A method and apparatus for recommending an alarm node

Abstract

The application provides a method and device for recommending an alarm node, wherein the topological relationship, level and alarm data in a specified time window of each alarm node are acquired, the alarm time sequence feature score of each alarm node is determined according to the alarm time and the topological relationship, the topological influence range score of each alarm node is determined according to the topological relationship and the level, the abnormal intensity score of each alarm node is determined according to the alarm level and the alarm level weight, the comprehensive confidence score of each alarm node is comprehensively determined, the scores are determined through the time dimension, the topological influence and the alarm abnormal intensity, the decision process is clear and the accuracy of the comprehensive confidence score is improved, the recommended alarm node is determined according to the size of the quantitative comprehensive confidence score, a clear troubleshooting order basis is provided for operation and maintenance personnel, and the fault positioning efficiency is improved.

Description

Technical Field

[0001] This application relates to the field of operation and maintenance, and in particular to a recommended method and device for alarm nodes. Background Technology

[0002] In the field of operations and maintenance, with the widespread adoption of technologies such as microservices and containerization, the scale and complexity of systems have increased dramatically. When a failure occurs, a large number of alarms are often generated in a short period of time, forming an "alarm storm," making it difficult for operations and maintenance personnel to quickly identify the source of the failure. Existing root cause localization methods for alarm nodes have the following shortcomings: (1) The feature dimension is single, and some solutions rely only on topological distance or time-series features for inference, resulting in insufficient recommendation accuracy; (2) The decision-making process of some solutions using end-to-end machine learning models is not transparent, and the recommendation results lack interpretability, making it difficult for operations and maintenance personnel to review and analyze; (3) The output granularity is coarse, only providing binary classification judgments, and failing to provide quantitative confidence levels. Operations and maintenance personnel still lack clear troubleshooting priorities, resulting in low efficiency in fault localization. Summary of the Invention

[0003] This application provides a method and apparatus for recommending alarm nodes to solve at least one problem existing in related technologies. The technical solution is as follows: Firstly, embodiments of this application provide a method for recommending alarm nodes, including: Obtain the topology, hierarchy, and alarm data within a specified time window for each alarm node. The alarm data includes the alarm time and alarm level for each alarm. Based on the alarm time and the topological relationship, the alarm timing feature score of each alarm node is determined. Based on the topological relationship and the hierarchy, determine the topological influence range score of each alarm node; An anomaly strength score is determined for each alarm node based on the alarm level and alarm level weight. Based on the alarm timing feature score, the topology influence range score, and the anomaly intensity score, a comprehensive confidence score is determined for each alarm node, and a recommended alarm node is determined based on the comprehensive confidence score.

[0004] In one implementation, determining the alarm timing feature score of each alarm node based on the alarm time and the topological relationship includes: The initial timing score of each alarm node is determined based on the alarm time and the time decay coefficient, respectively. Based on the topological relationship, the initial timing score is corrected to obtain the alarm timing feature score of each alarm node.

[0005] In one implementation, determining the initial timing score of each alarm node based on the alarm time and the time decay coefficient includes: From all the alarm times, determine the earliest alarm time and the first alarm time corresponding to each alarm node; For each alarm node, the time difference between the first alarm time and the earliest alarm time is determined. Attenuation calculations are performed based on the time difference to obtain the initial timing score for each alarm node.

[0006] In one implementation, the step of correcting the initial time-series scores according to the topological relationship to obtain the alarm time-series feature score for each alarm node includes: Based on the topology, each pair of adjacent alarm nodes is determined, and the pair of adjacent alarm nodes includes an upstream alarm node and a downstream alarm node with an upstream-downstream dependency relationship. For each pair of adjacent alarm nodes, if the initial timing score of the downstream alarm node is higher than the initial timing score of the upstream alarm node, then the initial timing scores of the downstream alarm node and the upstream alarm node are exchanged to determine the alarm timing feature score of each alarm node. Alternatively, the initial timing score of one of the upstream alarm node and the downstream alarm node is corrected so that the corrected alarm timing feature score of the upstream alarm node is not lower than the alarm timing feature score of the downstream alarm node, thus obtaining the alarm timing feature score of each alarm node.

[0007] In one implementation, determining the topology influence range score of each alarm node based on the topology relationship and the hierarchy includes: Based on the respective levels, a basic score corresponding to each level is determined, and the magnitude of the basic score is negatively correlated with the distance between the level and the infrastructure layer. For each alarm node, based on the topology, determine the number of adjacent affected alarm nodes that are affected by the alarm and are located upstream of the alarm node. Based on the number of nodes and the hierarchical base score, determine the topology influence range score for each alarm node. or, Using a weighted propagation graph traversal algorithm, starting from each alarm node, at least one propagation path is traversed according to the topological relationship. The hierarchical base score, edge dependency strength weight, and path depth decay factor corresponding to the alarm node on the propagation path are accumulated and calculated to determine the topological influence range score of each alarm node.

[0008] In one implementation, determining the topology impact range score for each alarm node based on the number of nodes and the hierarchical base score includes: The upstream influence amplification factor for each alarm node is determined based on the number of nodes and the logarithmic function, respectively. The topological influence score is determined by multiplying the upstream influence amplification factor by the hierarchical base score. The topology impact score is compared with the upper limit of the score. If the topology impact score is less than or equal to the upper limit of the score, the topology impact score is used as the topology impact range score of the alarm node. If the topology impact score is greater than the upper limit of the score, the upper limit of the score is used as the topology impact range score of the alarm node, thus obtaining the topology impact range score of each alarm node.

[0009] In one implementation, determining the anomaly strength score of each alarm node based on the alarm level and the alarm level weight includes: For each alarm node, the number of levels corresponding to each alarm level is determined, and the number of levels is multiplied by the alarm level weight corresponding to the alarm level to obtain each weight item. For each alarm node, the weight items are summed to obtain the candidate anomaly strength score of each alarm node. The candidate anomaly strength score of each alarm node is used as the anomaly strength score of each alarm node. Alternatively, for each alarm node, the duration between the first alarm time and the latest alarm time is determined to determine the abnormal duration factor, and the abnormal intensity score of each alarm node is determined based on the abnormal duration factor and the candidate abnormal intensity score.

