corresponding to this time window is {A, C, D, a, d}. Similarly, for the W4 time window, this window contains three event-based alarms, A, B, and D, and one business indicator-based alarm, k.

[0042] S102. Determine a frequent item set combination based on historical alarm transactions corresponding to each time window in multiple time windows, and construct an alarm association knowledge graph based on the frequent item set combination; wherein the frequent item set combination includes multiple frequent item sets, the frequent item set includes at least one alarm type, and any node in the alarm association knowledge graph corresponds to an alarm type in the frequent item set combination.

[0043] In this step, an association rule algorithm is used to mine frequent itemsets from multiple historical alarm transactions to obtain frequent item set combinations. The association rule algorithm can be any algorithm for mining frequent itemsets, such as the Apriori algorithm or the FP-growth (Frequent Pattern Growth) algorithm.

[0044] Exemplarily, the FP-growth algorithm is used to mine frequent itemsets across multiple historical alarm transactions to obtain frequent item set combinations. Specifically, the alarm types contained in each of the multiple historical alarm transactions are treated as items, with each alarm type corresponding to one item. The number of occurrences of each alarm type (i.e., each item) in the multiple historical alarm transactions is determined. For example, if event-type alarm A appears in five historical alarm transactions, the number of occurrences of event-type alarm A in the multiple historical alarm transactions is five.

[0045] For any alarm type, the ratio of the number of times that alarm type appears in multiple historical alarm transactions to the number of historical alarm transactions (i.e., the number of historical alarm transactions) is used as the support for that alarm type. If this support is greater than the minimum support threshold corresponding to that alarm type, the alarm type is considered a frequent item. This allows multiple frequent items to be identified. The minimum support thresholds corresponding to different alarm types can be the same or different, and can be set based on actual application needs; this is not a limitation in this embodiment.

[0046] For any historical alarm transaction, infrequent items are deleted, retaining only frequent items. Frequent items in the historical alarm transaction are sorted from highest to lowest support. Frequent items in each historical alarm transaction are added to a frequent pattern tree in order of frequency. If there are duplicate frequent items in a prefix path (i.e., a path in the frequent pattern tree), the duplicate items are merged into the same node, and the node count is incremented. In the frequent pattern tree, nodes represent frequent items, and edge weights represent the number of times the two connected nodes appear together in multiple historical alarm transactions.

[0047] For any frequent item, all paths containing the frequent item are identified from the frequent pattern tree, and the support of each path is calculated. Specifically, for any path, the ratio of the number of times all nodes in the path appear together in multiple historical alarm transactions to the number of historical alarm transactions is used as the support of the path, that is, the support of the itemset consisting of all nodes in the path (i.e., frequent items). If the support of the itemset is greater than the itemset support threshold, the itemset is considered a frequent itemset. The itemset support threshold can be set according to the needs of the actual application and is not limited in this embodiment.

[0048] A conditional pattern tree is constructed based on all paths containing the frequent item that are greater than the itemset support threshold. For any sub-frequent item in the conditional pattern tree, all paths to that sub-frequent item are determined from the conditional pattern tree and the support of each path is calculated. The itemset consisting of all nodes in the paths whose support is greater than the itemset support threshold is then considered a frequent itemset. This process is repeated until all frequent itemsets corresponding to the frequent item are found.

[0049] In this way, we can find multiple frequent item sets corresponding to each frequent item. We can get the frequent item set combination by finding the union of multiple frequent item sets corresponding to each frequent item.

[0050] For any frequent item set in the frequent item set combination, association rules are generated based on all two subsets of the frequent item set (i.e., subsets containing only two frequent items), and all association rules corresponding to the frequent item set are obtained.

[0051] Specifically, for any two-item subset {alarm 1, alarm 2}, association rules corresponding to the two item subsets are generated, including: alarm 1 → alarm 2 and alarm 2 → alarm 1. Alarm 1 → alarm 2 means: if alarm 1 occurs, then alarm 2 occurs. That is, alarm 1 is the cause and alarm 2 is the result. Alarm 2 → alarm 1 means: if alarm 2 occurs, then alarm 1 occurs. That is, alarm 2 is the cause and alarm 1 is the result.

