Method, device, computer equipment and storage medium for determining alarm level

Abstract

The embodiments of the present invention relate to a method, apparatus, computer equipment and storage medium for determining an alarm level, including: determining a target feature corresponding to a target alarm; querying a target level corresponding to the target feature from an association relationship, using the target level as the alarm level of the target alarm, and using the alarm level in historical alarm data as a basis for judging the target alarm, so as to accurately predict the target level corresponding to the target alarm, so as to remind operation and maintenance personnel to perform corresponding processing through the target level, thereby improving the accuracy of the alarm and the timeliness of the processing.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of fault alarms, and in particular to a method, device, computer equipment and storage medium for determining an alarm level. Background Art

[0002] The rapid development of computer technology has brought stronger processing power, more storage space and faster network environment. This allows applications to serve more people and face greater load pressure. As the complexity of the internal logic of applications continues to increase, their development and operation and maintenance face more and more challenges. In order to reduce the cost of development and operation and maintenance, more and more applications are beginning to use microservice frameworks to develop and deploy businesses. Microservices divide the functions of an application into several small functional modules. Each functional module interacts with each other through the network. However, with the subdivision of microservice modules, the stability of microservices also faces great challenges. A single application may be composed of dozens or hundreds of microservice modules, and each microservice module is heterogeneous, which makes microservices often face various exceptions.

[0003] Alarm is an important part of microservices. Currently, most alarm solutions for microservices support custom alarm levels, and developers can choose to handle alarms according to the alarm level. Due to the randomness and uncertainty of fault-alarms, developers cannot exhaust all types of alarms. Therefore, when an unknown alarm occurs, it is impossible to effectively judge the alarm and give a corresponding processing level. Summary of the invention

[0004] In view of this, in order to solve the above technical problems or part of the technical problems, the embodiments of the present invention provide a method, an apparatus, a computer device and a storage medium for determining an alarm level.

[0005] In a first aspect, an embodiment of the present invention provides a method for determining an alarm level, comprising:

[0006] Determine the target characteristics corresponding to the target alarm;

[0007] Querying a target level corresponding to the target feature from the association relationship, wherein the association relationship stores a correspondence relationship between multiple sets of preset features and alarm levels, and the target level is the alarm level corresponding to the preset feature closest to the target feature;

[0008] The target level is used as the alarm level of the target alarm.

[0009] In a possible implementation, the association relationship is constructed in the following manner:

[0010] Obtain a set of historical alarm data within a preset time period, each of which is set with corresponding features and alarm levels;

[0011] Performing clustering and grouping processing on the historical alarm data set by using a K-means clustering algorithm to obtain a plurality of historical alarm data subsets, each of the historical alarm data subsets being correspondingly provided with a preset feature;

[0012] Determine an average alarm level corresponding to each subset of the historical alarm data to obtain a plurality of average alarm levels;

[0013] The association relationship is established based on the multiple average alarm levels and the corresponding multiple preset features.

[0014] In a possible implementation, the historical alarm data set is clustered and grouped using a K-means clustering algorithm to obtain a plurality of historical alarm data subsets, including:

[0015] Randomly select a feature corresponding to a historical alarm data from the historical alarm data set as the first K value;

[0016] According to a preset rule, N-1 features corresponding to N-1 historical alarm data are selected from the historical alarm data set as the second to N K values, where N is greater than 1;

[0017] Using the N K values ​​to perform clustering and grouping processing on the historical alarm data set to obtain N historical alarm data subsets;

[0018] For any of the N historical alarm data subsets, when the average characteristics of the historical alarm data subset and the corresponding K value do not meet the preset conditions, the K value in each of the historical alarm data subsets is updated, and the step of clustering and grouping the historical alarm data set is re-executed so that the average characteristics of the historical alarm data subset after re-clustering and grouping and the corresponding K value meet the preset conditions.

[0019] In a possible implementation, the method further includes:

[0020] When the average feature of the historical alarm data subsets and the corresponding K value meet the preset conditions, the updated K value in each of the historical alarm data subsets is used as the corresponding preset feature.

[0021] In a possible implementation manner, the average feature of the historical alarm data subset after the re-clustering and grouping and the corresponding K value meet the preset conditions, including:

[0022] The average characteristic of the historical alarm data subset after re-clustering and grouping is the same as the corresponding K value;

[0023] or,

[0024] The average feature of the historical alarm data subset after re-clustering and grouping is closest to the corresponding K value.