[0010] In one implementation, determining a comprehensive confidence score for each alarm node based on the alarm timing feature score, the topology influence range score, and the anomaly intensity score, and then determining a recommended alarm node based on the comprehensive confidence score, includes: The comprehensive confidence score of each alarm node is obtained by weighted summation based on the alarm timing feature score, time weight, topology influence range score, influence weight, anomaly intensity score, and intensity weight; wherein, the magnitude of time weight, influence weight, and intensity weight is determined based on different business scenario weight strategies, historical data supervised learning, or configuration page settings. The comprehensive confidence scores are arranged from high to low, and the alarm nodes corresponding to the top preset number of comprehensive confidence scores are used as recommended alarm nodes.

[0011] In one embodiment, the method includes: Before determining the alarm timing feature score of each alarm node, for each alarm node, all alarms are filtered according to the masking rules to determine the valid alarms. The alarms that are identical and valid, or valid alarms that are spaced less than a time threshold, are deduplicated and merged to update the alarm data.

[0012] In one embodiment, the method further includes: When alarm levels exist for different alarm sources, the alarm levels are mapped to a unified alarm level according to the alarm level mapping configuration; if the alarm level does not match the alarm level mapping configuration, the alarm level is mapped to the default alarm level.

[0013] In one implementation, the alarm level weight is determined in the following way: The default base weight corresponding to the alarm level is used as the alarm level weight; or, Determine the indicator type of the indicator corresponding to the alarm, adjust the default base weight corresponding to the alarm level according to the indicator type, and determine the alarm level weight, or use the default type weight corresponding to the indicator type as the alarm level weight.

[0014] Secondly, embodiments of this application provide a device for recommending alarm nodes, comprising: The acquisition module is used to acquire the topological relationship, hierarchy, and alarm data within a specified time window of each alarm node. The alarm data includes the alarm time and alarm level of each alarm. The first determining module is used to determine the alarm timing feature score of each alarm node based on the alarm time and the topological relationship, respectively. The second determining module is used to determine the topology influence range score of each alarm node based on the topology relationship and the hierarchy, respectively. The third determining module is used to determine the anomaly intensity score of each alarm node based on the alarm level and the alarm level weight, respectively. The fourth determining module is used to determine the comprehensive confidence score of each alarm node based on the alarm timing feature score, the topology influence range score, and the anomaly intensity score, and to determine the recommended alarm node based on the comprehensive confidence score.

[0015] In one embodiment, the acquisition module is further configured to: Before determining the alarm timing feature score of each alarm node, for each alarm node, all alarms are filtered according to the masking rules to determine the valid alarms. The alarms that are identical and valid, or valid alarms that are spaced less than a time threshold, are deduplicated and merged to update the alarm data.

[0016] In one implementation, the third determining module is further configured to: When alarm levels exist for different alarm sources, the alarm levels are mapped to a unified alarm level according to the alarm level mapping configuration; if the alarm level does not match the alarm level mapping configuration, the alarm level is mapped to the default alarm level.

[0017] Thirdly, embodiments of this application provide an electronic device, including: a processor and a memory, wherein the memory stores instructions that are loaded and executed by the processor to implement the methods in any of the above-described embodiments.

[0018] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed, implements the methods in any of the above-described embodiments.

[0019] The beneficial effects of the above technical solution include at least the following: By acquiring the topological relationships, hierarchies, and alarm data (including alarm time and alarm level for each alarm) of each alarm node within a specified time window, the system determines the alarm timing feature score, topological influence range score, and anomaly intensity score based on alarm level and alarm level weight. Finally, it calculates the comprehensive confidence score for each alarm node using multiple feature dimensions—time, topological influence, and alarm anomaly intensity—leading to a clear decision-making process and improved accuracy of the comprehensive confidence score. Based on the quantified comprehensive confidence score, recommended alarm nodes are determined, providing maintenance personnel with a clear order of investigation and improving fault location efficiency.

[0020] The above overview is for illustrative purposes only and is not intended to be limiting in any way. In addition to the illustrative aspects, embodiments, and features described above, these aspects, embodiments, and features will become readily apparent from the accompanying drawings and the following detailed description. Attached Figure Description

[0021] In the accompanying drawings, unless otherwise specified, the same reference numerals throughout the various drawings denote the same or similar parts or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings depict only some embodiments disclosed in this application and should not be construed as limiting the scope of this application.

[0022] Figure 1 This is a flowchart illustrating the steps of a recommended method for an alarm node according to an embodiment of this application; Figure 2 This is a structural block diagram of a recommended device for an alarm node according to an embodiment of this application; Figure 3 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0023] In the following description, only certain exemplary embodiments are briefly described. As those skilled in the art will recognize, the described embodiments can be modified in various ways without departing from the spirit or scope of this application. Therefore, the drawings and description are considered to be exemplary in nature and not restrictive.

[0024] Reference Figure 1 The flowchart illustrates a method for recommending alarm nodes according to an embodiment of this application. This method may include at least steps S100-S500: S100: Obtain the topology, hierarchy, and alarm data within a specified time window for each alarm node. The alarm data includes the alarm time and alarm level for each alarm.

[0025] In this embodiment, an alarm node is a node that has triggered or is currently triggering an alarm. Each alarm node has node data, including but not limited to a unique node identifier (ID), node name, node type (e.g., MySQL, K8s-Pod, Nginx, etc.), its topology level (abbreviated as level, which can be automatically mapped through the CMDB object model type), IP address (or hostname), running status, tag information, and a list of upstream and downstream dependency edges between nodes. The list of upstream and downstream dependency edges records the ID of the source node connected to both ends of the connection edge, the ID of the target node, and the dependency type (e.g., call, deployment, connection, etc.). Therefore, based on the list of upstream and downstream dependency edges, the topology relationship of each alarm node can be obtained, and the level of each alarm node can be directly obtained from the node data.

[0026] It should be noted that each time an alarm occurs on a node, alarm information will be generated. The alarm information includes, but is not limited to, the alarm unique identifier (ID), the timestamp of the alarm occurrence (i.e., the alarm time), the alarm level (such as Fatal / Critical / Warning / Info), the unique identifier (ID) of the associated node, the alarm title, the alarm description text, etc.