[0052] Based on all the association rules corresponding to each frequent item set in the frequent item set combination, an alarm association knowledge graph can be constructed. Specifically, for any association rule that needs to be added to the alarm association knowledge graph, the cause and result in the association rule are respectively used as nodes in the alarm association knowledge graph, and the association relationship between the two nodes is: if the cause occurs, the result is likely to occur.

[0053] In this step, all association rules corresponding to each frequent item set in the frequent item set combination can be added to the alarm association knowledge graph, or some rules of all association rules corresponding to each frequent item set in the frequent item set combination can be added to the alarm association knowledge graph. The specific addition can be based on the needs of the actual application, and this embodiment does not limit this.

[0054] S103: According to the current event-type alarm set to be queried, query the alarm-related knowledge graph to determine the business indicator-type alarm corresponding to each event-type alarm in the current event-type alarm set.

[0055] Specifically, event-type alarms occurring within the current period are used as the current event-type alarm set to be queried. The end time and duration of the current period can be set based on actual application needs and are not limited in this embodiment. For example, the end time of the current period can be the current system time, and the duration of the current period can be 2 hours.

[0056] For any event-type alarm in the current event-type alarm set, the association rule with the event-type alarm as the cause and the business indicator-type alarm as the result is queried from the alarm association knowledge graph to obtain the business indicator-type alarm that may occur if the event-type alarm occurs.

[0057] Specifically, a knowledge graph query tool is used to search the alarm-related knowledge graph for edges that are directly connected to the event-type alarm and point from the event-type alarm to the business indicator-type alarm. The business indicator-type alarm corresponding to the queried edge is determined as the business indicator-type alarm corresponding to the event-type alarm. The knowledge graph query tool can be any tool for querying knowledge graphs based on nodes, and can be selected based on actual application needs. This embodiment does not limit this, such as a graph database, a graph query language, etc.

[0058] In an embodiment of the present application, based on a preset time window size, multiple alarms within a historical period are extracted to obtain historical alarm transactions corresponding to each time window in multiple time windows; wherein, alarms include event-type alarms and business indicator-type alarms, and event-type alarms and business indicator-type alarms each include multiple alarm types. Based on the historical alarm transactions corresponding to each time window in multiple time windows, a frequent item set combination is determined; wherein, the alarm types contained in any frequent item set in the frequent item set combination are considered to frequently appear together in historical alarm transactions, indicating that the alarm types contained in the frequent item set are associated, and when one alarm type in the frequent item set occurs, other alarm types in the frequent item set are likely to also occur. Based on the frequent item set combination, an alarm association knowledge graph is constructed; wherein, the alarm association knowledge graph includes multiple nodes, each node corresponds to an alarm type in the frequent item set combination, and contains the association relationship between each alarm type in the frequent item set combination. According to the current event-type alarm set to be queried, the alarm-related knowledge graph is queried to determine the business indicator-type alarm corresponding to each event-type alarm (i.e., system failure) in the current event-type alarm set, thereby accurately determining the business indicators affected by the system failure.

[0059] Figure 3 A flow chart of a method for determining a frequent item set combination provided by an embodiment of the present application. In an optional implementation, in the aforementioned S102, when determining a frequent item set combination based on historical alarm transactions corresponding to each of multiple time windows, such as Figure 3 As shown, this can be achieved by taking the following steps:

[0060] S301. For any alarm type in the historical alarm transactions corresponding to each time window in multiple time windows, determine the minimum support threshold corresponding to the alarm type according to the priority of the alarm type, and determine the support of the alarm type according to the number of occurrences of the alarm type in the historical alarm transactions corresponding to each time window in multiple time windows; wherein, the higher the priority, the smaller the minimum support threshold corresponding to the alarm type.

[0061] The priority of the alarm type can be set according to the actual application needs, which is not limited in this embodiment. For example, different priorities can be set for each alarm type according to the urgency or importance of the alarm type, and a higher priority can be set for the more urgent or important alarm type.

[0062] In this step, different minimum support thresholds are set for alarm types of different priorities, wherein alarm types with higher priorities have smaller minimum support thresholds, so that alarm types with higher priorities can be more easily determined as frequent items.

