Method and apparatus for processing alarm events

Abstract

Disclosed are a method and device for processing an alarm event. The method comprises: pre-processing a real-time received alarm event to obtain a mark sequence, the mark sequence being composed of keywords in the alarm event; calculating a measure value of information quantity size and a measure value of importance of the alarm event according to the mark sequence and historical alarm events respectively; calculating an information entropy of the alarm event based on the measure value of information quantity size and the measure value of importance of the alarm event; and sending the alarm event only when the information entropy of the alarm event is greater than a set threshold. The embodiment realizes pre-processing by using some methods of natural language text processing, calculates the measure value of information quantity size and the measure value of importance of the real-time received alarm event in combination with historical alarm events, and obtains the information entropy of the alarm event according to the measure value, so as to achieve the purpose of more accurately distinguishing alarm events and sending important alarm events to a destination.

Description

Technical Field

[0001] This disclosure relates to the field of alarm handling, and more specifically, to a method and apparatus for handling alarm events. Background Technology

[0002] In using cloud services, system observability is an indispensable element. When a problem or change occurs in the observed system, the corresponding changes generate alarm events that are notified to the user. However, due to the scaling and complexity of systems, as well as the duplication of alarm configurations, a large number of duplicate, redundant, inefficient, and invalid events appear in the alarm events. Important events are often hidden among these numerous inefficient and invalid events. This causes a lot of interference for operations and maintenance personnel. Therefore, removing a large number of duplicate, inefficient, and invalid alarm events so that important alarms can be given more attention is a matter of great practical value. Summary of the Invention

[0003] In view of this, the purpose of this disclosure is to provide a method and apparatus for processing alarm events, so as to remove a large number of repetitive, inefficient and invalid alarm events, thereby enabling more attention to important alarms.

[0004] In a first aspect, embodiments of this disclosure provide a method for handling alarm events, including:

[0005] The alarm events received in real time are preprocessed to obtain a tag sequence, which is composed of keywords in the alarm events;

[0006] Calculate the information content and importance of the alarm event based on the tag sequence and historical alarm events, respectively.

[0007] The information entropy of the alarm event is calculated based on the metrics of the amount of information and the importance of the alarm event.

[0008] The alarm event is sent out only when the information entropy of the alarm event is greater than a set threshold.

[0009] Optionally, the metric for calculating the importance of the alarm event based on the tag sequence and historical alarm events includes:

[0010] The importance of an alarm event is measured based on the frequency of each keyword in the tag sequence in the historical alarm event and the frequency of the alarm event itself.

[0011] Optionally, the metric for calculating the information content of the alarm event based on the tag sequence and historical alarm events includes:

[0012] Calculate the probability value of each keyword in the alarm event by calculating the number of events in the historical alarm events and the total number of events in the historical alarm events for each keyword in the alarm event; and

[0013] The information content of the alarm event is measured based on the probability value of each keyword in the labeled sequence.

[0014] Optionally, a first vector composed of the TF-IDF values ​​of each keyword in the labeled sequence is used as a measure of the importance of the alarm event.

[0015] Optionally, the step of calculating the information content of the alarm event based on the tag sequence and historical alarm events includes: using a second vector composed of the negative logarithms of the probability values ​​of each keyword in the tag sequence as the information content of the alarm event.

[0016] Optionally, calculating the information entropy of the alarm event based on a metric of the amount of information and a metric of its importance includes:

[0017] The product of the first vector and the second vector is mapped to a set numerical range, and the final mapped value is used as the information entropy of the alarm event.

[0018] Optionally, the product of the first vector and the second vector can be mapped to a set numerical range using one of the following functions: sigmoid function, normalization function, tanh function, and relu function.

[0019] Optionally, the preprocessing includes one or more of the following processes: cleaning alarm events, word segmentation, filtering meaningless words, word type restoration, and keyword extraction.

[0020] Optionally, it also includes: adjusting the information entropy of the alarm event according to preset filter words or priority words.

[0021] Optionally, it further includes: retrieving the tag sequence based on a preset priority word; if the tag sequence includes a preset priority word, then directly sending out the alarm event.