[0027] In some cases, the obtained alarm levels may be inconsistent. For example, when different alarm sources exist, the level configurations for different alarm sources may differ. Therefore, when alarm levels exist for different alarm sources, these original alarm levels can be mapped to standard, unified alarm levels (e.g., mapping crit / critical to Fatal, warn to Warning, and info to remind) based on the alarm level mapping configuration table (which includes the mapping relationship between alarm levels from different data sources and a unified alarm level). If an alarm level does not match the alarm level mapping configuration (i.e., when no mapping relationship can be found in the alarm level mapping configuration), this alarm level will be mapped to the default alarm level, such as being treated as remind. Furthermore, the length of the specified time window can be configured as needed, such as 24 hours. Therefore, based on the timestamp of the alarm (i.e., the alarm time), alarm information within 24 hours prior to the current time can be determined, thus obtaining the alarm data of each alarm node within the specified time window (i.e., alarm data within 24 hours).

[0028] In one implementation, before S200, after acquiring alarm data within a specified time window, alarm data preprocessing can be performed to update the alarm data. The updated alarm data serves as the basis for data processing in subsequent steps. In another implementation, preprocessing may be omitted, and no specific limitation is made. In the embodiments of this application, preprocessing includes, but is not limited to: 1. For each alarm node, filter all alarms according to the blocking rules to determine the valid alarms.

[0029] Optionally, filtering rules can be pre-defined to proactively filter invalid alarms in specific scenarios, retaining only valid alarms and avoiding invalid interference in subsequent analysis. For example, filtering rules include, but are not limited to: filtering alarms corresponding to certain specified nodes, IP addresses, alarm titles, specified keywords in alarm description text, specified alarm levels, silent windows, and data missing (such as one or more missing alarm information), retaining the remaining alarms as valid alarms for further processing. It should be noted that in some embodiments, alarms corresponding to data missing may not be filtered; instead, data completion processing can be used to fill in the missing parts.

[0030] 2. Duplicate and merge identical and valid alarms or valid alarms that are less than a time interval of less than a time threshold to update the alarm data.

[0031] Optionally, for each alarm node, after determining the valid alarms to be retained, duplicate and merge valid alarms that are the same (e.g., the same alarm level and / or the same alarm title) or duplicate and merge valid alarms that are less than a time threshold (e.g., 30 seconds, i.e., the time interval between two adjacent alarms in the same alarm node is less than 30 seconds) to update the alarm data.

[0032] S200. Determine the alarm timing feature score for each alarm node based on the alarm time and topology relationship.

[0033] S300: Determine the topology impact range score for each alarm node based on the topology relationship and hierarchy.

[0034] S400: Determine the anomaly strength score for each alarm node based on the alarm level and alarm level weight.

[0035] S500 determines the comprehensive confidence score of each alarm node based on the alarm timing feature score, topology influence range score, and anomaly intensity score, and determines the recommended alarm node based on the comprehensive confidence score.

[0036] The technical solution of this application embodiment obtains the topological relationship, hierarchy, and alarm data (including alarm time and alarm level for each alarm) of each alarm node within a specified time window. Based on the alarm time and topological relationship, it determines the alarm timing feature score of each alarm node; based on the topological relationship and hierarchy, it determines the topological influence range score of each alarm node; based on the alarm level and alarm level weight, it determines the anomaly intensity score of each alarm node; and based on the alarm timing feature score, topological influence range score, and anomaly intensity score, it determines the comprehensive confidence score of each alarm node. The scoring is performed using multiple feature dimensions such as time, topological impact, and alarm anomaly intensity, resulting in a clear decision-making process that improves the accuracy of the comprehensive confidence score. Based on the quantified comprehensive confidence score, recommended alarm nodes are determined, providing maintenance personnel with a clear basis for troubleshooting order and improving fault location efficiency.

[0037] In one implementation, step S200 includes steps S210-S220: S210. Determine the initial timing score of each alarm node based on the alarm time and the time decay coefficient.

[0038] First, from all alarm times, determine the earliest alarm time t_window_earliest and the first alarm time t_node_first corresponding to each alarm node. For example, if there are 5 alarms, the time of the first alarm is the first alarm time, and the earliest alarm time is the earliest first alarm time among all the first alarm times.

[0039] Then, for each alarm node, the time difference Delta_t between the first alarm time and the earliest alarm time is determined: Delta_t = t_node_first - t_window_earliest.

[0040] Finally, attenuation calculations are performed based on the time difference to obtain the initial time-series score S_Time_Raw for each alarm node. The attenuation calculation includes three methods: The first method, the specific formula is: S_Time_Raw = 100 ×e (-lambda × Delta_t) Wherein, 100 is the upper limit of the score, which can be denoted as S_max. In other implementations, it is not limited to 100. lambda is the time decay coefficient, lambda = ln(2) / T_half. T_half is the preset half-life parameter, which can be set based on different business scenarios. For example, business scenarios include real-time scenarios (such as high-frequency transactions, real-time risk control, microservice synchronous call chains, etc., which are time-sensitive and have extremely short fault propagation delays), standard scenarios (general default scenarios, such as typical production environments), and batch processing scenarios (scenarios with long propagation delays, such as time-insensitive, timed task execution, offline batch processing jobs, and asynchronous systems with retry and queuing mechanisms). For example, the half-life parameter T_half of real-time scenarios, standard scenarios, and batch processing scenarios can be 15 seconds, 60 seconds, and 300 seconds, respectively. In this application embodiment, T_half can be preset for business units including several alarm nodes and read directly.

[0041] The second method uses a linear decay model as its specific formula: S_Time_Raw = max(0, 100- k×Delta_t) Wherein, 100 is the upper limit of score S_max, k is the linear attenuation slope, for example, k=1 by default, that is, 1 point is attenuated per second, and the score becomes zero after 100 seconds. The linear attenuation model is suitable for scenarios with uniform requirements for timing sensitivity. For example, in operation and maintenance scenarios, fault propagation delay is basically linearly distributed, and the troubleshooting timeliness in each time period is equally important, and there is no obvious non-uniform preference such as "the earlier the more important" or "only focus on the first-wave alarm". For example, typical business scenarios include: uniform microservice links with synchronous RPC calls among all services, and a comprehensive monitoring dashboard where alarms in each time period require equal attention. It should be noted that k can be adjusted as required based on business scenarios. For example, for real-time scenarios, a larger k value (e.g., k=2~5) is set to make the timing score attenuate rapidly, highlighting the alarm node where the anomaly occurs earliest; while for batch processing scenarios, a smaller k value (e.g., k=0.2~0.5) is set to make the initial timing score attenuate gently, improving timing resolution.