[0025] In one possible implementation, the features include: text data;

[0026] The distance between the features is calculated by:

[0027] The features are segmented, and the Jaccard distances corresponding to the features after segmentation are used as the distances between the features.

[0028] In one possible implementation, the feature includes: numerical data;

[0029] The distance between the features is calculated by:

[0030] The difference between the features is taken as the distance between the features.

[0031] In a second aspect, an embodiment of the present invention provides a device for determining an alarm level, including:

[0032] A determination module, used to determine target features corresponding to the target alarm;

[0033] A query module, used to query a target level corresponding to the target feature from the association relationship, wherein the association relationship stores a correspondence relationship between multiple sets of preset features and alarm levels, and the target level is the alarm level corresponding to the preset feature closest to the target feature;

[0034] The determining module is further configured to use the target level as the alarm level of the target alarm.

[0035] In a third aspect, an embodiment of the present invention provides a computer device, comprising: a processor and a memory, wherein the processor is used to execute an alarm level determination program stored in the memory to implement the alarm level determination method described in any one of the first aspects.

[0036] In a fourth aspect, an embodiment of the present invention provides a storage medium, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method for determining the alarm level described in any one of the first aspects.

[0037] The alarm level determination scheme provided in the embodiment of the present invention determines the target feature corresponding to the target alarm; queries the target level corresponding to the target feature from the association relationship, uses the target level as the alarm level of the target alarm, and uses the alarm level in the historical alarm data as the judgment basis for the target alarm. The target level corresponding to the target alarm can be accurately predicted, so as to remind the operation and maintenance personnel to perform corresponding processing through the target level, thereby improving the accuracy of the alarm and the timeliness of the processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 A flowchart of a method for determining an alarm level provided by an embodiment of the present invention;

[0039] Figure 2 A schematic diagram of a flow chart of a method for establishing an association relationship provided in an embodiment of the present invention;

[0040] Figure 3 A schematic diagram of a process for clustering and grouping the historical alarm data set using a K-means clustering algorithm to obtain multiple historical alarm data subsets is provided in an embodiment of the present invention;

[0041] Figure 4 A schematic diagram of the structure of a device for determining an alarm level provided by an embodiment of the present invention;

[0042] Figure 5 A schematic diagram of the structure of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0044] To facilitate understanding of the embodiments of the present invention, specific embodiments will be further explained below in conjunction with the accompanying drawings. The embodiments do not constitute a limitation on the embodiments of the present invention.

[0045] Figure 1 A flowchart of a method for determining an alarm level provided by an embodiment of the present invention is shown in FIG. Figure 1 As shown, specifically including:

[0046] S11. Determine the target feature corresponding to the target alarm.

[0047] The method for determining the alarm level provided in an embodiment of the present invention is applied to alarm monitoring in microservices. By pre-constructing an association relationship between historical alarm data and alarm levels, when a new alarm is detected, the new alarm level can be determined by querying the pre-constructed association relationship. The alarm can be a fault alarm, an indicator abnormality alarm, etc. The microservice where the alarm occurs can also be represented by an alarm node.

[0048] Furthermore, when a new alarm is detected, the new alarm is used as a target alarm, and a corresponding target feature is extracted from the target alarm. The feature is used to characterize the fault content corresponding to the target alarm. For example, if the fault content corresponding to the target alarm is that the CPU utilization rate is 75%, then the target feature corresponding to the target alarm is 75%.

[0049] S12: Query the target level corresponding to the target feature from the association relationship.

[0050] In this embodiment, an association relationship is pre-constructed, in which a plurality of sets of correspondences between preset features and alarm levels are stored. The preset features are obtained from the fault content in the historical alarm data. The preset features can be numerical values ​​or texts, and are used to characterize the fault content in the historical alarm data.

[0051] Furthermore, historical alarm data is obtained, which includes metadata of the alarm (the metadata can be understood as the content of the fault, such as computer room, service, IP, alarm type, interface address), and the alarm level corresponding to the alarm; preset features corresponding to the fault are extracted from the metadata in the historical alarm data.

[0052] In one example, alarm data A may be: CPU utilization is 75%, and the alarm level is "medium"; alarm data B may be: CPU utilization is 90%, and the alarm level is "high".