[0063] For any alarm type, the ratio of the number of occurrences of the alarm type in multiple historical alarm transactions to the number of historical alarm transactions is used as the support of the alarm type.

[0064] S302: If the support of the alarm type is greater than the minimum support threshold corresponding to the alarm type, determine the alarm type as a frequent item.

[0065] S303: Determine a frequent item set combination according to multiple frequent items corresponding to each of the multiple time windows.

[0066] The multiple frequent items corresponding to each time window are the multiple frequent items corresponding to each historical alarm transaction.

[0067] In this step, any association rule mining algorithm that first determines frequent items and then mines frequent item sets based on the frequent items can be used to mine frequent item sets of historical alarm transactions. This embodiment does not limit this. For example, the association rule mining algorithm can be an Apriori algorithm or an FP-growth algorithm.

[0068] In this embodiment, different alarm types can have different priorities. Different minimum support thresholds are set for different alarm types according to the priority. The higher the priority, the smaller the minimum support threshold corresponding to the alarm type, so that alarm types with higher priorities can be more easily determined as frequent items, so that alarm types with higher priorities can be added to the alarm-related knowledge graph as much as possible, thereby improving the accuracy of the alarm-related knowledge graph.

[0069] Figure 4 A flow chart of a method for constructing an alarm-related knowledge graph provided in an embodiment of the present application. In an optional implementation, in the aforementioned S102, when constructing an alarm-related knowledge graph based on a combination of frequent item sets, as shown in FIG. Figure 4 As shown, the following steps can be used to implement it:

[0070] S401. Determine association rules between different alarm types in the frequent item set combination according to the frequent item set combination to obtain multiple association rules; wherein the association rules between any two different alarm types include a first association rule and a second association rule, and the causal relationship between the first association rule and the second association rule is opposite.

[0071] Specifically, for any frequent item set in the frequent item set combination, determine all two-item subsets of the frequent item set (i.e., subsets containing only two frequent items). For example, assuming a frequent item set is {A, b, c}, then all two-item subsets of the frequent item set include: {A, b}, {A, c}, and {b, c}.

[0072] For any two-item subset {alarm 1, alarm 2}, association rules are generated between the two items: alarm 1 → alarm 2 and alarm 2 → alarm 1. If alarm 1 → alarm 2 is the first association rule, then alarm 2 → alarm 1 is the second association rule; if alarm 2 → alarm 1 is the first association rule, then alarm 1 → alarm 2 is the second association rule. Clearly, the causal relationship between the first and second association rules is opposite.

[0073] S402. Construct an alarm association knowledge graph based on multiple association rules.

[0074] In this step, all the association rules determined in S401 can be used to construct the alarm association knowledge graph, that is, all the association rules are added to the alarm association knowledge graph; or only a portion of the association rules determined in S401 can be used to construct the alarm association knowledge graph, that is, only a portion of the association rules are added to the alarm association knowledge graph. When only a portion of the association rules are added to the alarm association knowledge graph, which association rules to add to the alarm association rule knowledge graph can be selected based on actual application needs, and this embodiment does not impose any restrictions on this.

[0075] In this embodiment, multiple association rules are determined based on the combination of frequent itemsets, where the association rules reveal the causal relationship between different alarm types. Based on the association rules, an alarm association knowledge graph is constructed, thereby obtaining a knowledge graph that can accurately represent the association relationship (i.e., causal relationship) between different alarm types.

[0076] Figure 5 A flowchart of another method for constructing an alarm-related knowledge graph provided in an embodiment of the present application. In an optional implementation, in the aforementioned S402, when constructing an alarm-related knowledge graph based on multiple association rules, such as Figure 5 As shown, the following steps can be used to implement it:

[0077] S501: Filter multiple association rules according to preset filtering conditions to obtain filtered target association rules.

[0078] The preset screening conditions may be set according to actual application needs, and may be specifically set by the user according to the application scenario (such as the availability of existing software and hardware resources), which is not limited in this embodiment.

[0079] Optionally, this step can be implemented in the following manner:

[0080] If the preset screening condition includes confidence, the confidence of each association rule is calculated, and the association rule with a confidence greater than a confidence threshold among the multiple association rules is determined as the target association rule; wherein the confidence is used to measure the reliability of the association rule.