[0022] Secondly, embodiments of this disclosure provide an alarm event processing apparatus, including:

[0023] The preprocessing module is used to preprocess the alarm events received in real time to obtain a tag sequence, which is composed of keywords in the alarm events;

[0024] The information entropy calculation module is used to calculate the information content size and importance of the alarm event based on the label sequence and historical alarm events, respectively, and to calculate the information entropy of the alarm event based on the information content size and importance of the alarm event.

[0025] The alarm output module is used to send out the alarm event only when the information entropy of the alarm event is greater than a set threshold.

[0026] Thirdly, embodiments of this disclosure provide an electronic device, including a memory and a processor, wherein the memory further stores computer instructions executable by the processor, and when the computer instructions are executed, implement the processing method described in any of the preceding claims.

[0027] Fourthly, embodiments of this disclosure provide a computer-readable medium storing computer instructions executable by an electronic device, wherein when the computer instructions are executed, they implement the processing method described in any of the preceding claims.

[0028] The alarm event processing method provided in this disclosure utilizes some natural language text processing methods for preprocessing, combines historical alarm events to calculate the information content and importance metrics of real-time received alarm events, and obtains the information entropy of the alarm events accordingly, so as to more accurately distinguish alarm events and send important alarm events to the destination. Furthermore, when calculating the information content and importance metrics of real-time received alarm events, the calculation is based on word frequency statistics and event probability statistics. Attached Figure Description

[0029] The above and other objects, features, and advantages of this disclosure will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0030] Figure 1 This is a diagram illustrating the hardware deployment of cloud services;

[0031] Figure 2 This is a diagram illustrating the interaction between an application system, an alarm system, and an alarm display system.

[0032] Figure 3 This is a flowchart of an alarm event handling method provided in an embodiment of this disclosure;

[0033] Figure 4 This is a flowchart of an alarm event handling method provided in another embodiment of this disclosure.

[0034] Figure 5 This is a flowchart of an alarm event processing apparatus provided in an embodiment of the present disclosure;

[0035] Figure 6 A structural diagram of an electronic device for implementing embodiments of the present disclosure is shown. Detailed Implementation

[0036] The present disclosure is described below based on embodiments, but it is not limited to these embodiments. In the detailed description of the present disclosure below, certain specific details are described in detail. Those skilled in the art will fully understand the present disclosure even without these details. To avoid obscuring the substance of the present disclosure, well-known methods, processes, and procedures are not described in detail. Furthermore, the accompanying drawings are not necessarily drawn to scale.

[0037] Definitions of abbreviations and key terms

[0038] Alarm events include 0-1 events and indicator events. 0-1 events are often generated by system hardware logic, such as machine restarts or database downtime. Indicator events are generated through alarm rules set for indicators, such as CPU usage exceeding 80%.

[0039] Fault location and handling: This refers to the process by which operations and maintenance personnel, after receiving an alarm event, pinpoint the problem to a specific dimension (e.g., which location, which user) where an anomaly has occurred. This helps operations and maintenance personnel quickly locate the abnormal element and make decisions such as recovery or restart.

[0040] Information content: In information theory, it measures how much information each message contains.

[0041] Information entropy: In information theory, entropy is the average amount of information contained in each received message. It is also known as information entropy, source entropy, or average self-information. It can be understood as a measure of uncertainty. The greater the entropy, the more random the distribution of the information source.

[0042] TF-IDF: TF-IDF (term frequency–inverse document frequency) is a commonly used weighting technique for information retrieval and data mining. It is often used to mine keywords in articles, and the algorithm is simple and efficient, often used in industry for initial text data cleaning. TF-IDF has two meanings: one is "term frequency" (TF), and the other is "inverse document frequency" (IDF).

[0043] Lexical reduction is an important part of text preprocessing, similar to stemming. Simply put, lexical reduction removes affixes from words and extracts their stems. The extracted words are usually words from a dictionary, unlike stemming, where the extracted words may not necessarily appear in the dictionary.

