Information monitoring method and device

Abstract

The present invention discloses an information monitoring method and device. After acquiring monitoring data, the method combines a dynamic threshold algorithm with information such as parameters, experience thresholds or time intervals specified according to expert experience values ​​to jointly determine a dynamic threshold, and uses the dynamic threshold to issue an alarm. Among them, the information such as parameters, experience thresholds or effective time windows specified according to expert experience values ​​are obtained by summarizing and centrally processing different experience values ​​marked by multiple administrators or obtained from expert systems, and the values ​​obtained after continuous correction through an information feedback mechanism are more objective and accurate than the experience values ​​marked by a single administrator or a single expert system, and can also be continuously adjusted and optimized according to actual results. Combined with the above information specified by expert experience values, the false alarm rate generated when using dynamic thresholds for alarms can be greatly reduced.

Description

Technical Field

[0001] The present invention relates to the field of computer information processing, and in particular to an information monitoring method and device. Background Art

[0002] For large enterprises and cloud service providers, with the continuous expansion of business and digital management of business, the scale of equipment that needs to be monitored and maintained is also becoming increasingly large.

[0003] Traditional monitoring and operation use thresholds marked with empirical values ​​for monitoring. Such monitoring granularity is generally coarse, and the operation and maintenance effect often depends on the personal experience and management ability of the operation and maintenance personnel. It is difficult to meet the operation and maintenance needs of large-scale equipment and the personalized maintenance of different applications or systems. Dynamic threshold monitoring can achieve personalized dynamic threshold monitoring alarms to a certain extent, but dynamic threshold alarms based purely on mathematical algorithms may have a certain false alarm rate.

[0004] Therefore, the combination of dynamic threshold monitoring and experience value annotation has become a new trend. However, when multiple system administrators jointly manage a system, different administrators have different perspectives on the problem, and their respective experiences and factors may also be different. When performing experience value annotation, the values ​​set may also be different, which will cause the quality of system operation and maintenance to fluctuate.

[0005] In addition, as individuals, different administrators have limited operation and maintenance skills and experience, and each person has his or her own expertise.

[0006] Therefore, how to give full play to the expertise and advantages of different administrators when combining dynamic threshold monitoring with experience value labeling, and comprehensively consider the different settings of multiple administrators to finally determine a better value, is still a technical problem to be solved. Summary of the invention

[0007] In view of the above problems, an embodiment of the present invention provides a method and a device.

[0008] According to a first aspect of an embodiment of the present invention, an information monitoring method includes: obtaining monitoring data; obtaining a first value for assisting in determining a dynamic threshold based on a dynamic threshold algorithm, wherein the first value is a value that is centrally processed from multiple second values ​​with independent sources and continuously corrected through an information feedback mechanism; determining a dynamic threshold based on the dynamic threshold algorithm and the first value; and determining whether the monitoring data is within a range specified by the dynamic threshold, and if not, issuing an alarm.

[0009] According to an implementation manner of an embodiment of the present invention, obtaining a first numerical value according to a dynamic threshold algorithm includes: if the dynamic threshold algorithm is a first dynamic threshold algorithm, obtaining a parameter of the first dynamic threshold algorithm as a first numerical value; accordingly, determining a dynamic threshold according to the dynamic threshold algorithm and the first numerical value includes: using the first dynamic threshold algorithm and the first numerical value to calculate and obtain the dynamic threshold.

[0010] According to an implementation manner of an embodiment of the present invention, obtaining a first numerical value according to a dynamic threshold algorithm includes: if the dynamic threshold algorithm is a second dynamic threshold algorithm, obtaining the first dynamic threshold as the first numerical value; accordingly, determining the first dynamic threshold according to the dynamic threshold algorithm and the first numerical value, including: calculating the second dynamic threshold according to the second dynamic threshold algorithm; determining the dynamic threshold according to the first numerical value and the second dynamic threshold.