[0081] The preset screening condition including the confidence level means that when screening association rules, the association rules are screened according to the confidence levels of the association rules.

[0082] Specifically, for any association rule "Alarm 1 → Alarm 2" among multiple association rules, the confidence of the association rule is calculated as follows: Confidence (Alarm 1 → Alarm 2) = Number of transactions containing both Alarm 1 and Alarm 2 / Number of transactions containing Alarm 1. A higher confidence level indicates a higher likelihood of Alarm 2 occurring if Alarm 1 occurs, meaning the association rule is more reliable.

[0083] If the confidence of the association rule is greater than the confidence threshold, the association rule is used as the target association rule. The confidence threshold can be set according to actual application needs and is not limited in this embodiment.

[0084] In this embodiment, only association rules with a confidence greater than a confidence threshold (ie, association rules with high reliability) are added to the alarm association knowledge graph, thereby improving the accuracy and reliability of the alarm association knowledge graph.

[0085] Optionally, this step may also be implemented in the following manner:

[0086] If the preset screening condition includes a causal relationship, an association rule whose cause is an event-type alarm and whose result is a business-type indicator alarm among the multiple association rules is determined as a target association rule.

[0087] The preset screening condition includes a causal relationship, which means that the association rules are screened according to the causal relationship between different alarm types in the association rules.

[0088] Specifically, for any one of the multiple association rules, if the cause in the association rule is an event-type alarm and the result is a service-type alarm, the association rule is used as the target association rule.

[0089] In this embodiment, only the association rules whose causes are event-type alarms and whose results are business indicator-type alarms are added to the alarm association knowledge graph, which reduces the complexity of the alarm association knowledge graph and enables more rapid query of business indicator-type alarms affected by event-type alarms when querying the alarm association knowledge graph, thereby improving the query speed.

[0090] Optionally, this step can be implemented in the following manner:

[0091] If the preset screening conditions include confidence and causality, the confidence of each association rule will be calculated, and the association rules whose confidence is greater than the confidence threshold, whose cause is an event-type alarm, and whose result is a business-type indicator alarm among multiple association rules will be determined as target association rules.

[0092] In this embodiment, only association rules whose confidence is greater than the confidence threshold, and whose causes are event-type alarms and whose results are business indicator-type alarms are added to the alarm association knowledge graph, which improves the accuracy and reliability of the alarm association knowledge graph and reduces the complexity of the alarm association knowledge graph, thereby increasing the query speed when querying the graph and thus improving processing efficiency.

[0093] S502. Construct an alarm association knowledge graph based on target association rules.

[0094] Specifically, for any target association rule, the cause and result of the target association rule are respectively regarded as nodes, and an edge is used to connect the cause node and the result node, and the direction is from the cause node to the result node.

[0095] In this embodiment, according to preset screening conditions, only the association rules obtained by screening are used to construct the alarm association knowledge graph, which saves computing resources, simplifies the alarm association knowledge graph, and improves the efficiency of subsequent queries.

[0096] Optionally, this step can also be implemented in the following manner:

[0097] Determine the confidence of the target association rules, and use the target association rules and the confidence of the target association rules to build an alarm association knowledge graph.

[0098] Specifically, for any target association rule, the confidence of the target association rule is calculated. The cause and effect of the target association rule are treated as nodes, respectively. An edge is used to connect the cause node and the effect node, with the direction from the cause node to the effect node. The confidence of the target association rule is used as the weight of this edge. In other words, the edge between any two nodes in the alarm association knowledge graph not only represents the association relationship between the two nodes (i.e., causal relationship), but also includes the confidence of this causal relationship.

[0099] It should be noted that the implementation principle of calculating the confidence of the target association rule is the same as the principle of calculating the association rule in the aforementioned S501, and will not be repeated here.

[0100] Based on the construction of the alarm association knowledge graph using the target association rules and the confidence of the target association rules, in an optional implementation, in the aforementioned S103, according to the current event-type alarm set to be queried, the alarm association knowledge graph is queried, and the business indicator-type alarm corresponding to each event-type alarm in the current event-type alarm set is determined. The specific implementation can be as follows:

[0101] According to the current event-type alarm set to be queried, the alarm-related knowledge graph is queried to determine the business indicator-type alarm corresponding to each event-type alarm in the current event-type alarm set and the corresponding confidence level and output them.