[0044] Figure 1 This is a schematic diagram of the hardware deployment of cloud services. As shown in the figure, deployment diagram 100 includes a terminal 103 and a server cluster 102 connected via network 101.

[0045] Network 101 is one or a combination of various communication technologies based on switched signals, including but not limited to wired technologies using electrical and / or optical cables, and wireless technologies using infrared, radio frequency, and / or other forms. In different application scenarios, Network 101 can be the Internet, a wide area network (WAN), or a local area network (LAN), and can be a wired or wireless network; for example, Network 101 could be a company's internal LAN.

[0046] Server cluster 102 consists of multiple physical servers. Terminal 103 can be an electronic device such as a smartphone, tablet, laptop, or desktop computer. Various application systems are deployed on server cluster 102, and terminal 103 can obtain services provided by these application systems via network 101.

[0047] Figure 2 This diagram illustrates the interaction between an application system, an alarm system, and an alarm display system. As shown, at least one application system 201 generates alarm events and sends them to the alarm system 202. Each application system 201 includes an alarm interface, which is used to generate alarm events and send them to the alarm system 202. Alternatively, other methods exist for collecting alarm events, such as installing an alarm collector on the server hosting each application system to periodically generate and send alarm events to the alarm system 202. The alarm system 202 receives alarm events from each application system 201, distinguishes between them, filters out redundant, duplicate, inefficient, and invalid alarm events, and sends important alarm events to the alarm display system 203.

[0048] Combination Figure 1As shown, the application system, alarm system, and alarm display system can be deployed on one or more servers in server cluster 102. Operations personnel can access the alarm display system via terminal 103 to view each alarm event. When a system failure occurs in the application system, operations personnel can promptly view the corresponding alarm event. Through alarm events, operations personnel can quickly locate and resolve problems, avoiding the situation where alarm events are only seen long after a system failure has occurred, or even after significant losses have occurred. However, because the alarm system undertakes the crucial task of alarm filtering, the accuracy of the alarm filtering directly affects the work efficiency of operations personnel. Too many invalid or inefficient alarm events will prevent operations personnel from promptly addressing important alarm events.

[0049] Therefore, in order to improve the accuracy of alarm filtering in the alarm system, this disclosure provides a method for processing alarm events. Figure 3 This is a flowchart of the processing method. As shown in the figure, it includes the following steps.

[0050] In step S301, the alarm events received in real time are preprocessed to obtain a tag sequence.

[0051] based on Figure 2 Application system 201 sends various alarm events to the alarm system in real time. These alarm events are in text format, but are not limited to a specific language. Examples of alarm events include "Server 1 crashed," "Server 2 is under network attack," and "Database 1 connection failed."

[0052] According to step S301, the alarm system preprocesses the alarms received in real time and obtains a tag sequence through preprocessing. The tag sequence consists of keywords in the alarm event. The preprocessing includes but is not limited to the following steps. The first step is to clean the alarm event, including converting the case of English characters to lowercase, replacing special symbols and emoticons with substitute words. The second step is word segmentation. Word segmentation refers to splitting the Chinese character sequence into individual words using methods such as dictionary matching, statistics, and deep learning models. For example, for the alarm event "Server server1 is down", after word segmentation, it becomes four words: "service", "server", "server1", and "down". The third step is to filter out meaningless words. A strategy can be set in advance, and then meaningless words are determined and filtered according to the strategy. For example, function words such as "de" (的) and "le" (了) in Chinese words and some adjectives used as attributives are filtered. Another example is to filter "to" and "a" in English. The fourth step is word form reduction. This step is mainly for reducing the singular / plural and different word structures that are common in English. For example, "containers" is reduced to "container". The fifth step is keyword extraction. The purpose of keyword extraction is to extract key words that can represent the central theme of the alarm event from multiple words. For example, for the four words "service", "server", "server1", and "down" obtained through the third step, through keyword extraction, two words "server1" and "down" are obtained, and the tag sequence is composed of these two words. However, keyword extraction can also be directly performed on the alarm event. That is, for example, for "Server server1 is down", the words "server1" and "down" are extracted as keywords through a natural language processing model. It should be noted that although ordinal numbers such as "first" and "second" are used above to represent each step, in fact, the execution order of these steps can be adjusted.