[0042] The third method is specifically: dividing the time difference Delta_t into intervals, each interval adopts a different attenuation rate, and configuring the corresponding interval ranges of the fast zone, transition zone and stationary zone for judgment. All 100 in the following are examples of the upper score limit S_max, and are not specifically limited: Fast zone (0<= Delta_t<= 60s): no attenuation, S_Time_Raw = 100, which is the upper score limit S_max; Transition zone (60s<Delta_t<= 300s): linear attenuation, S_Time_Raw = max(10, 100 - k2 ×(Delta_t - 60)), wherein k2 is the attenuation slope of the transition zone (k2=0.4 by default).

[0043] Stationary zone (Delta_t> 300s): retain a preset base score, such as 10, that is S_Time_Raw = 10.

[0044] S220, according to the topological relationship, performing correction processing on the initial timing scores respectively to obtain the alarm timing feature score of each alarm node.

[0045] First, according to the topological relationship, determining each adjacent alarm node pair, wherein the adjacent alarm node pair includes an upstream alarm node and a downstream alarm node with upstream-downstream dependency. For example, there are alarm nodes A, B, and C, based on the topological relationship, there is A→B→C, then the adjacent alarm node pair A (as the upstream alarm node) and B (as the downstream alarm node), and the adjacent alarm node pair B (as the upstream alarm node) and C (as the downstream alarm node) can be determined.

[0046] Then, for each pair of adjacent alarm nodes, if the initial time-series score of the downstream alarm node is higher than that of the upstream alarm node, the initial time-series scores of the downstream and upstream alarm nodes are swapped to determine the alarm time-series feature score of each alarm node. For example, taking adjacent alarm node pairs A and B as an example, the initial time-series scores S_Time_Raw of A and B are compared respectively: 1. Assume that the initial time series score S_Time_Raw of B is 80 points and the initial time series score S_Time_Raw of A is 90 points. If 80≤90, no adjustment is needed. The current initial time series scores S_Time_Raw of A and B are respectively used as their own alarm time series feature scores, denoted as S_Time.

[0047] 2. Assume that the initial time series score S_Time_Raw of B is 95 points and the initial time series score S_Time_Raw of A is 90 points. Since 95 > 90, the initial time series scores of A and B are swapped (also known as interchange). After the swap, the initial time series score S_Time_Raw of B is updated to 90 points and used as the alarm time series feature score of B. The initial time series score S_Time_Raw of A is updated to 95 points.

[0048] It should be noted that when performing the above exchange, the process can be carried out in the order from upstream to downstream based on the topological relationship, such as A→B→C. Assuming that A has no upstream node, then the process is based on the above steps. First, analyze A and B to determine whether A and B need to be swapped. If they do not need to be swapped, then the initial timing score of A is its alarm timing feature score. B is temporarily set as the alarm timing feature score in the comparison of A and B. It is necessary to analyze B and C. If they do not need to be swapped, then the temporary alarm timing feature score of B is determined as the final alarm timing feature score. If they need to be swapped, then the final alarm timing feature score of B is the initial timing score of C. If C has a downstream node, continue the analysis. If it does not have a downstream node, then the temporary alarm timing feature score of B is the final alarm timing feature score of C. If there is a swap, then the alarm timing feature score of A becomes the initial timing score of B. After the swap, the initial timing score of A becomes the temporary alarm timing feature score of B (which can be called the new initial timing score). Then it is compared with C until no downstream node can be found.

[0049] In one implementation, in addition to exchanging, the initial timing score of one of the upstream alarm nodes and the downstream alarm nodes can be corrected so that the alarm timing feature score of the upstream alarm node is not lower than the alarm timing feature score of the downstream alarm node, thereby obtaining the alarm timing feature score of each alarm node.

[0050] For example, suppose the initial timing score S_Time_Raw of B is 95 points and the initial timing score S_Time_Raw of A is 90 points. Since 95 > 90, the initial timing score of A can be corrected to make A greater than 95, for example, 96 points. Then the corrected alarm timing feature score of A will be 96, and the initial timing score of B will be used as its alarm timing feature score. Alternatively, B can be corrected to make B less than 90 points, for example, 88. The corrected alarm timing feature score of B will be 88, and the initial timing score of A will be used as its alarm timing feature score.

[0051] Therefore, after the exchange, it is ensured that the alarm timing feature score S_Time of the upstream alarm node is not lower than that of the downstream alarm node in the upstream-to-downstream topology relationship. This avoids the unreasonable situation of the downstream alarming first, realizes the positive correction of the timing judgment by the topology relationship, ensures the rationality and effectiveness of the alarm timing feature score, solves the problem of pure timing inference distortion caused by the downstream node issuing alarms first due to response timeout and other reasons, and makes the evaluation results of the timing dimension consistent with the physical causal logic.

[0052] In one implementation, step S300 includes steps S310-S330: S310. Determine the basic score for each level based on the level.

[0053] Optionally, the level base score is negatively correlated with the distance between the level and the infrastructure layer; that is, the closer the level is to the infrastructure layer, the higher the level base score B_level. In this embodiment, the level is determined by automatic mapping of CMDB object model types. For example, when observing topology data synchronously from CMDB, each configuration item (CI) has an object model type attribute (e.g., the object type of a MySQL instance is Database / MySQL, and the object type of a Kubernetes node is Container / K8s-Node). The system has a built-in mapping table from object model types to topology levels, and the level corresponding to a node can be determined based on this mapping table.

[0054] For example, the following is an example of the hierarchical base score B_level, which does not constitute a specific limitation: 50 points — Infrastructure Layer (Network Layer): Switches, Firewalls, Load Balancers, DNS; 45 minutes — Hardware layer: physical servers, storage arrays, SAN; 40 points — Host layer (OS): Linux / Windows virtual machines, operating system kernel; 35 minutes — Container Orchestration Layer: Kubernetes Nodes, Docker Engine; 30 minutes — Database layer: MySQL, Oracle, Redis; 25 points — Middleware layer: Kafka, RabbitMQ, Nginx; 15 points — Application service layer: Java / Go microservices, backend API; 5 points — Terminal application layer: Web front-end, iOS / Android applications.