[0011] According to an implementation manner of an embodiment of the present invention, a first numerical value is obtained according to a dynamic threshold algorithm, including: if the dynamic threshold algorithm includes a third dynamic threshold algorithm and a fourth dynamic threshold algorithm, a time window value is obtained as the first numerical value; accordingly, a first dynamic threshold is determined according to the dynamic threshold algorithm and the first numerical value, including: a third dynamic threshold is calculated according to the third dynamic threshold algorithm; a fourth dynamic threshold is calculated according to the fourth dynamic threshold algorithm; if the time window of the third dynamic threshold and the fourth dynamic threshold is less than or equal to the first numerical value, the third dynamic threshold and the fourth dynamic threshold are determined as valid dynamic thresholds.

[0012] According to an implementation of an embodiment of the present invention, before obtaining a first value for assisting in determining a dynamic threshold according to a dynamic threshold algorithm, the method further includes: obtaining a plurality of second values ​​having independent sources; and calculating the plurality of second values ​​having independent sources to obtain a first value.

[0013] According to an implementation of an embodiment of the present invention, a first value is obtained by calculating multiple second values ​​with independent sources, including: obtaining a weight value of each second value source, wherein the second value source is an independent source of the second value; and performing weighted calculation on multiple second values ​​with independent sources according to the weight value of each second value source to obtain the first value.

[0014] According to an implementation manner of an embodiment of the present invention, before obtaining the weight value of each second value source, the method further includes: obtaining the annotation quality of each second value source; and determining the weight value of the corresponding second value source according to the annotation quality.

[0015] According to an embodiment of the present invention, before obtaining multiple second values ​​with independent sources, the method also includes: providing each second value source with a historical record of the first value and the actual result corresponding to the first value, so that each second value source can independently revise the second value.

[0016] According to an implementation of an embodiment of the present invention, before obtaining a first value for assisting in determining a dynamic threshold according to a dynamic threshold algorithm, the method further includes: determining whether the first value exists; if not, further determining whether a second value exists; if so, using the second value as the first value to perform subsequent operations to obtain a first alarm result, and sending the first alarm result to a second value source corresponding to the second value.

[0017] According to a second aspect of an embodiment of the present invention, an information monitoring device includes: a monitoring data acquisition module for acquiring monitoring data; a first value acquisition module for acquiring a first value for assisting in determining a dynamic threshold based on a dynamic threshold algorithm, wherein the first value is a value that is centrally processed from multiple second values ​​with independent sources and continuously corrected through an information feedback mechanism; a dynamic threshold determination module for determining a dynamic threshold based on the dynamic threshold algorithm and the first value; and an alarm module for determining whether the monitoring data is within a range specified by the dynamic threshold, and if not, issuing an alarm.

[0018] According to a third aspect of an embodiment of the present invention, a computer-readable storage medium is provided, characterized in that the storage medium includes a set of computer-executable instructions, which are used to execute any of the above-mentioned information monitoring methods when the instructions are executed.

[0019] The embodiment of the present invention provides an information monitoring method, device and computer-readable storage medium, and the present invention discloses an information monitoring method and device. After acquiring the monitoring data, the method combines the dynamic threshold algorithm and the information such as the parameters, experience threshold or time interval specified according to the expert experience value to jointly determine a dynamic threshold, and uses the dynamic threshold to make an alarm. Among them, the information such as the parameters, experience threshold or effective time window specified according to the expert experience value is obtained by summarizing and centrally processing the different experience values ​​marked by multiple administrators or obtained from the expert system, and the value obtained after continuous correction through the information feedback mechanism is more objective and more accurate than the experience value marked by a single administrator or a single expert system, and can also be continuously adjusted and optimized according to the actual effect. Combined with the above information specified by the expert experience value, the false alarm rate generated when using the dynamic threshold for alarm can be greatly reduced.

[0020] It should be understood that the teachings of the present invention are not required to achieve all of the beneficial effects described above, but specific technical solutions can achieve specific technical effects, and other embodiments of the present invention can also achieve beneficial effects not mentioned above. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The above and other objects, features and advantages of the exemplary embodiments of the present invention will become readily understood by reading the detailed description below with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present invention are shown in an exemplary and non-limiting manner, in which:

[0022] In the drawings, the same or corresponding reference numerals represent the same or corresponding parts.