[0053] Accordingly, the association relationship can be:

[0054] Serial number CPU Utilization level 1 75 middle 2 90 high

[0055] Table 1

[0056] According to the target feature corresponding to the target alarm, the target level corresponding to the target feature is matched from the association relationship. The target level may be the alarm level corresponding to the preset feature that is closest to the target feature.

[0057] S13: Using the target level as the alarm level of the target alarm.

[0058] In this embodiment, the target level corresponding to the target alarm is obtained through the pre-constructed association relationship in the form of query matching, and the target level is used as the alarm level of the target alarm, so as to facilitate the subsequent corresponding processing of the target alarm according to the target level.

[0059] Accordingly, the target alarm may be one of the historical alarm data, or a newly appeared alarm (that is, an alarm that has not appeared before and is not included in the historical alarm data); when the target alarm is one of the historical alarm data, the target alarm level corresponding to the target alarm is directly queried from the association relationship; when the target alarm data is a new alarm, the alarm level corresponding to the preset feature closest to the target feature is queried from the association relationship (that is, the newly appeared alarm) as the target level. The target level has the highest similarity to the newly appeared alarm, and its alarm level can be adopted as the target level.

[0060] The method for determining the alarm level provided in an embodiment of the present invention determines the target feature corresponding to the target alarm; queries the target level corresponding to the target feature from the association relationship, uses the target level as the alarm level of the target alarm, and uses the alarm level in the historical alarm data as the judgment basis for the target alarm. The target level corresponding to the target alarm can be accurately predicted, so as to remind the operation and maintenance personnel to perform corresponding processing through the target level, thereby improving the accuracy of the alarm and the timeliness of the processing.

[0061] Figure 2 A flowchart of a method for constructing an association relationship provided by an embodiment of the present invention is shown in FIG. Figure 2 As shown, specifically including:

[0062] S21. Obtain a set of historical alarm data within a preset time period, each set of historical alarm data being provided with corresponding features and alarm levels.

[0063] In this embodiment, the alarms generated by the microservices are recorded, and the alarm data is stored in a structured manner. The stored structured historical alarm data is parsed by regular expressions to obtain metadata corresponding to the historical alarm data. The metadata may include: computer room, service, IP address, alarm type, interface address, etc.

[0064] Furthermore, feature extraction is performed on each historical alarm data to obtain the features and alarm levels corresponding to each historical alarm data. The feature is used to characterize the main information of the alarm (for example, the alarm type of alarm A is CPU alarm, specifically the CPU utilization rate is 85%, and the feature is 85%), and the alarm level is used to characterize the level to which the alarm belongs (for example, the alarm level of alarm A is "intermediate").

[0065] Furthermore, a set of historical alarm data within a preset time is obtained, and a historical alarm data set consisting of multiple historical alarm data within the preset time period is obtained. The historical alarm data is stored using structured data, and the structured historical alarm data is parsed using regular expressions to obtain the characteristics and alarm levels corresponding to each historical alarm data, and then multiple historical alarm data corresponding to the historical alarm data set are obtained, and each historical alarm data is set with corresponding characteristics and alarm levels.

[0066] In an optional solution of an embodiment of the present invention, the historical alarm data in the historical alarm data set is classified according to the alarm type in the metadata. For example, the alarm data corresponding to the CPU utilization is classified into one category, the alarm data corresponding to the memory usage is classified into another category, and so on.

[0067] In one example, a historical alarm data set within 4 months is obtained, corresponding meta information is extracted from the historical alarm data set, the historical alarm data is classified according to the alarm type in the meta information, and the characteristics and alarm levels corresponding to each type of historical alarm data are determined.

[0068] In an optional scheme of an embodiment of the present invention, the historical alarm data set obtained within a preset time period can be historical alarm data of the same type. In this way, there is no need to perform the step of classifying the historical alarm data. Instead, the step of clustering and grouping the historical alarm data set using the K-means clustering algorithm can be directly performed to obtain multiple historical alarm data subsets.

[0069] S22. Perform clustering and grouping processing on the historical alarm data set using a K-means clustering algorithm to obtain a plurality of historical alarm data subsets, each of which is correspondingly provided with a preset feature.

[0070] In this embodiment, for the historical alarm data of the same category in the historical alarm data set, a K-means clustering algorithm is used to perform clustering and grouping operations, and the historical alarm data subsets divided into each category of historical alarm data can be set according to actual needs.