[0053] In addition, in computer processing, for the tag sequence obtained through preprocessing, it is generally stored in a hash structure according to the hash algorithm to facilitate subsequent counting of the word frequency information of each word.

[0054] In step S302, a metric value representing the amount of information of the alarm event is calculated based on the tag sequence and historical alarm events.

[0055] In step S303, metric values representing the importance of the alarm event are calculated based on the tag sequence and historical alarm events respectively.

[0056] Continue based on Figure 2The alarm system can pre-set the calculation methods for the information content and importance of alarm events, so that in steps S302 and S303, the information content and importance of alarm events are calculated respectively according to the set calculation methods.

[0057] It should be noted that the calculation method must incorporate historical alert events to obtain metrics for information content and importance. Furthermore, the importance metric is calculated from both the word and event dimensions, while the information content metric is calculated from the event dimension.

[0058] In some embodiments, the importance metric is obtained based on the frequency of each keyword in the tag sequence in historical alarm events and the frequency of each keyword in the alarm event. Specifically, the frequency of each keyword in the tag sequence in historical alarm events is first calculated, then the frequency of each keyword in the tag sequence in the alarm event is calculated, and finally the importance metric is obtained based on the frequency of each keyword in historical alarm events and the frequency of each keyword in the alarm event.

[0059] In some embodiments, measuring the importance of alarm events from a word perspective is based on the following concept: if a word appears less frequently in historical alarm events but more frequently in alarm events, it indicates that the word has strong distinguishability and is therefore more important; otherwise, the word is less important. Based on this concept, a formula is set that satisfies the following condition: the importance of a word is inversely proportional to its frequency in historical alarm events and directly proportional to its frequency in alarm events.

[0060] In some embodiments, the measure of information content size is calculated by taking the probability value of each keyword in the tag sequence appearing in historical alarm events and the total number of historical alarm events. Then, the measure of information content size of the alarm event is obtained based on the probability values ​​of each keyword in the tag sequence. For example, if the keyword "server1" appears in 500 alarm events and there are 10,000 historical alarm events, the probability value for the keyword "server1" is 0.05. If the keyword "downtime" appears in 1,000 alarm events, the probability value for the keyword "downtime" is 0.1. The measure of information content size for the alarm event "server1 downtime" is then obtained based on 0.05 and 0.1.

[0061] It should be understood that the historical alarm events referred to in this embodiment are preferably historical alarm events from the most recent period. For example, after the alarm system receives an alarm event in real time, it uses all alarm events within the previous month as historical events and combines them with the alarm event to calculate the information content and importance of the alarm event.

[0062] Furthermore, the information content and importance metrics for multiple keywords can be calculated offline. Then, these metrics can be directly used online, avoiding massive online computations. For example, the information content and importance metrics for the keyword "downtime" can be calculated offline, and then directly used online in this step. To prevent offline calculation results from becoming outdated, offline calculations can be performed periodically to obtain information content and importance metrics for multiple keywords based on the latest historical alarm events.

[0063] In step S304, the information entropy of the alarm event is calculated based on the metric values ​​of the information content and importance of the alarm event.

[0064] Continue based on Figure 2 The alarm system can pre-set the calculation method for the information entropy of alarm events, so that the information entropy of alarm events can be calculated in this step according to the set calculation method.

[0065] In step S305, it is determined that the information entropy of the alarm event is greater than a set threshold. If so, step S306 is executed.

[0066] In step S306, the alarm event is sent out only when the information entropy of the alarm event is greater than the set threshold.

[0067] Continue based on Figure 2 Steps S305 and S306 clarify which alarm events the alarm system will send to the alarm display system. Through the previous steps, the information entropy of the alarm events received in real time has been obtained. The alarm system will block alarm events with information entropy less than or equal to a set threshold and not send them to the alarm display system, while sending alarm events with information entropy greater than the set threshold to the alarm display system.