[0023] Figure 1 A schematic diagram of an application scenario of the information monitoring method according to an embodiment of the present invention;

[0024] Figure 2 A schematic diagram of the implementation flow of the information monitoring method according to an embodiment of the present invention;

[0025] Figure 3 This is a specific implementation flow chart of the information monitoring method according to an embodiment of the present invention, in which a weighted calculation based on a second value is performed to obtain a first value;

[0026] Figure 4 Schematic diagram of the structure of the information monitoring device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to make the purpose, features and advantages of the present invention more obvious and easy to understand, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0028] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine different embodiments or examples described in this specification and the features of different embodiments or examples, unless they are contradictory.

[0029] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0030] Figure 1 An application scenario of the information monitoring method according to an embodiment of the present invention is shown. Figure 1 The information monitoring system shown in the figure mainly includes three parts: dynamic threshold generation part, writing adapter part and external system part. Among them, the dynamic threshold generation part mainly combines the dynamic threshold calculation method and the information stored in the parameter database (such as the parameter value marked with the empirical value, the empirical threshold and the effective window time, etc.) to generate the dynamic threshold regularly; when the monitoring data is received, it will be compared with the generated dynamic threshold. If it exceeds the range and conditions defined by the dynamic threshold, it will be written to the adapter and then sent to the external system through the adapter for alarm.

[0031] like Figure 1 As shown, the dynamic threshold calculation process of the timed start will perform corresponding dynamic threshold calculations according to the selected algorithm, for example:

[0032] 1) In some dynamic threshold algorithms for amplitude, fluctuation degree, and periodic oscillation, the parameter information of related applications and nodes will be obtained through the parameter database, and the retrieved parameters will be used for calculation;

[0033] 2) In some dynamic threshold algorithms that have certain upper and lower limits, such as the ESD dynamic threshold algorithm, percentile dynamic threshold algorithm, quartile dynamic threshold algorithm, etc., a threshold interval is calculated. If the monitoring data is outside the threshold interval, an alarm will be triggered. At this time, the alarm threshold range marked by the expert experience value is obtained through the parameter database. Only when the dynamic threshold alarm is exceeded and the alarm threshold range marked by the expert experience value is exceeded at the same time, an alarm will be triggered;

[0034] 3) In some combinations that require the combination of dynamic threshold calculation method I and dynamic threshold calculation method II, if it occurs within a time window of adjacent length L, it is considered valid or invalid, where the adjacent time window L is also recorded in the parameter database. For example, dynamic threshold algorithm II needs to be calculated only after the value calculated by dynamic threshold algorithm I exceeds a certain range, and the events monitored by dynamic threshold algorithm II and dynamic threshold algorithm I are required to be within the time window L.

[0035] Figure 2 The implementation process of the information monitoring method according to the embodiment of the present invention is shown. Figure 2An embodiment of the present invention provides an information monitoring method, which includes: operation 210, obtaining monitoring data; operation 220, obtaining a first value for assisting in determining a dynamic threshold according to a dynamic threshold algorithm, wherein the first value is a value obtained by centrally processing multiple second values ​​with independent sources and continuously correcting them through an information feedback mechanism; operation 230, determining a dynamic threshold according to the dynamic threshold algorithm and the first value; operation 240, determining whether the monitoring data is within a range defined by the dynamic threshold, and if not, issuing an alarm.

[0036] In operation 210, the monitoring data is usually real-time data collected by a data collector, such as application access, room temperature collected under production conditions, mobile phone power usage, available internal disk space and IO operation statistics, system error information statistics, etc. These data are also used for real-time monitoring and are compared with dynamic thresholds to detect abnormal data.

[0037] In operation 220, the first value is usually a value of a data stored in a data storage system such as a parameter database, and is used to assist the dynamic threshold algorithm in jointly determining the dynamic threshold to be used, for example, the parameter value, empirical threshold, and effective window time mentioned in the above application scenario.

[0038] It should be noted that the first value referred to in the embodiment of the present invention is different from the commonly used experience threshold in the existing system, and the first value is obtained based on multiple second values ​​from different and independent sources. The second values ​​with independent sources can be expert experience values ​​marked by different administrators, or expert experience values ​​obtained from different expert systems.