[0102] Specifically, for any event-type alarm in the current event-type alarm set, use the knowledge graph query tool to query the edge in the alarm association knowledge graph that is directly connected to the event-type alarm and has a pointing relationship from the event-type alarm to the business indicator-type alarm. The business indicator-type alarm corresponding to the queried edge is determined as the business indicator-type alarm corresponding to the event-type alarm. The weight corresponding to the queried edge is determined as the confidence of the association relationship "If the event-type alarm occurs, the business indicator corresponding to the edge occurs"; output the business indicator-type alarm corresponding to the event-type alarm and the corresponding confidence.

[0103] It should be noted that a single event-based alarm can correspond to multiple business indicator-based alarms. When the same event-based alarm corresponds to different business indicator-based alarms, the corresponding edge weights can be different. The business indicator type and confidence level corresponding to the event-based alarm can be output directly to the user or to the operation and maintenance model for further processing and analysis before being output to the user.

[0104] In this embodiment, the confidence of the target association rule is stored in the alarm association knowledge graph, and the reliability of the association relationship between different alarm types is quantified. The quantified confidence is obtained during the query to obtain a more accurate association relationship.

[0105] In an optional implementation, in the aforementioned S103, after determining the business indicator type alarm corresponding to each event type alarm in the current event type alarm set, the following operations may be further performed:

[0106] For any event-type alarm in the current event-type alarm set, the degree of impact of the event-type alarm on the business indicator-type alarm corresponding to the event-type alarm is calculated based on the difference between the real-time indicator value and the preset indicator value of the business indicator corresponding to the business indicator-type alarm corresponding to the event-type alarm.

[0107] The difference between the real-time indicator value and the preset indicator value of the business indicator corresponding to the business indicator type alarm corresponding to the event type alarm may be the difference, ratio or change rate between the real-time indicator value and the preset indicator value.

[0108] Specifically, the difference, ratio or change rate between the real-time indicator value and the preset indicator value is used as the impact degree of the event-type alarm on the business indicator-type alarm corresponding to the event-type alarm.

[0109] The preset indicator value can be set based on actual application needs and is not limited in this embodiment. For example, for an information system without an established service level agreement (SLA), the average indicator value within a certain historical period can be used as the preset indicator value. For an information system with an established service level agreement (SLA), the indicator value in the SLA can be used as the preset indicator value.

[0110] The current event-type alarm set, the business indicator-type alarms corresponding to each event-type alarm in the current event-type alarm set, and their impact levels are input into the operation and maintenance big model to obtain a comprehensive report on the business indicator impact corresponding to the current event-type alarm set.

[0111] Specifically, the current event-type alarm set, the business indicator-type alarms corresponding to each event-type alarm in the current event-type alarm set, and their impact levels are input into the operation and maintenance big model, which further processes and analyzes the input information and outputs a comprehensive report on the business indicator impact corresponding to the current event-type alarm set.

[0112] The operation and maintenance big model may be any language big model that can perform comprehensive analysis based on input information (including text, pictures, etc.) and generate a comprehensive report, and this embodiment does not limit this.

[0113] Optionally, the current event-type alarm set, the business indicator alarms corresponding to each event-type alarm in the current event-type alarm set and their impact levels, as well as the confidence levels of the correlations between each event-type alarm and the business indicators corresponding to each event-type alarm, can also be input into the operation and maintenance big model, which will further process and analyze the input information and output a comprehensive report on the impact of the business indicators corresponding to the current event-type alarm set.

[0114] In this embodiment, the current event-type alarm set, the business indicator-type alarms corresponding to each event-type alarm in the current event-type alarm set, and their impact levels are input into the operation and maintenance big model, and the operation and maintenance big model generates a comprehensive impact report in an automated manner, thereby reducing manual intervention and improving the efficiency of producing operation and maintenance reports.