[0071] For example, the historical alarm data set includes three categories of alarms. For the first category of alarms, 4 K values ​​are pre-divided (K value is the characteristic of the historical alarm data), and the K-means clustering algorithm is used to pre-divide the first category of alarms in the historical alarm data set into 4 historical alarm data subsets; for the second category of alarms, 3 K values ​​are pre-divided, and the K-means clustering algorithm is used to pre-divide the second category of alarms in the historical alarm data set into 3 historical alarm data subsets; for the third category of alarms, 2 K values ​​are pre-divided, and the K-means clustering algorithm is used to pre-divide the third category of alarms in the historical alarm data set into 2 historical alarm data subsets.

[0072] Furthermore, the K-means clustering algorithm is used to perform clustering and grouping processing on the historical alarm data set. The clustering and grouping process includes one or more selections of K values, thereby obtaining multiple historical alarm data subsets, and taking the most recently updated K value in each historical alarm data subset as a preset feature.

[0073] S23: Determine the average alarm level corresponding to each subset of the historical alarm data to obtain multiple average alarm levels.

[0074] S24: constructing the association relationship based on the multiple average alarm levels and the corresponding multiple preset features.

[0075] In this embodiment, the alarm levels of the historical alarm data in each historical alarm data subset are counted to determine the average alarm level corresponding to each historical alarm data subset. The average alarm level can be the average value of the alarm levels corresponding to all the historical alarm data in each of the historical alarm data subsets, or the alarm level with the highest proportion of alarm levels in each of the historical alarm data subsets.

[0076] Furthermore, an association relationship is constructed based on the average alarm level of each historical alarm data subset and the corresponding preset feature, and the association relationship is used to characterize the correspondence between the preset feature and the average alarm level.

[0077] Figure 3 A schematic diagram of a process for clustering and grouping the historical alarm data set using a K-means clustering algorithm to obtain multiple historical alarm data subsets is provided in an embodiment of the present invention, such as Figure 3 As shown, specifically including:

[0078] S31. Randomly select a feature corresponding to a historical alarm data from the historical alarm data set as the first K value.

[0079] In this embodiment, before using the K-means clustering algorithm to cluster and group the historical alarm data set, it is necessary to pre-select N K values. The features corresponding to the historical alarm data can be used as K values. Accordingly, the number of K values ​​is the same as the number of historical alarm data subsets after clustering and grouping, that is, N K values ​​correspond to N historical alarm data subsets.

[0080] The historical alarm data set includes one type or multiple types of alarm data. The processing methods of one type or multiple types of alarm data are basically similar. For the sake of brief description, the following will take the historical alarm data set including one type of alarm data as an example for introduction.

[0081] Furthermore, a feature corresponding to a historical alarm data is randomly selected from the historical alarm data set as the first K value.

[0082] S32. According to a preset rule, select N-1 features corresponding to N-1 historical alarm data from the historical alarm data set as the second to N K values, where N is greater than 1.

[0083] In this embodiment, except for the first K value, the preset rules corresponding to the selection of the remaining N-1 K values ​​may include: based on the first K value, selecting a value that is farthest from the first K value from the remaining historical alarm data set as the second K value, the third K value that is farthest from the sum of the distances between the first K value and the second K value (for example, max(s1+s2) is used as the third K value, s1 represents the distance between the third K value and the first K value, and s2 represents the distance between the third K value and the second K value.) as the third K value, the fourth K value that is farthest from the sum of the distances between the first K value, the second K value and the third K value (for example, max(s1+s2+s3) is used as the third K value, s1 represents the distance between the third K value and the first K value, and s2 represents the distance between the third K value and the second K value.) 1 represents the distance between the fourth K value and the first K value, s2 represents the distance between the fourth K value and the second K value, and s3 represents the distance between the fourth K value and the third K value. ) is taken as the fourth K value, …, the Nth K value is the sum of the distances from the first K value, the second K value, the third K value, … and the N-1th K value (for example, max(s1+s2+s3+…+sN-1) is taken as the third K value, s1 represents the distance between the Nth K value and the first K value, s2 represents the distance between the Nth K value and the second K value, s3 represents the distance between the Nth K value and the third K value, …, sN-1 represents the distance between the Nth K value and the N-1th K value.) is taken as the Nth K value.