[0039] The first value and the second value are both estimated values ​​or empirical values ​​to some extent, and usually have a certain degree of error from the target value. The target value here refers to a value that can capture more abnormal events and control the false alarm rate below a certain level. This target value is usually the value with the best implementation effect obtained through a period of verification.

[0040] However, since the first value comprehensively considers multiple second values ​​with independent sources, it is more objective and accurate than the empirical value marked by a single administrator or a single expert system.

[0041] The information feedback mechanism refers to feeding back the first value and the actual result of using the first value for alarm, such as alarm information, monitoring data that triggers the alarm information, and the processing result of the alarm information, to the various data sources of the second value. After receiving these feedback information, the various data sources of the second value will adjust the second value for next use accordingly. In this way, after multiple iterations, the accuracy of the second value and the first value, that is, the degree of closeness to the target value, will continue to improve.

[0042] Afterwards, through operations 230 and 240, a dynamic threshold can be determined based on the first value and whether the monitoring data is within the range specified by the dynamic threshold can be judged based on the dynamic threshold. If it exceeds the range specified by the dynamic threshold, an alarm can be triggered by triggering an alarm event.

[0043] In different application scenarios, the first value may be a parameter of a dynamic threshold algorithm, an empirical threshold used in combination with a dynamic threshold, or a valid time window length between two combined dynamic thresholds. The above situations are exemplified below.

[0044] According to an implementation manner of an embodiment of the present invention, obtaining a first numerical value according to a dynamic threshold algorithm includes: if the dynamic threshold algorithm is a first dynamic threshold algorithm, obtaining a parameter of the first dynamic threshold algorithm as a first numerical value; accordingly, determining a dynamic threshold according to the dynamic threshold algorithm and the first numerical value includes: using the first dynamic threshold algorithm and the first numerical value to calculate and obtain the dynamic threshold.

[0045] Among them, the first dynamic threshold algorithm usually refers to an algorithm that performs dynamic calculations based on certain parameters, for example, some dynamic threshold algorithms related to amplitude, degree of fluctuation, and periodic oscillation; the first numerical value mainly refers to the parameters of the relevant application or server node; the dynamic threshold is calculated by substituting these parameters into the dynamic threshold algorithm.

[0046] For example, a server runs an application that provides a clock-in service. The application has a high number of visits during the peak hours of get off work on weekdays (for example, 8 a.m. to 10 a.m. and 6 p.m. to 9 p.m.), but a low number of visits during other hours. The number of visits during the day fluctuates periodically, and 8 a.m., 10 a.m., 6 a.m., and 9 a.m. are the parameters that the dynamic threshold algorithm needs to use to specify the peak hours on weekdays. This period may be different at the beginning, middle, and end of the year, during the peak and off-seasons, and needs to be adjusted accordingly.

[0047] In the above monitoring and early warning example, the parameters that need to be adjusted are marked by expert experience values ​​and can be stored in data storage systems such as parameter databases for use at any time when dynamic threshold algorithms are used for monitoring.

[0048] According to an implementation manner of an embodiment of the present invention, obtaining a first numerical value according to a dynamic threshold algorithm includes: if the dynamic threshold algorithm is a second dynamic threshold algorithm, obtaining the first dynamic threshold as the first numerical value; accordingly, determining the first dynamic threshold according to the dynamic threshold algorithm and the first numerical value, including: calculating the second dynamic threshold according to the second dynamic threshold algorithm; determining the dynamic threshold according to the first numerical value and the second dynamic threshold.

[0049] Among them, the second dynamic threshold algorithm mainly refers to a dynamic threshold algorithm with determined upper and lower limits, such as the ESD dynamic threshold algorithm, the percentile dynamic threshold algorithm, the quartile dynamic threshold algorithm and other algorithms; correspondingly, the first numerical value mainly refers to the alarm threshold range marked according to the expert experience value; the dynamic threshold determined according to the first numerical value and the second dynamic threshold is usually the boundary value of the intersection or union of the first interval obtained by the dynamic threshold algorithm and the second interval determined by the first numerical value.