[0115] Figure 6 This is a structural diagram of an alarm processing device provided in an embodiment of the present application. Figure 6 As shown, the alarm processing device 600 includes: a historical alarm transaction determination module 601, an alarm-related knowledge graph construction module 602 and a query module 603.

[0116] Among them, the historical alarm transaction determination module 601 is used to extract multiple alarms within the historical period based on a preset time window size, and obtain historical alarm transactions corresponding to each time window in multiple time windows; wherein, multiple alarms include at least one event-type alarm and at least one business indicator-type alarm, and both event-type alarms and business indicator-type alarms correspond to multiple alarm types. The historical alarm transactions corresponding to the time window include at least one alarm within the time window; wherein, event-type alarms are used to indicate that there is a system failure in the information system, and business indicator-type alarms are used to indicate that there is an abnormality in the indicators of the transaction business implemented based on the information system.

[0117] The alarm association knowledge graph construction module 602 is used to determine the frequent item set combination based on the historical alarm transactions corresponding to each time window in multiple time windows, and construct the alarm association knowledge graph based on the frequent item set combination; wherein the frequent item set combination includes multiple frequent item sets, the frequent item set includes at least one alarm type, and any node in the alarm association knowledge graph corresponds to an alarm type in the frequent item set combination.

[0118] The query module 603 is used to query the alarm-related knowledge graph according to the current event-type alarm set to be queried, and determine the business indicator-type alarm corresponding to each event-type alarm in the current event-type alarm set.

[0119] In an optional implementation, when determining a frequent item set combination based on historical alarm transactions corresponding to each of multiple time windows, the alarm-related knowledge graph construction module 602 is specifically configured to:

[0120] For any alarm type in the historical alarm transactions corresponding to each time window in multiple time windows, the minimum support threshold corresponding to the alarm type is determined according to the priority of the alarm type, and the support of the alarm type is determined according to the number of occurrences of the alarm type in the historical alarm transactions corresponding to each time window in the multiple time windows; wherein, the higher the priority, the smaller the minimum support threshold corresponding to the alarm type; if the support is greater than the minimum support threshold, the alarm type is determined as a frequent item; based on the multiple frequent items corresponding to each time window in the multiple time windows, a frequent item set combination is determined.

[0121] In an optional implementation, when constructing an alarm-related knowledge graph based on a combination of frequent itemsets, the alarm-related knowledge graph construction module 602 is specifically used to:

[0122] Based on the frequent item set combination, the association rules between different alarm types in the frequent item set combination are determined to obtain multiple association rules; wherein, the association rules between any two different alarm types include a first association rule and a second association rule, and the causal relationship between the first association rule and the second association rule is opposite; based on the multiple association rules, an alarm association knowledge graph is constructed.

[0123] In an optional implementation, when constructing an alarm-related knowledge graph based on multiple association rules, the alarm-related knowledge graph construction module 602 is specifically used to:

[0124] According to the preset screening conditions, multiple association rules are screened to obtain the filtered target association rules; based on the target association rules, an alarm association knowledge graph is constructed.

[0125] In an optional implementation, when multiple association rules are screened according to preset screening conditions and the filtered target association rules are obtained, the alarm association knowledge graph construction module 602 is specifically used to:

[0126] If the preset screening condition includes confidence, the confidence of each association rule is calculated, and the association rule with a confidence greater than a confidence threshold among the multiple association rules is determined as the target association rule; wherein the confidence is used to measure the reliability of the association rule.

[0127] In an optional implementation, when multiple association rules are screened according to preset screening conditions and the filtered target association rules are obtained, the alarm association knowledge graph construction module 602 is specifically used to:

[0128] If the preset screening condition includes a causal relationship, an association rule whose cause is an event-type alarm and whose result is a business-type indicator alarm among the multiple association rules is determined as a target association rule.

[0129] In an optional implementation, when constructing the alarm association knowledge graph according to the target association rule, the alarm association knowledge graph construction module 602 is specifically used to:

[0130] Determine the confidence of the target association rules, and use the target association rules and the confidence of the target association rules to build an alarm association knowledge graph.