[0055] S320. For each alarm node, based on the topology, determine the number of adjacent affected alarm nodes that are upstream of the alarm node and are affected by the alarm. Based on the number of nodes and the hierarchical base score, determine the topology influence range score for each alarm node.

[0056] Optionally, for each alarm node, based on the topology, determine the number of adjacent affected alarm nodes located upstream of the alarm node that are affected by the alarm. For example, an impact time window (e.g., 30 seconds or several minutes) can be set. Taking A→B→C as an example, if an alarm is found to occur in A within the impact time window after the alarm time of B, then A can be considered to be affected by the alarm of B. A is an adjacent affected alarm node located upstream of the alarm node that is affected by the alarm. Then, the number of nodes N_upstream is counted. For example, if there is another node D upstream of B that meets the condition, then there are A and D, so the number of nodes is 2.

[0057] In this embodiment of the application, the topology impact range score of each alarm node is determined based on the number of nodes and the hierarchical base score, specifically: First, the upstream influence amplification factor Factor for each alarm node is determined based on the number of nodes N_upstream and the logarithmic function log. The logarithmic function is used to ensure that the topology influence range score decreases marginally with the increase of the number of upstream affected nodes. The specific formula is as follows: Factor = 1 + log 10 (1 + N_upstream) Then, the topological influence score is determined by multiplying the upstream influence amplification factor and the hierarchical base score: S_T = B_level × Factor.

[0058] Finally, the topology impact score is compared with the upper limit of the score. If the topology impact score is less than or equal to the upper limit of the score, the topology impact score is used as the topology impact range score of the alarm node. If the topology impact score is greater than the upper limit of the score, the upper limit of the score is used as the topology impact range score of the alarm node, thus obtaining the topology impact range score of each alarm node.

[0059] Optionally, a score cap S_max is set, for example, to 100. The topology impact score S_T is compared with the score cap S_max. If the topology impact score S_T is less than or equal to the score cap S_max, the topology impact score S_T is used as the topology impact range score S_Impact of the alarm node; if the topology impact score S_T is greater than the score cap S_max, the score cap S_max is used as the topology impact range score S_Impact of the alarm node. The specific formula for obtaining the topology impact range score S_Impact of each alarm node is as follows: S_Impact = min(100, B_level × Factor) S330. Using a weighted propagation graph traversal algorithm, starting from each alarm node, at least one propagation path is traversed according to the topological relationship. The basic score of the level, the edge dependency strength weight, and the path depth decay factor corresponding to the alarm node on the propagation path are accumulated and calculated to determine the topological influence range score of each alarm node.

[0060] Specifically, the formula is: S_Impact=sum_over_path_P [B_level(node_j)×W_edge(j-1 ->j) × decay (depth_j) ] Where sum_over_path_P is the summation of P, where P is the set of propagation paths that traverse upstream from the alarm node based on the topological relationship. For example, if there are 3 propagation paths, denoted as P1, P2, and P3, the S_Impact of each of the 3 paths will be calculated. The S_Impact with the highest score will be taken as the candidate S_Impact. Then, the minimum of S_max (100) and the candidate S_Impact will be taken as the final topological influence range score S_Impact. Therefore, by taking each alarm node as the starting point, the topological influence range score of each alarm node can be determined. This method more precisely depicts the actual propagation path and attenuation process of the alarm in the topology. Where node_j is the alarm node located at level j on the propagation path (the level is determined by the number of hops from the originating alarm node); B_level(node_j) is the level base score of alarm node node_j; W_edge(j-1->j) is the edge dependency strength weight of the edge connecting node_(j-1) to node_j (preset based on call frequency or dependency type); decay is a preset path depth decay factor between 0 and 1 (default decay=0.7); depth_j is the depth of node_j in the path (the originating alarm node itself has depth_0=0).

[0061] In one embodiment, step S400 includes steps S410-S420: S410. For each alarm node, determine the number of levels corresponding to each alarm level, multiply the number of levels by the alarm level weight corresponding to the alarm level to obtain each weight item; for each alarm node, sum the weight items to determine the abnormal intensity score of each alarm node.

[0062] Optionally, alarm levels, from highest to lowest, include but are not limited to Fatal / Critical level / Level 1, Warning level / Level 2, and Remind / Info level / Level 3. For example, the default base weights corresponding to alarm levels from highest to lowest are pre-configured as 6, 3, and 1. If none of the above specific alarm levels are found, the default alarm level is Remind / Info level / Level 3, with a corresponding default base weight of 1. In one implementation, the default base weight can be directly used as the alarm level weight. In another implementation, the indicator type corresponding to the alarm can be determined, and then the default base weight corresponding to the alarm level can be adjusted according to the indicator type to determine the alarm level weight. Alternatively, default type weights corresponding to different indicator types can be pre-configured, and then the default type weights corresponding to the indicator types can be used as the alarm level weights.

[0063] It's important to note that an alarm is always triggered when a specific metric is abnormal. At this point, the metric type corresponding to the alarm can be determined. Metric types include, but are not limited to, life / death metrics, alarm metrics, and analytical metrics. For example, life / death metrics are used to characterize metrics that directly reflect instance availability, such as heartbeat, connectivity, and online status; alarm metrics serve as the baseline type; and analytical metrics are used to characterize trend-related, capacity-related, or reference-related anomalies. When no metric type is configured for the alarm's corresponding metric, the default base weight is applied without adjustment. The adjustment range of the default base weight for different metric types, as well as the default type weight for different metric types, can be configured as needed without specific limitations.

[0064] For example, taking the default base weight as the alarm level weight, assuming that the alarm is triggered based on the normal range, then the level can be determined based on the degree to which it exceeds the normal range; if it is an availability impact, such as service downtime → fatal, slow response time → warning, occasional timeout → alert; if it is a time-sensitive requirement, it needs to be handled immediately → fatal, can be handled in a planned manner → warning, only needs to be monitored → alert; if it is an impact scope, full business interruption → fatal; some business affected → warning, individual functions abnormal → alert, without specific limitations.