[0050] For example, when monitoring room temperature in production conditions, the room temperature in the production environment may need to be fine-tuned according to the real-time humidity. When the humidity is extremely high or extremely low, the room temperature threshold may become correspondingly very high or very low. However, in fact, the room temperature threshold at this time does not need to be significantly adjusted. In this case, the maximum room temperature threshold or the minimum room temperature threshold specified by the expert experience value can be obtained. As long as the room temperature in the production environment exceeds the maximum room temperature threshold or the minimum room temperature threshold in the parameter library, an alarm can be triggered.

[0051] In the above monitoring and warning example, the maximum room temperature threshold or the minimum room temperature threshold is the first value that needs to be marked with an expert experience value, which can be stored in a data storage system such as a parameter database for use at any time when the dynamic threshold algorithm is used for monitoring.

[0052] According to an implementation manner of an embodiment of the present invention, a first numerical value is obtained according to a dynamic threshold algorithm, including: if the dynamic threshold algorithm includes a third dynamic threshold algorithm and a fourth dynamic threshold algorithm, a time window value is obtained as the first numerical value; accordingly, a first dynamic threshold is determined according to the dynamic threshold algorithm and the first numerical value, including: a third dynamic threshold is calculated according to the third dynamic threshold algorithm; a fourth dynamic threshold is calculated according to the fourth dynamic threshold algorithm; if the time window of the third dynamic threshold and the fourth dynamic threshold is less than or equal to the first numerical value, the third dynamic threshold and the fourth dynamic threshold are determined as valid dynamic thresholds.

[0053] Among them, the third dynamic threshold algorithm and the fourth dynamic threshold algorithm, such as Figure 1 The dynamic threshold calculation method I and the dynamic threshold calculation method II are a combination of two dynamic thresholds used to determine whether the monitoring data is abnormal; the first value refers to the time window used to determine whether the combination condition is met.

[0054] Assume that dynamic threshold calculation method I calculates that when the available power is less than 20%, it is a low power warning condition, and the low power warning is generated at 15:05; when dynamic threshold calculation method II calculates that the power consumption of a certain application reaches 5% when the power consumption is less than 20%, and the time window is within 1 hour (20% of the power can be on standby for about 1 hour), an alarm is generated. When the time window exceeds 1 hour, it may have been charged or is being charged, and no alarm is generated at this time.

[0055] In the above monitoring and early warning example, 20% is the third dynamic threshold of dynamic threshold calculation method I; 5% is the fourth threshold obtained by dynamic threshold calculation method II when the value reaches below the third dynamic threshold, and the 1-hour time window represents the first numerical value that needs to be specified by expert experience, which can be stored in a data storage system such as a parameter database for use at any time when the dynamic threshold algorithm is used for monitoring.

[0056] According to an implementation of an embodiment of the present invention, before obtaining a first value for assisting in determining a dynamic threshold according to a dynamic threshold algorithm, the method further includes: obtaining a plurality of second values ​​having independent sources; and calculating the plurality of second values ​​having independent sources to obtain a first value.

[0057] Among them, the indicators measured by multiple second values ​​are the same, but the sources are different. These sources are independent of each other and unrelated to each other. Therefore, the second values ​​are also independent of each other and are calculated based on different experiences or systems. In this way, the objectivity of the first value based on multiple second values ​​can be ensured. When calculating the first value based on the second values, various applicable calculation methods can be used, such as taking the average; taking the average after removing the maximum and minimum values; the value obtained by weighted average calculation according to the specified weight value; or an end-to-end model can be established to obtain a value through model calculation.

[0058] Since the first value comprehensively considers multiple second values ​​with independent sources, it is more objective and accurate than the empirical value marked by a single administrator or a single expert system.

[0059] According to an implementation of an embodiment of the present invention, a first value is obtained by calculating multiple second values ​​with independent sources, including: obtaining a weight value of each second value source, wherein the second value source is an independent source of the second value; and performing weighted calculation on multiple second values ​​with independent sources according to the weight value of each second value source to obtain the first value.

[0060] Since the estimation methods used by various sources may be different, the focus may be different, or the accumulated experience, the level of experts, and the difference in the algorithms used by the system may lead to different accuracy of the second value. In this case, if the average value is calculated by quantity without any weight value, it is likely to reduce the accuracy of the first value.