[0068] This embodiment uses natural language text processing methods to perform preprocessing, utilize information entropy to measure the amount of information and importance carried by events, and combine historical alarm events to calculate the information entropy of real-time received alarm events. This aims to more accurately distinguish alarm events, block redundant, duplicate, inefficient, and invalid alarm events, and send important alarm events.

[0069] In some embodiments, knowledge points are extracted based on the distribution of each keyword in historical alarm events, and these knowledge points are applied to future alarm filtering, thereby further improving system capabilities. For example, keywords with high frequency of occurrence are continuously added to the thesaurus based on the distribution of each keyword in historical alarm events, and the thesaurus can be used for preprocessing of subsequent alarm events.

[0070] In some embodiments, the above method further includes a configuration step. For example, setting priorities and controlling the latency based on priorities, such as processing high-priority alarm events in real time and processing low-priority alarm events in batches. For instance, for some regular alarm events, their priorities are set to be low.

[0071] Furthermore, priorities can be set based on the frequency of each keyword appearing in historical alarm events and / or the probability of an alarm event appearing in historical alarm events. For example, filter words and priority words can be set. If the tag sequence contains a filter word, the corresponding alarm event will be blocked in the alarm system without going through the above steps, awaiting batch processing or not being processed at all. Alternatively, the corresponding alarm event will still go through the above steps, but after obtaining the information entropy of the alarm event, the information entropy of the alarm event will be adjusted according to the filter word. Similarly, if the tag sequence contains a priority word, the corresponding alarm event will be sent directly to the alarm display system without going through the above steps, or the corresponding alarm event will still go through the above steps, but after obtaining the information entropy of the alarm event, the information entropy of the alarm event will be adjusted according to the priority word. Another approach is to calculate the information content and importance of each keyword, and then combine the weight of each keyword to calculate the final information content and importance of the alarm event. If a keyword is not a priority keyword, it will receive a default weight, while priority keywords will receive a higher weight, thereby increasing the information entropy of the alarm event through priority keywords.

[0072] Figure 4 This is a flowchart of an alarm event processing method provided in another embodiment of this disclosure, which specifically includes the following steps.

[0073] In step S401, the alarm events received in real time are preprocessed to obtain a tag sequence.

[0074] In step S402, the TF-IDF value of each keyword is obtained based on the tag sequence and historical alarm events to obtain the first vector.

[0075] In step S403, the probability of each keyword appearing in the tag sequence is calculated based on the tag sequence and historical alarm events, and a second vector is obtained based on the probability of each keyword appearing.

[0076] In step S404, the information entropy of the alarm event is obtained based on the first vector and the second vector.

[0077] In step S405, it is determined that the information entropy of the alarm event is greater than a set threshold. If so, step S406 is executed.

[0078] In step S406, the alarm event is sent out only when the information entropy of the alarm event is greater than the set threshold.

[0079] In this embodiment, steps S401, S405, and S406 are the same as steps S301, S305, and S306 in the previous embodiment, and will not be described in detail here. Step S402 calculates the TD-IDF value of each keyword in the labeled sequence using the TD-IDF algorithm, and obtains a w vector accordingly. Step S403 calculates the probability value of the alarm event based on the number of events in historical alarm events and the total number of historical alarm events for each keyword in the labeled sequence, and then obtains a measure of the information content of the alarm event based on the probability value of each keyword in the labeled sequence. Specifically, obtaining the measure of the information content of the alarm event based on the probability value of each keyword in the labeled sequence can be achieved by calculating the negative value of the logarithm of the probability value of each keyword using the formula -log(p), and then forming an x ​​vector from the values ​​corresponding to each keyword. The step of obtaining the information entropy of an alarm event based on vectors w and x can be to multiply the w and x vectors and use the resulting value as the information entropy of the alarm event. However, this step can also be further processed using the following formula: the final value of the information entropy is in the interval [0,1] through an activation function (Sigmod). Furthermore, the activation formula can be replaced with other methods: normalizing the multiplication of the w and x vectors to map the result to the interval [0,1], or other nonlinear functions such as tanh, ReLU, etc.