[0065] In this embodiment of the application, for each alarm node, the number of levels corresponding to each alarm level is determined. For example, for 6 alarms, there is 1 fatal level, 2 warning levels, and 3 alert levels. Then the number of levels corresponding to the fatal level, warning level, and alert level are 1, 2, and 3 respectively, denoted as Count_level. i , representing the number of alarm levels for the i-th alarm level, and the alarm level weight corresponding to the alarm level is denoted as W_level. i , representing the alarm level weight corresponding to the i-th alarm level. Then, count_level for each level. i Alarm level weight W_level corresponding to the alarm level i Multiplying them together yields the individual weights: (Count_level) i × W_level i ).

[0066] Optionally, for each alarm node, the weights are summed to obtain the summation result: sum(Count_level) i × W_level i To determine the candidate anomaly intensity score S_Intensity' for each alarm node, the summation result of each alarm node can be directly used as the candidate anomaly intensity score S_Intensity'. In another implementation, a score upper limit value S_max is set, for example, 100. The smaller value between the summation result and the set score upper limit value S_max is used as the final candidate anomaly intensity score S_Intensity', thus obtaining the candidate anomaly intensity score S_Intensity' for each alarm node. The specific formula is as follows: S_Intensity' = min(100, sum(Count_level i × W_level i )) S420. The candidate anomaly intensity score of each alarm node is used as the anomaly intensity score of each alarm node; or, for each alarm node, the duration between the first alarm time and the latest alarm time is determined to determine the anomaly duration factor, and the anomaly intensity score of each alarm node is determined according to the anomaly duration factor and the candidate anomaly intensity score.

[0067] In one implementation, the candidate anomaly intensity score S_Intensity' of each alarm node is directly used as the anomaly intensity score S_Intensity of each alarm node.

[0068] In another implementation, for each alarm node, the duration T_duration between the first alarm time and the latest alarm time is determined to establish an anomaly duration factor Duration_Factor. Based on the anomaly duration factor Duration_Factor and the candidate anomaly intensity score S_Intensity', the anomaly intensity score S_Intensity of each alarm node is then determined. The specific formula is as follows: S_Intensity= min(100, S_Intensity' × Duration_Factor) Duration_Factor = min(2, 1 + log 10 (1 + T_duration / T_unit) Where 100 is the maximum score value S_max, T_duration is in seconds, and T_unit is the preset unit time (e.g., 60 seconds); the maximum value of Duration_Factor is 2, which means that the abnormal duration factor will amplify the intensity score by a maximum of 1. By introducing the abnormal duration factor, it is possible to effectively distinguish between instantaneous jitter alarms (short duration, factor close to 1) and persistent fault alarms (long duration, factor close to or reaching 2), so that fault nodes that have been continuous for a long time and have not been dealt with in a timely manner can receive higher attention priority.

[0069] In one implementation, step S500 includes S510-S520: S510. The comprehensive confidence score of each alarm node is obtained by weighted summation based on the alarm timing feature score, time weight, topology influence range score, influence weight, anomaly intensity score, and intensity weight.

[0070] Specifically, the formula for calculating the Overall Confidence Score (RCS) is as follows: RCS = W_Time×S_Time + W_Impact×S_Impact + W_Intensity×S_Intensity Wherein, W_Time is the time weight, W_Impact is the impact weight, and W_Intensity is the intensity weight, and the sum of the three weights is 1. In this embodiment, the magnitudes of the time weight W_Time, the impact weight W_Impact, and the intensity weight W_Intensity are determined based on the weighting strategy for different business scenarios.

[0071] For example, a corresponding business scenario weighting strategy can be set based on different business scenarios, as exemplified below: The standard scenario's business scenario weighting strategy, denoted as the balancing strategy (default, general): W_Time=0.3, W_Impact=0.4, W_Intensity=0.3; The business scenario weighting strategy for real-time scenarios is denoted as the time-first strategy: W_Time=0.5, W_Impact=0.3, W_Intensity=0.2; The business scenario weighting strategy for trusted CMDB scenarios is denoted as the topology priority strategy, with W_Time=0.2, W_Impact=0.6, and W_Intensity=0.2. It is applicable to trusted CMDB scenarios, meaning that the accuracy of the CMDB meets the preset conditions. The judgment of meeting the preset conditions includes, but is not limited to, one or more aspects such as node discovery coverage, upstream and downstream topology relationships, node data integrity, and update timeliness, without specific limitations.

[0072] In some implementations, the time weight, impact weight, and intensity weight can be manually configured and determined by operations and maintenance personnel through the configuration interface; alternatively, it can be based on supervised learning of fault handling records corresponding to historical data: using the root cause nodes confirmed in historical data (i.e., historical target recommendation alarm nodes) as positive samples, automatically learning the optimal weight allocation, realizing automated parameter tuning, and further improving the accuracy and personalized adaptability of recommendations.

[0073] S520. Arrange the comprehensive confidence scores from high to low, and use the alarm nodes corresponding to the top preset number of comprehensive confidence scores as recommended alarm nodes.

[0074] Optionally, the overall confidence scores (RCS) are sorted from high to low. Assuming a preset number of K, the alarm nodes corresponding to the top K RCS are selected as recommended alarm nodes. This generates a TOP-K recommended list of alarm nodes, which allows maintenance personnel to intuitively and quickly locate the root cause alarm node based on the recommended list. The priority of troubleshooting can be arranged in an orderly manner according to the overall confidence scores (RCS), avoiding blind troubleshooting like searching for a needle in a haystack, and significantly improving fault location efficiency and maintenance efficiency.

[0075] In this embodiment, based on three explicit feature dimensions—fusion timing, topological influence range, and anomaly intensity—alarm nodes are comprehensively scored from three orthogonal perspectives: temporal sequence, propagation breadth, and activity intensity. This avoids the uncertainty and one-sidedness of information from a single dimension, significantly improving the accuracy and robustness of recommending alarm nodes as root cause nodes. Simultaneously, anomaly intensity scores are quantified based on alarm levels and their weights, allowing alarms of different severity levels to make differentiated contributions, better aligning with the needs of actual operational scenarios.