[0061] In order to make the first value closer to the target value, in this embodiment, the weight value of the second value source is obtained, and the first value is obtained by weighted average calculation according to the weight value of the second value source. The weight value of the second value source is usually set in advance. The weight value can be a fixed value set with reference to the expert level, administrator score or other information, or it can be dynamically updated according to the alarm result and the gap between the second value and the accurate value.

[0062] According to an implementation manner of an embodiment of the present invention, before obtaining the weight value of each second value source, the method further includes: obtaining the annotation quality of each second value source; and determining the weight value of the corresponding second value source according to the annotation quality.

[0063] The annotation quality of the second value source mainly refers to a measurement indicator that the second value given by the second value source makes the first value closer to the target value.

[0064] The annotation quality of the second value source can be obtained by dividing the number of valid alarms that discover true anomalies by the number of alarms that may be triggered using the second value for alarm, thereby obtaining the abnormal event capture rate; it can also be measured by the degree of proximity between the second value and the target value.

[0065] Generally speaking, the higher the annotation quality of the second value source, the higher the accuracy of the second value, and the higher the weight value of the second value source.

[0066] In this embodiment, the weight value of the second value source is not fixed, but dynamically updated according to the annotation quality of the second value source. Compared with the fixed value set by referring to the expert level, administrator score or other information, the dynamically updated weight value can better reflect the annotation quality of the second value and make the first value closer to the target value.

[0067] Figure 3 The specific implementation flow chart of the information monitoring method of the embodiment of the present invention is shown as follows: Figure 3 In the application shown, different experts label the parameters used in the dynamic threshold through an expert labeling system. The expert experience value labeled by each expert is the second value referred to in the embodiment of the present invention. The parameter p calculated based on the expert experience value labeled by each expert with the weight w is the first value referred to in the embodiment of the present invention.

[0068] Specifically, the process of calculating the parameter p by the expert experience value through the weight w mainly includes:

[0069] Step 310, triggering the calculation process of parameter p actively through timing triggering or command;

[0070] Step 320, obtaining historical data within a period of time from the configuration management database;

[0071] These historical data include the expert experience value independently marked by each expert, the parameter p calculated based on the expert experience value marked by each expert with the weight w, and the actually triggered alarm events and the valid alarm events therein.

[0072] After obtaining these historical data, they can be sent to various experts for reference to adjust the expert experience value of subsequent annotations. In addition, these historical data can also be used to calculate the annotation quality of different experts under specific applications, fields or labels, and calculate the weight w based on the annotation quality.

[0073] Step 330, storing the weight w of each expert calculated in step 320, and obtaining the expert experience value marked by each expert;

[0074] Step 340: Calculate the parameter p according to the weight w of each expert and the expert experience value marked by each expert.

[0075] According to an embodiment of the present invention, before obtaining multiple second values ​​with independent sources, the method also includes: providing each second value source with a historical record of the first value and the actual result corresponding to the first value, so that each second value source can independently revise the second value.

[0076] In this embodiment, the first value and the actual result corresponding to the first value are fed back to the second value source. The second value source can adjust the second value for next use according to the first value and the actual result corresponding to the first value. In this way, an information feedback closed loop and an iterative mechanism can be formed, so that the second value is infinitely close to the target value, thereby making the first value infinitely close to the target value.

[0077] According to an implementation of an embodiment of the present invention, before obtaining a first value for assisting in determining a dynamic threshold according to a dynamic threshold algorithm, the method further includes: determining whether the first value exists; if not, further determining whether a second value exists; if so, using the second value as the first value to perform subsequent operations to obtain a first alarm result, and sending the first alarm result to a second value source corresponding to the second value.

[0078] It usually takes a period of time to determine the first value based on the second value, and the calculation can only be done after the values ​​of all the second value sources are collected. During this period, there may be a gap, that is, the first value calculated last time has expired, and the first value to be used this time has not yet been obtained. At this time, a single second value can be selected for trial operation, and the dynamic threshold calculated using the second value is used to return the alarm result to the corresponding second value source.

[0079] The result will not be sent to other second value sources, but only to the second value source that provided the second value, so that the second value source can optimize the second value provided next time. In this way, more reference information can be provided to the second value source, so that the second value can be continuously optimized and gradually approach the target value.