[0080] Figure 5 This is a structural diagram of an alarm event processing device provided in another embodiment of the present disclosure. As shown in the figure, the processing device 500 includes a preprocessing module 501, an information entropy calculation module 502, and an alarm output module 503.

[0081] The preprocessing module 501 is used to preprocess the alarm events received in real time to obtain a tag sequence, which is composed of keywords in the alarm events.

[0082] The information entropy calculation module 502 is used to calculate the information quantity and importance of the alarm event based on the tag sequence and historical alarm events, respectively, and to calculate the information entropy of the alarm event based on the information quantity and importance of the alarm event.

[0083] The alarm output module 503 is used to send out alarm events only when the information entropy of the alarm event is greater than a set threshold.

[0084] In the preprocessing module 501, preprocessing includes, but is not limited to, the following steps: cleaning alarm events, word segmentation, filtering meaningless words, word type restoration, and keyword extraction. For details of these steps, please refer to the description of step S301 above.

[0085] In the information entropy calculation module 502, the measurement values ​​of the information quantity and importance of the alarm event can be calculated using a set calculation method, and the information entropy can be calculated based on the measurement values ​​of the information quantity and importance of the alarm event according to the set calculation method.

[0086] In this calculation method, historical alarm events must be considered to obtain metrics for information content and importance. Furthermore, the importance metric is calculated from both the word and event dimensions, with the emphasis metric calculated from the event dimension. Specifically, for the importance metric, the importance of the alarm event is determined based on the frequency of each keyword in the tag sequence appearing in historical alarm events and the frequency of each keyword appearing in the current alarm event. For the information content metric, the probability value of the alarm event is calculated based on the number of events in which each keyword in the tag sequence appears in historical alarm events and the total number of events in historical alarm events. Then, the information content metric of the alarm event is obtained based on the probability values ​​of each keyword in the tag sequence. For detailed information about this calculation method, please refer to the description of step S303 above.

[0087] In the alarm output module 503, it is determined whether the information entropy of the alarm event is greater than a set threshold. If so, the alarm event is sent to an external system; otherwise, the alarm event is processed separately. This separate processing could include waiting for batch processing or blocking locally.

[0088] This disclosure provides a management application scenario for alarm events that require real-time monitoring. When a new event arrives, the information content and importance of the event are calculated in real time based on word frequency statistics and event probability statistics. The information entropy of the alarm event is obtained accordingly. Then, the alarm events are filtered according to the information entropy, thereby blocking redundant, duplicate, inefficient and invalid alarm events and sending important alarm events to the destination.

[0089] This disclosure also provides an electronic device 600, such as... Figure 6As shown, at the hardware level, it includes a memory 602 and a processor 601. In addition, in some cases, it also includes input / output devices 603 and other hardware 604. The memory 602 is, for example, high-speed random-access memory (RAM), or it may be non-volatile memory, such as at least one disk storage device. The input / output device 603 is, for example, a monitor, keyboard, mouse, network controller, etc. The processor 601 can be built based on various models of processors currently on the market. The processor 601, memory 602, input / output devices 603, and other hardware 604 are interconnected via a bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, Figure 6 The symbol is represented by only one line, but this does not mean that there is only one bus or one type of bus.

[0090] Memory 602 is used to store programs. Specifically, the program may include program code, which includes computer instructions. The memory may include main memory and non-volatile memory, and provides computer instructions and data to processor 601. Processor 601 reads the corresponding computer program from memory 602 into main memory and then runs it, which is the alarm event handling method of the above embodiment at the logical level.

[0091] Those skilled in the art will understand that this disclosure can be implemented as a system, method, and computer program product. Therefore, this disclosure can be implemented as entirely hardware, entirely software (including firmware, resident software, and microcode), or a combination of software and hardware. Furthermore, in some embodiments, this disclosure can also be implemented as a computer program product contained in one or more computer-readable media, the computer-readable media containing computer-readable program code.