[0131] When querying the alarm-related knowledge graph based on the current event-type alarm set to be queried and determining the business indicator-type alarm corresponding to each event-type alarm in the current event-type alarm set, the query module 603 is specifically used to:

[0132] According to the current event-type alarm set to be queried, the alarm-related knowledge graph is queried to determine the business indicator-type alarm corresponding to each event-type alarm in the current event-type alarm set and the corresponding confidence level and output them.

[0133] In an optional implementation, after determining the business indicator type alarm corresponding to each event type alarm in the current event type alarm set, the query module 603 is further configured to:

[0134] For any event-type alarm in the current event-type alarm set, calculate the degree of impact of the event-type alarm on the business indicator-type alarm corresponding to the event-type alarm based on the difference between the real-time indicator value and the preset indicator value of the business indicator corresponding to the business indicator-type alarm corresponding to the event-type alarm; input the current event-type alarm set, the business indicator-type alarm corresponding to each event-type alarm in the current event-type alarm set, and their degree of impact, into the operation and maintenance big model to obtain a comprehensive report on the impact of the business indicators corresponding to the current event-type alarm set.

[0135] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 7 As shown, the electronic device control unit 700 includes a memory 701 and a processor 702. The memory 701 is used to store a computer program, and when the processor 702 executes the computer program, it implements the method of any of the above embodiments. A communication link is provided between the memory 701 and the processor 702. Exemplarily, the memory 701 and the processor 702 can communicate via a communication bus 703.

[0136] Optionally, the processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), or application-specific integrated circuits (ASICs). A general-purpose processor may be a microprocessor or any conventional processor. The steps in the method embodiments disclosed herein may be directly executed by a hardware processor or by a combination of hardware and software modules within the processor.

[0137] An embodiment of the present application further provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, a method in any of the above method embodiments is implemented.

[0138] An embodiment of the present application further provides a computer program product, including a computer program, which implements the method in any of the above method embodiments when the computer program is executed by a processor.

[0139] It should be noted that for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that this application is not limited by the order of the actions described, because according to this application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all optional embodiments, and the actions and modules involved are not necessarily required by this application.

[0140] It should be understood that the above-described device embodiments are merely illustrative, and the device of the present application may also be implemented in other ways. For example, the division of units / modules in the above-described embodiments is merely a logical functional division, and actual implementations may employ other division methods. For example, multiple units, modules, or components may be combined or integrated into another system, or some features may be omitted or not implemented.

[0141] In the above embodiments, the description of each embodiment has its own emphasis. For parts not described in detail in a particular embodiment, please refer to the relevant description of other embodiments. The technical features of the above embodiments can be combined in any way. To keep the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0142] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present application that follow the general principles of the present application and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0143] It should be understood that the present application is not limited to the exact structure described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. An alarm processing method, characterized in that: include: Based on a preset time window size, multiple alarms within a historical period are extracted to obtain historical alarm transactions corresponding to each of the multiple time windows; wherein the multiple alarms include at least one event-type alarm and at least one business indicator-type alarm, each of the event-type alarm and the business indicator-type alarm corresponds to multiple alarm types, and the historical alarm transactions corresponding to the time window include at least one alarm within the time window; wherein the event-type alarm is used to indicate a system failure in an information system, and the business indicator-type alarm is used to indicate an abnormality in an indicator of a transaction business implemented based on the information system; Determine a frequent item set combination based on historical alarm transactions corresponding to each time window in the multiple time windows, and construct an alarm-related knowledge graph based on the frequent item set combination; wherein the frequent item set combination includes multiple frequent item sets, the frequent item sets include at least one alarm type, and any node in the alarm-related knowledge graph corresponds to an alarm type in the frequent item set combination; According to the current event-type alarm set to be queried, the alarm-related knowledge graph is queried to determine the business indicator-type alarm corresponding to each event-type alarm in the current event-type alarm set.

2. The method according to claim 1, characterized in that The determining of a frequent item set combination according to the historical alarm transactions corresponding to each of the multiple time windows includes: For any alarm type in the historical alarm transactions corresponding to each of the multiple time windows, determine a minimum support threshold corresponding to the alarm type according to the priority of the alarm type, and determine the support of the alarm type according to the number of occurrences of the alarm type in the historical alarm transactions corresponding to each of the multiple time windows; wherein, the higher the priority, the smaller the minimum support threshold corresponding to the alarm type; If the support is greater than the minimum support threshold, determining the alarm type as a frequent item; The frequent item set combination is determined according to a plurality of frequent items corresponding to each of the plurality of time windows.