[0080] Furthermore, an embodiment of the present invention also provides an information monitoring device, such as Figure 4 As shown, the device 40 includes: a monitoring data acquisition module 401, used to acquire monitoring data; a first value acquisition module 402, used to acquire a first value for assisting in determining a dynamic threshold according to a dynamic threshold algorithm, wherein the first value is a value that is centrally processed from multiple second values ​​with independent sources and continuously corrected through an information feedback mechanism; a dynamic threshold determination module 403, used to determine a dynamic threshold according to the dynamic threshold algorithm and the first value; an alarm module 404, used to determine whether the monitoring data is within the range specified by the dynamic threshold, and if not, to issue an alarm.

[0081] According to an implementation manner of an embodiment of the present invention, the first numerical value acquisition module 402 is specifically used to obtain the parameters of the first dynamic threshold algorithm as the first numerical value if the dynamic threshold algorithm is the first dynamic threshold algorithm; accordingly, the dynamic threshold determination module 403 is specifically used to use the first dynamic threshold algorithm and the first numerical value to calculate the dynamic threshold.

[0082] According to an implementation manner of an embodiment of the present invention, the first numerical value acquisition module 402 is specifically used to obtain the first dynamic threshold as the first numerical value if the dynamic threshold algorithm is the second dynamic threshold algorithm; accordingly, the dynamic threshold determination module 403 is specifically used to calculate the second dynamic threshold according to the second dynamic threshold algorithm; and determine the dynamic threshold according to the first numerical value and the second dynamic threshold.

[0083] According to an implementation manner of an embodiment of the present invention, the first numerical value acquisition module 402 is specifically used to obtain a time window value as a first numerical value if the dynamic threshold algorithm includes a third dynamic threshold algorithm and a fourth dynamic threshold algorithm; accordingly, the dynamic threshold determination module 403 is specifically used to calculate a third dynamic threshold according to the third dynamic threshold algorithm; calculate a fourth dynamic threshold according to the fourth dynamic threshold algorithm; if the time window of the third dynamic threshold and the fourth dynamic threshold is less than or equal to the first numerical value, the third dynamic threshold and the fourth dynamic threshold are determined as valid dynamic thresholds.

[0084] According to an implementation of an embodiment of the present invention, the device 40 further includes: a second value acquisition module, used to acquire multiple second values ​​with independent sources; and a first value calculation module, used to calculate the multiple second values ​​with independent sources to obtain the first value.

[0085] According to an embodiment of the present invention, the first numerical calculation module includes: a weight value acquisition submodule, used to obtain the weight value of each second numerical value source, wherein the second numerical value source is an independent source of the second numerical value; a weighted calculation submodule, used to perform weighted calculation on multiple second numerical values ​​with independent sources according to the weight value of each second numerical value source to obtain the first numerical value.

[0086] According to an implementation manner of an embodiment of the present invention, the first numerical calculation module also includes: an expected result acquisition submodule, used to obtain the expected result corresponding to each second numerical value; an actual result acquisition submodule, used to obtain the actual result corresponding to each second numerical value; a comparison result submodule, used to compare the expected result and the actual result to determine the annotation quality of each second numerical source; a weight value determination submodule, used to determine the weight value of the corresponding second numerical source according to the annotation quality.

[0087] According to an implementation of an embodiment of the present invention, the device 40 further includes: a history record providing module for providing each second value source with a history record of the first value and the actual result corresponding to the first value, so that each second value source can independently revise the second value.

[0088] According to an embodiment of the present invention, the device 40 also includes: a second numerical value verification module, used to determine whether the first numerical value exists, and if not, further determine whether the second numerical value exists, and if so, use the second numerical value as the first numerical value to perform subsequent operations to obtain a first alarm result, and send the first alarm result to a second numerical value source corresponding to the second numerical value.

[0089] According to a third aspect of an embodiment of the present invention, a computer-readable storage medium is provided, characterized in that the storage medium includes a set of computer-executable instructions, which are used to execute any of the above-mentioned information monitoring methods when the instructions are executed.