[0092] Any combination of one or more computer-readable media may be used. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium is, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium include: an electrical connection of one or more wires, a portable computer disk, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage, magnetic storage, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with a processing unit, apparatus, or device.

[0093] Computer-readable signal media may include data signals propagated in baseband or as part of a chopped signal, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any other suitable combination. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of transmitting, propagating, or transmitting programs for use by or in connection with an instruction system, apparatus, or device.

[0094] The program code contained on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wire, optical fiber, RF, and any suitable combination thereof.

[0095] Computer program code for executing embodiments of this disclosure can be written in one or more programming languages ​​or combinations thereof. The programming languages ​​include object-oriented programming languages ​​such as JAVA and C++, and may also include conventional procedural programming languages ​​such as C. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0096] The above description is merely a preferred embodiment of this disclosure and is not intended to limit this disclosure. Various modifications and variations can be made to this disclosure by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for handling alarm events, comprising: The alarm events received in real time are preprocessed to obtain a tag sequence, which is composed of keywords in the alarm events; Calculate the information content and importance of the alarm event based on the tag sequence and historical alarm events, respectively. The information entropy of the alarm event is calculated based on the metrics of the amount of information and the importance of the alarm event. The alarm event is sent out only when the information entropy of the alarm event is greater than a set threshold.

2. The processing method according to claim 1, wherein, The metrics used to calculate the importance of the alarm event based on the tag sequence and historical alarm events include: The importance of an alarm event is measured based on the frequency of each keyword in the tag sequence occurring in the historical alarm event and the frequency of occurrence in the alarm event.

3. The processing method according to claim 1, wherein, The metric for calculating the information content of the alarm event based on the tag sequence and historical alarm events includes: Calculate the probability value of each keyword in the alarm event by calculating the number of events in which each keyword in the labeled sequence appears in the historical alarm events and the total number of events in the historical alarm events; and The information content of the alarm event is measured based on the probability value of each keyword in the labeled sequence.

4. The processing method according to claim 1, wherein, The first vector, composed of the TF-IDF values ​​of each keyword in the labeled sequence, is used as a measure of the importance of the alarm event.

5. The processing method according to claim 4, wherein, The measure of the information content of the alarm event calculated based on the tag sequence and historical alarm events includes: using a second vector composed of the negative logarithm of the probability values ​​of each keyword in the tag sequence as the measure of the information content of the alarm event.

6. The processing method according to claim 5, wherein, The calculation of the information entropy of the alarm event based on the metrics of the amount of information and the importance of the alarm event includes: The product of the first vector and the second vector is mapped to a set numerical range, and the final mapped value is used as the information entropy of the alarm event.

7. The processing method according to claim 6, wherein, The product of the first and second vectors can be mapped to a set numerical range using one of the following functions: sigmoid function, normalization function, tanh function, and relu function.

8. The processing method according to claim 1, wherein, The preprocessing includes one or more of the following: cleaning alarm events, word segmentation, filtering meaningless words, word form restoration, and keyword extraction.

9. The processing method according to claim 1, further comprising: The information entropy of the alarm event is adjusted according to the preset filter words or priority words.

10. The processing method according to claim 1, further comprising: The marker sequence is retrieved according to the preset priority words. If the marker sequence includes the preset priority words, the alarm event is sent directly.

11. An alarm event processing device, comprising: The preprocessing module is used to preprocess the alarm events received in real time to obtain a tag sequence, which is composed of keywords in the alarm events; The information entropy calculation module is used to calculate the information content size and importance of the alarm event based on the label sequence and historical alarm events, respectively, and to calculate the information entropy of the alarm event based on the information content size and importance of the alarm event. The alarm output module is used to send out the alarm event only when the information entropy of the alarm event is greater than a set threshold.

12. An electronic device comprising a memory and a processor, the memory further storing computer instructions executable by the processor, the computer instructions, when executed, implementing the processing method as described in any one of claims 1 to 10.

13. A computer-readable medium storing computer instructions executable by an electronic device, wherein the computer instructions, when executed, implement the processing method as described in any one of claims 1 to 10.

Images