3. The method according to claim 1, characterized in that The step of constructing an alarm-related knowledge graph based on the combination of the frequent itemsets includes: Determining, based on the frequent item set combination, association rules between different alarm types in the frequent item set combination to obtain a plurality of association rules; wherein the association rules between any two of the different alarm types include a first association rule and a second association rule, and the first association rule and the second association rule have an opposite causal relationship; According to the multiple association rules, the alarm association knowledge graph is constructed.

4. The method according to claim 3, characterized in that The step of constructing the alarm association knowledge graph according to the plurality of association rules includes: Filtering the plurality of association rules according to preset filtering conditions to obtain filtered target association rules; According to the target association rules, the alarm association knowledge graph is constructed.

5. The method according to claim 4, characterized in that The filtering of the plurality of association rules according to the preset filtering conditions to obtain the filtered target association rules includes: If the preset screening condition includes confidence, the confidence of each of the association rules is calculated, and an association rule whose confidence is greater than a confidence threshold among the multiple association rules is determined as the target association rule; The confidence level is used to measure the reliability of the association rule.

6. The method according to claim 4, characterized in that The filtering of the plurality of association rules according to the preset filtering conditions to obtain the filtered target association rules includes: If the preset screening condition includes a causal relationship, the association rule whose cause is an event-type alarm and whose result is a business-type indicator alarm among the multiple association rules is determined as the target association rule.

7. The method according to claim 4, characterized in that The step of constructing the alarm association knowledge graph according to the target association rule includes: Determining the confidence of the target association rule, and constructing the alarm association knowledge graph using the target association rule and the confidence of the target association rule; The step of querying the alarm-associated knowledge graph based on the current event-type alarm set to be queried, and determining the business indicator-type alarm corresponding to each event-type alarm in the current event-type alarm set, includes: According to the current event-type alarm set to be queried, the alarm-related knowledge graph is queried to determine the business indicator-type alarm corresponding to each event-type alarm in the current event-type alarm set and the corresponding confidence level and output them.

8. The method according to any one of claims 1 to 7, characterized in that After determining the business indicator type alarm corresponding to each event type alarm in the current event type alarm set, the method further includes: For any event-type alarm in the current event-type alarm set, calculate the degree of influence of the event-type alarm on the business indicator-type alarm corresponding to the event-type alarm based on the difference between the real-time indicator value and the preset indicator value of the business indicator corresponding to the business indicator-type alarm corresponding to the event-type alarm; The current event-type alarm set, the business indicator-type alarms corresponding to each event-type alarm in the current event-type alarm set, and their impact levels are input into the operation and maintenance big model to obtain a comprehensive report on the business indicator impact corresponding to the current event-type alarm set.

9. An alarm processing device, characterized in that: include: A historical alarm transaction determination module is configured to extract, based on a preset time window size, multiple alarms within a historical period to obtain historical alarm transactions corresponding to each of the multiple time windows; wherein the multiple alarms include at least one event-type alarm and at least one business indicator-type alarm, each of which corresponds to multiple alarm types, and the historical alarm transactions corresponding to the time window include at least one alarm within the time window; wherein the event-type alarm is used to indicate a system failure in the information system, and the business indicator-type alarm is used to indicate an anomaly in an indicator of a transaction business implemented based on the information system; an alarm-associated knowledge graph construction module, configured to determine a frequent item set combination based on historical alarm transactions corresponding to each of the multiple time windows, and to construct an alarm-associated knowledge graph based on the frequent item set combination; wherein the frequent item set combination includes multiple frequent item sets, each of which includes at least one alarm type, and any node in the alarm-associated knowledge graph corresponds to an alarm type in the frequent item set combination; The query module is used to query the alarm-related knowledge graph based on the current event-type alarm set to be queried, and determine the business indicator-type alarm corresponding to each event-type alarm in the current event-type alarm set.

10. An electronic device, characterized in that: include: a processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 6.

11. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

12. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 6 when the computer program is executed by a processor.

Images