[0084] In an optional solution of the embodiment of the present invention, the feature includes: text data; the method of calculating the distance between the features includes: segmenting the feature, and using the Jaccard distance corresponding to the feature after segmentation as the distance between the features.

[0085] In one example, node A is an alarm node, and the features extracted from the alarm data include: North China Beijing computer room; node B is an alarm node, and the features extracted from the alarm data include: North China Changchun computer room.

[0086] Calculating the distance between the corresponding features of node A and node B may include: performing word segmentation processing on "North China Beijing Computer Room" (for example, using a dictionary-based word segmentation method, a statistics-based word segmentation method, and a machine learning word segmentation method to perform the word segmentation operation, which is not specifically limited in this embodiment), and obtaining a word segmentation set A "North China", "Beijing", and "Computer Room", performing word segmentation processing on "North China Changchun Computer Room", and obtaining a word segmentation set B "North China", "Changchun", and "Computer Room", and using the Jaccard distance (Jaccard) to calculate the distance between the word segmentation set A and the word segmentation set B, d(A,B) = |A∪B|-|A∩B| = 4-2 = 2, that is, the distance between the corresponding features of node A and node B is 2.

[0087] In an optional solution of the embodiment of the present invention, the feature includes: numerical data; and the method of calculating the distance between the features includes: taking the difference between the features as the distance between the features.

[0088] In one example, node A is an alarm node, and the features extracted from the alarm data include: CPU utilization is 75; node B is an alarm node, and the features extracted from the alarm data include: CPU utilization is 60.

[0089] Calculating the distance between the corresponding features of node A and node B may include: calculating the difference between the CPU utilizations of the two, 75-60=15, that is, the distance between the corresponding features of node A and node B is 15.

[0090] It should be noted that the number N corresponding to the K values ​​involved in this embodiment can be set according to actual needs. This embodiment does not make any specific limitation on this. For example, N is set to 4, that is, 4 K values ​​are determined from the historical alarm data.

[0091] S33: Use the N K values ​​to perform clustering and grouping processing on the historical alarm data set to obtain N historical alarm data subsets.

[0092] In this embodiment, after determining N K values, the historical alarm data set is clustered and grouped using the N K values. The processing process may be: calculating the distance between the historical alarm data and the N K values ​​in the historical alarm data set except for the N K values. If the historical alarm data is closer to a certain K value, the historical alarm data and the K value are divided into a group to obtain N historical alarm data subsets, each of which contains at least one historical alarm data.

[0093] In one example, four K values ​​are determined from a historical alarm data set. Assume that the features corresponding to the four K values ​​are A (CPU utilization: 10%, computer room: North China Beijing computer room), B (CPU utilization: 20%, computer room: North China Changchun computer room), C (CPU utilization: 30%, computer room: North China Beijing computer room), and D (CPU utilization: 40%, computer room: Central China Wuhan computer room). The feature corresponding to the alarm node E is (CPU utilization: 25%, computer room: North China Changchun computer room). Then E is closest to K value B, and E and B are divided into a historical alarm data set.

[0094] S34. For any of the N historical alarm data subsets, when the average characteristics of the historical alarm data subset and the corresponding K value do not meet the preset conditions, the K value in each of the historical alarm data subsets is updated, and the step of clustering and grouping the historical alarm data set is re-executed to make the average characteristics of the historical alarm data subset after re-clustering and grouping and the corresponding K value meet the preset conditions.

[0095] In this embodiment, since the selection of the first K value is random and has a certain degree of uncertainty, it is necessary to determine whether the average characteristics of each historical alarm subset and the corresponding K value meet the preset conditions. When the preset conditions are met, the K value is re-determined in each historical alarm subset to complete the update of the K value, and then the historical alarm data set is re-executed for clustering and grouping.

[0096] Furthermore, the average characteristics of the historical alarm data subset after re-clustering and grouping meet preset conditions with the corresponding K value, including: the average characteristics of the historical alarm data subset after re-clustering and grouping are the same as the corresponding K value; or the average characteristics of the historical alarm data subset after re-clustering and grouping are closest to the corresponding K value.

[0097] Accordingly, the preset condition may be that the average characteristic of the historical alarm data subset is the same as the corresponding K value, or the average characteristic is closest to the corresponding K value.