[0090] It should be pointed out here that the above description of the device embodiment for information monitoring and the above description of the computer-readable storage medium embodiment are similar to the description of the aforementioned method embodiment, and have similar beneficial effects as the aforementioned method embodiment, so they are not described in detail. For the technical details that have not been disclosed in the description of the device embodiment for information monitoring and the description of the computer-readable storage medium embodiment of the present invention, please refer to the description of the aforementioned method embodiment of the present invention for understanding, and in order to save space, they are not described in detail.

[0091] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0092] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another device, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0093] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0094] In addition, all functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0095] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiment; and the aforementioned storage medium includes: mobile storage medium, read-only memory (ROM), magnetic disk or optical disk, etc., various media that can store program codes.

[0096] Alternatively, if the above-mentioned integrated unit of the present invention is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present invention can be essentially or partly reflected in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods of each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage media, ROM, magnetic disks or optical disks.

[0097] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. An information monitoring method, the method comprising: Acquire monitoring data, wherein the monitoring data is real-time data collected by a data collector; Acquire a first value for assisting in determining a dynamic threshold value according to a dynamic threshold value algorithm, wherein the first value is a value that is obtained by centrally processing a plurality of second values ​​having independent sources and continuously correcting them through an information feedback mechanism; The second value is an expert experience value; Determine a dynamic threshold according to the dynamic threshold algorithm and the first value; Determine whether the monitoring data is within the range defined by the dynamic threshold, and if not, issue an alarm.

2. The method according to claim 1, wherein obtaining the first value according to the dynamic threshold algorithm comprises: If the dynamic threshold algorithm is a first dynamic threshold algorithm, obtaining a parameter of the first dynamic threshold algorithm as a first value; Accordingly, determining a dynamic threshold according to the dynamic threshold algorithm and the first value includes: The dynamic threshold is calculated using a first dynamic threshold algorithm and the first value.

3. The method according to claim 1, wherein obtaining the first value according to the dynamic threshold algorithm comprises: If the dynamic threshold algorithm includes a third dynamic threshold algorithm and a fourth dynamic threshold algorithm, obtaining a time window value as a first value; Accordingly, determining a dynamic threshold according to the dynamic threshold algorithm and the first value includes: Calculate a third dynamic threshold value according to the third dynamic threshold value algorithm; Calculate a fourth dynamic threshold value according to the fourth dynamic threshold algorithm; If the time window of the third dynamic threshold and the fourth dynamic threshold is less than or equal to the first value, the third dynamic threshold and the fourth dynamic threshold are determined as valid dynamic thresholds.

4. The method according to claim 1, before obtaining the first value for assisting in determining the dynamic threshold according to the dynamic threshold algorithm, the method further comprises: obtaining a plurality of second values ​​having independent sources; The first value is obtained by calculating the plurality of second values ​​having independent sources.

5. The method according to claim 4, wherein the step of calculating the plurality of second values ​​having independent sources to obtain the first value comprises: Obtaining a weight value of each second value source, wherein the second value source is an independent source of the second value; According to the weight value of each second value source, the plurality of second values ​​having independent sources are weightedly calculated to obtain the first value.

6. The method according to claim 5, before obtaining the weight value of each second value source, the method further comprises: Obtaining the annotation quality of each second value source; A weight value of a corresponding second value source is determined according to the annotation quality.

7. The method according to claim 4, before acquiring the first value for assisting in determining the dynamic threshold according to the dynamic threshold algorithm, the method further comprises: Determine whether the first value exists. If not, further determine whether the second value exists. If so, use the second value as the first value to perform subsequent operations to obtain a first alarm result, and send the first alarm result to a second value source corresponding to the second value.

8. An information monitoring device, comprising: A monitoring data acquisition module is used to acquire monitoring data, wherein the monitoring data is real-time data collected by a data collector; A first value acquisition module, used for acquiring a first value for assisting in determining a dynamic threshold value according to a dynamic threshold algorithm, wherein the first value is a value that is obtained by centrally processing a plurality of second values ​​having independent sources and continuously correcting them through an information feedback mechanism; The second value is an expert experience value; A dynamic threshold determination module, configured to determine a dynamic threshold according to the dynamic threshold algorithm and the first value; The alarm module is used to determine whether the monitoring data is within the range defined by the dynamic threshold, and if not, to issue an alarm.

Images