[0076] In some implementations, when determining recommended alarm nodes, the following node information may also be output simultaneously, including but not limited to, to provide operations and maintenance personnel with more detailed information: 1. Basic Information: Node Name, Node Level, Object Model Type; 2. Timing basis: first alarm time, duration of anomaly, and whether topological causality correction (i.e., corrective processing) was triggered; 3. Impact criteria: Hierarchical base score, number of affected upstream nodes (N_upstream), Factor; 4. Intensity basis: Count_level i W_level i , sum(Count_level) i × W_level i ).

[0077] The aforementioned node content can be presented in the form of a pop-up panel or sidebar in the software interface. Operation and maintenance personnel can view the relevant data and process of calculating the comprehensive confidence score RCS by clicking on the comprehensive confidence score RCS, thus realizing the white-box output of the algorithm.

[0078] In this embodiment, the specified time window, blocking rules, time threshold, topology layer mapping table, layer base score, impact time window, score upper limit, alarm level, alarm level weight, indicator type weight, default indicator type, time weight, impact weight, intensity weight, preset quantity K, linear decay slope k, interval range, transition zone decay slope, decay factor, dependency intensity weight, etc., support flexible parameter configuration based on global default rules or business-specific independent rules, which is beneficial for adapting to the operation and maintenance characteristics of different business systems. Furthermore, the above parameter configuration supports runtime adjustment without restarting the system and without affecting system operation. Operation and maintenance personnel can optimize parameters in real time through the configuration interface to adapt to different business scenarios and operation and maintenance needs.

[0079] Reference Figure 2 The diagram illustrates a structural block diagram of a recommended device for an alarm node according to an embodiment of this application. The device may include: The acquisition module is used to acquire the topology, hierarchy, and alarm data within a specified time window for each alarm node. The alarm data includes the alarm time and alarm level for each alarm. The first determining module is used to determine the alarm timing feature score of each alarm node based on the alarm time and topology relationship respectively. The second determination module is used to determine the topology influence range score of each alarm node based on the topology relationship and the hierarchy. The third determination module is used to determine the anomaly strength score of each alarm node based on the alarm level and the alarm level weight. The fourth determination module is used to determine the comprehensive confidence score of each alarm node based on the alarm timing feature score, topology influence range score, and anomaly intensity score, and to determine the recommended alarm node based on the comprehensive confidence score.

[0080] In one implementation, the acquisition module is further configured to: Before determining the alarm timing feature score for each alarm node, for each alarm node, all alarms are filtered according to the masking rules to determine the valid alarms. Duplicate alarms that are identical and valid, or valid alarms that are spaced less than a time threshold, are merged to update the alarm data.

[0081] In one implementation, the third determining module is further configured to: When alarm levels exist for different alarm sources, the alarm levels are mapped to a unified alarm level according to the alarm level mapping configuration; if the alarm level does not match the alarm level mapping configuration, the alarm level is mapped to the default alarm level.

[0082] The functions of each module in the device of this application embodiment can be found in the corresponding description in the above method, and will not be repeated here.

[0083] Reference Figure 3 The diagram illustrates a structural block diagram of an electronic device according to an embodiment of this application. The electronic device includes a memory 310 and a processor 320. The memory 310 stores instructions that can be executed on the processor 320. The processor 320 loads and executes these instructions to implement the recommended method for the alarm node in the above embodiment. The number of memories 310 and processors 320 can be one or more.

[0084] In one embodiment, the electronic device further includes a communication interface 330 for communicating with external devices and exchanging data. If the memory 310, processor 320, and communication interface 330 are implemented independently, they can be interconnected via a bus to communicate with each other. This bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. This bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0085] Optionally, in a specific implementation, if the memory 310, processor 320 and communication interface 330 are integrated on a single chip, the memory 310, processor 320 and communication interface 330 can communicate with each other through an internal interface.

[0086] This application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the recommended method for alarm nodes provided in the above embodiments.

[0087] This application also provides a chip, which includes a processor for calling and executing instructions stored in a memory, causing a communication device on which the chip is installed to perform the method provided in this application.

[0088] This application also provides a chip, including: an input interface, an output interface, a processor, and a memory. The input interface, output interface, processor, and memory are connected through an internal connection path. The processor is used to execute code in the memory. When the code is executed, the processor is used to execute the method provided in the application embodiment.

[0089] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. General-purpose processors can be microprocessors or any conventional processor. It is worth noting that the processor can be a processor supporting the Advanced Reduced Instruction Set Computing (RISC) machine (ARM) architecture.

[0090] Further, optionally, the aforementioned memory may include read-only memory and random access memory, and may also include non-volatile random access memory. The memory may be volatile or non-volatile, or may include both. Non-volatile memory may include read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory may include random access memory (RAM), which serves as an external cache. Many forms of RAM are available by way of example, but not limitation. Examples include static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0091] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another.

[0092] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of those different embodiments or examples.

[0093] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "a plurality of" means two or more, unless otherwise explicitly specified.

[0094] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process. Furthermore, the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functionality involved.

[0095] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus or device (such as a computer-based system, a processor-included system or other system that can fetch and execute instructions from, an instruction execution system, apparatus or device).

[0096] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. All or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware, the program being stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiments.

[0097] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. This storage medium can be a read-only memory, a disk, or an optical disk, etc.

[0098] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various variations or substitutions within the technical scope disclosed in this application, and these should all be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for recommending alarm nodes, characterized in that, include: Obtain the topology, hierarchy, and alarm data within a specified time window for each alarm node. The alarm data includes the alarm time and alarm level for each alarm. Based on the alarm time and the topological relationship, the alarm timing feature score of each alarm node is determined. Based on the topological relationship and the hierarchy, determine the topological influence range score of each alarm node; An anomaly strength score is determined for each alarm node based on the alarm level and alarm level weight. Based on the alarm timing feature score, the topology influence range score, and the anomaly intensity score, a comprehensive confidence score is determined for each alarm node, and a recommended alarm node is determined based on the comprehensive confidence score.

2. The method for recommending alarm nodes according to claim 1, characterized in that: The step of determining the alarm timing feature score for each alarm node based on the alarm time and the topological relationship includes: The initial timing score of each alarm node is determined based on the alarm time and the time decay coefficient, respectively. Based on the topological relationship, the initial timing score is corrected to obtain the alarm timing feature score of each alarm node.