[0098] In an example, suppose that the historical alarm subset contains five historical alarm data (i.e., five alarm nodes) A, F, G, H, and I, where A is the current K value, and the average feature of the five historical alarm data is: 37.5. Correspondingly, the distances between F, G, H, and I and A are: S FA =10,S GA =20,S HA =40,S IA =80, the average feature is closest to H, so H is selected as the new K value.

[0099] In an optional solution of the embodiment of the present invention, when the average feature of the historical alarm data subset and the corresponding K value meet the preset conditions, the updated K value in each of the historical alarm data subsets is used as the corresponding preset feature.

[0100] In an example, suppose that after multiple clustering groupings, a historical alarm subset contains five historical alarm data (that is, 5 alarm nodes) A, F, G, H, and I, where G is the current K value, and the average feature of the five historical alarm data is: 37.5. Correspondingly, the feature of A is 10, the feature of F is 20, the feature of G is 40, the feature of H is 60, and the feature of I is 80. The average feature and the feature of G meet the preset conditions (the average feature is closest to the corresponding K value). Therefore, the clustering grouping is completed, and G is used as the preset feature value in the historical alarm subset.

[0101] In an example, suppose that after multiple clustering groupings, a historical alarm subset contains five historical alarm data (i.e., 5 alarm nodes) A, F, G, H, and I, where G is the current K value, and the average feature of the five historical alarm data is 40. Correspondingly, the feature of A is 10, the feature of F is 20, the feature of G is 40, the feature of H is 60, and the feature of I is 80. The average feature and the feature of G meet the preset conditions (the average feature is the same distance from the corresponding K value). Therefore, the clustering grouping is completed, and G is used as the preset feature value in the historical alarm subset.

[0102] Figure 4 A schematic diagram of a structure of a device for determining an alarm level provided by an embodiment of the present invention, such as Figure 4 As shown, the structure specifically includes:

[0103] A determination module 41, used to determine the target feature corresponding to the target alarm;

[0104] A query module 42 is used to query the target level corresponding to the target feature from the association relationship, wherein the association relationship stores a correspondence relationship between multiple sets of preset features and alarm levels, and the target level is the alarm level corresponding to the preset feature closest to the target feature;

[0105] The determining module 41 is further configured to use the target level as the alarm level of the target alarm.

[0106] In a possible implementation, the device further includes:

[0107] Construction module 43 is used to obtain a set of historical alarm data within a preset time period, each historical alarm data is set with corresponding characteristics and alarm levels; use K-means clustering algorithm to cluster and group the historical alarm data set to obtain multiple historical alarm data subsets, each of which is set with preset characteristics; determine the average alarm level corresponding to each of the historical alarm data subsets to obtain multiple average alarm levels; based on the multiple average alarm levels and the corresponding multiple preset characteristics, construct the association relationship.

[0108] In one possible implementation, the construction module 43 is specifically used to randomly select a feature corresponding to a historical alarm data from the historical alarm data set as the first K value; select N-1 features corresponding to N-1 historical alarm data from the historical alarm data set according to a preset rule as the second to N K values, wherein N is greater than 1; perform clustering and grouping processing on the historical alarm data set using the N K values ​​to obtain N historical alarm data subsets; for any of the N historical alarm data subsets, when the average feature of the historical alarm data subset and the corresponding K value do not meet the preset conditions, update the K value in each of the historical alarm data subsets, and re-execute the step of clustering and grouping the historical alarm data set, so that the average feature of the re-clustered and grouped historical alarm data subset and the corresponding K value meet the preset conditions.

[0109] In a possible implementation manner, the construction module 43 is further configured to use the updated K value in each of the historical alarm data subsets as the corresponding preset feature when the average feature of the historical alarm data subsets and the corresponding K value meet a preset condition.

[0110] In a possible implementation, the construction module 43 is further used to make the average characteristic of the historical alarm data subset after re-clustering and grouping the same as the corresponding K value; or, the average characteristic of the historical alarm data subset after re-clustering and grouping is closest to the corresponding K value.

[0111] In a possible implementation, the feature includes: text data; and the distance between the features is calculated by: segmenting the feature, and using the Jaccard distance corresponding to the feature after segmentation as the distance between the features.

[0112] In a possible implementation manner, the feature includes: numerical data; and the method for calculating the distance between the features includes: taking the difference between the features as the distance between the features.