3. The method for recommending alarm nodes according to claim 2, characterized in that: The determination of the initial timing score for each alarm node based on the alarm time and the time decay coefficient includes: From all the alarm times, determine the earliest alarm time and the first alarm time corresponding to each alarm node; For each alarm node, the time difference between the first alarm time and the earliest alarm time is determined. Attenuation calculations are performed based on the time difference to obtain the initial timing score for each alarm node.

4. The method for recommending alarm nodes according to claim 2, characterized in that: The step of correcting the initial time-series scores according to the topological relationship to obtain the alarm time-series feature score for each alarm node includes: Based on the topology, each pair of adjacent alarm nodes is determined, and the pair of adjacent alarm nodes includes an upstream alarm node and a downstream alarm node with an upstream-downstream dependency relationship. For each pair of adjacent alarm nodes, if the initial timing score of the downstream alarm node is higher than the initial timing score of the upstream alarm node, then the initial timing scores of the downstream alarm node and the upstream alarm node are exchanged to determine the alarm timing feature score of each alarm node. Alternatively, the initial timing score of one of the upstream alarm node and the downstream alarm node is corrected so that the corrected alarm timing feature score of the upstream alarm node is not lower than the alarm timing feature score of the downstream alarm node, thus obtaining the alarm timing feature score of each alarm node.

5. The method for recommending alarm nodes according to any one of claims 1-4, characterized in that: The determination of the topology influence range score for each alarm node based on the topology relationship and the hierarchy includes: Based on the respective levels, a basic score corresponding to each level is determined, and the magnitude of the basic score is negatively correlated with the distance between the level and the infrastructure layer. For each alarm node, based on the topology, determine the number of adjacent affected alarm nodes that are affected by the alarm and are located upstream of the alarm node. Based on the number of nodes and the hierarchical base score, determine the topology influence range score for each alarm node. or, Using a weighted propagation graph traversal algorithm, starting from each alarm node, at least one propagation path is traversed according to the topological relationship. The hierarchical base score, edge dependency strength weight, and path depth decay factor corresponding to the alarm node on the propagation path are accumulated and calculated to determine the topological influence range score of each alarm node.

6. The method for recommending alarm nodes according to claim 5, characterized in that: The determination of the topology impact range score for each alarm node based on the number of nodes and the hierarchical base score includes: The upstream influence amplification factor for each alarm node is determined based on the number of nodes and the logarithmic function, respectively. The topological influence score is determined by multiplying the upstream influence amplification factor by the hierarchical base score. The topology impact score is compared with the upper limit of the score. If the topology impact score is less than or equal to the upper limit of the score, the topology impact score is used as the topology impact range score of the alarm node. If the topology impact score is greater than the upper limit of the score, the upper limit of the score is used as the topology impact range score of the alarm node, thus obtaining the topology impact range score of each alarm node.

7. The method for recommending alarm nodes according to any one of claims 1-4, characterized in that: The process of determining the anomaly strength score for each alarm node based on the alarm level and the alarm level weight includes: For each alarm node, the number of levels corresponding to each alarm level is determined, and the number of levels is multiplied by the alarm level weight corresponding to the alarm level to obtain each weight item. For each alarm node, the weight items are summed to obtain the candidate anomaly strength score of each alarm node. The candidate anomaly strength score of each alarm node is used as the anomaly strength score of each alarm node. Alternatively, for each alarm node, the duration between the first alarm time and the latest alarm time is determined to determine the abnormal duration factor, and the abnormal intensity score of each alarm node is determined based on the abnormal duration factor and the candidate abnormal intensity score.

8. The method for recommending alarm nodes according to any one of claims 1-4, characterized in that: The comprehensive confidence score of each alarm node is determined based on the alarm timing feature score, the topology influence range score, and the anomaly intensity score, respectively. Based on the comprehensive confidence score, recommended alarm nodes are determined, including: The comprehensive confidence score of each alarm node is obtained by weighted summation based on the alarm timing feature score, time weight, topology influence range score, influence weight, anomaly intensity score, and intensity weight; wherein, the magnitude of time weight, influence weight, and intensity weight is determined based on different business scenario weight strategies, historical data supervised learning, or configuration page settings. The comprehensive confidence scores are arranged from high to low, and the alarm nodes corresponding to the top preset number of comprehensive confidence scores are used as recommended alarm nodes.

9. The method for recommending alarm nodes according to any one of claims 1-4, characterized in that: The method includes: Before determining the alarm timing feature score of each alarm node, for each alarm node, all alarms are filtered according to the masking rules to determine the valid alarms. The alarms that are identical and valid, or valid alarms that are spaced less than a time threshold, are deduplicated and merged to update the alarm data.

10. The method for recommending alarm nodes according to claim 7, characterized in that: The method further includes: When alarm levels exist for different alarm sources, the alarm levels are mapped to a unified alarm level according to the alarm level mapping configuration; if the alarm level does not match the alarm level mapping configuration, the alarm level is mapped to the default alarm level.

11. The method for recommending alarm nodes according to claim 7, characterized in that: The alarm level weights are determined in the following way: The default base weight corresponding to the alarm level is used as the alarm level weight; or, Determine the indicator type of the indicator corresponding to the alarm, adjust the default base weight corresponding to the alarm level according to the indicator type, and determine the alarm level weight, or use the default type weight corresponding to the indicator type as the alarm level weight.

12. A device for recommending alarm nodes, characterized in that, include: The acquisition module is used to acquire the topological relationship, hierarchy, and alarm data within a specified time window of each alarm node. The alarm data includes the alarm time and alarm level of each alarm. The first determining module is used to determine the alarm timing feature score of each alarm node based on the alarm time and the topological relationship, respectively. The second determining module is used to determine the topology influence range score of each alarm node based on the topology relationship and the hierarchy, respectively. The third determining module is used to determine the anomaly intensity score of each alarm node based on the alarm level and the alarm level weight, respectively. The fourth determining module is used to determine the comprehensive confidence score of each alarm node based on the alarm timing feature score, the topology influence range score, and the anomaly intensity score, and to determine the recommended alarm node based on the comprehensive confidence score.

Images