[0113] The alarm level determination device provided in this embodiment may be as follows Figure 4 The alarm level determination device shown in , can be executed as follows Figure 1-3 All steps of the method for determining the alarm level in Figure 1-3 For details, please refer to the technical effect of the method for determining the alarm level shown in Figure 1-3 For the sake of brevity, the relevant description is not repeated here.

[0114] Figure 5 A schematic diagram of the structure of a computer device provided by an embodiment of the present invention, Figure 5 The computer device 500 shown includes: at least one processor 501, a memory 502, at least one network interface 504 and other user interfaces 503. The various components in the computer device 500 are coupled together via a bus system 505. It is understood that the bus system 505 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 505 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the bus system 505 is not described in detail. Figure 5 Various buses are labeled as bus system 505 .

[0115] The user interface 503 may include a display, a keyboard, or a pointing device (eg, a mouse, a trackball, a touch pad, or a touch screen).

[0116] It can be understood that the memory 502 in the embodiment of the present invention can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DRRAM). The memory 502 described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0117] In some implementations, the memory 502 stores the following elements, executable units or data structures, or a subset thereof, or an extended set thereof: an operating system 5021 and an application program 5022 .

[0118] The operating system 5021 includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., which are used to implement various basic services and process hardware-based tasks. The application 5022 includes various application programs, such as a media player (MediaPlayer), a browser (Browser), etc., which are used to implement various application services. The program for implementing the method of the embodiment of the present invention can be included in the application 5022.

[0119] In the embodiment of the present invention, by calling the program or instruction stored in the memory 502, specifically, the program or instruction stored in the application 5022, the processor 501 is used to execute the method steps provided by each method embodiment, for example, including:

[0120] Determine the target feature corresponding to the target alarm; query the target level corresponding to the target feature from the association relationship, wherein the association relationship stores a plurality of sets of correspondences between preset features and alarm levels, and the target level is the alarm level corresponding to the preset feature that is closest to the target feature; use the target level as the alarm level of the target alarm.

[0121] In one possible implementation, a set of historical alarm data within a preset time period is obtained, each historical alarm data is provided with corresponding features and alarm levels; the historical alarm data set is clustered and grouped using a K-means clustering algorithm to obtain a plurality of historical alarm data subsets, each of which is provided with preset features; the average alarm level corresponding to each of the historical alarm data subsets is determined to obtain a plurality of average alarm levels; and the association relationship is constructed based on the plurality of average alarm levels and the corresponding plurality of preset features.

[0122] In one possible implementation, a feature corresponding to a historical alarm data is randomly selected from the historical alarm data set as the first K value; N-1 features corresponding to N-1 historical alarm data are selected from the historical alarm data set according to a preset rule as the second to N K values, wherein N is greater than 1; the historical alarm data set is clustered and grouped using the N K values ​​to obtain N historical alarm data subsets; for any of the N historical alarm data subsets, when the average feature of the historical alarm data subset and the corresponding K value do not meet the preset conditions, the K value in each of the historical alarm data subsets is updated, and the step of clustering and grouping the historical alarm data set is re-executed so that the average feature of the re-clustered and grouped historical alarm data subset and the corresponding K value meet the preset conditions.

[0123] In a possible implementation, when the average feature of the historical alarm data subsets and the corresponding K value meet a preset condition, the updated K value in each of the historical alarm data subsets is used as the corresponding preset feature.

[0124] In a possible implementation, the average characteristic of the historical alarm data subset after re-clustering and grouping is the same as the corresponding K value; or, the average characteristic of the historical alarm data subset after re-clustering and grouping is closest to the corresponding K value.

[0125] In a possible implementation, the features include: text data; segmenting the features, and using the Jaccard distances corresponding to the features after segmentation as the distances between the features.

[0126] In a possible implementation manner, the features include: numerical data; and the difference between the features is used as the distance between the features.

[0127] The method disclosed in the above embodiment of the present invention can be applied to the processor 501, or implemented by the processor 501. The processor 501 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 501 or the instruction in the form of software. The above processor 501 can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present invention can be directly embodied as a hardware decoding processor to execute, or the hardware and software units in the decoding processor can be executed. The software unit can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 502, and the processor 501 reads the information in the memory 502 and completes the steps of the above method in combination with its hardware.

[0128] It is understood that the embodiments described herein can be implemented by hardware, software, firmware, middleware, microcode or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPDevice, DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described in the present application or a combination thereof.

[0129] For software implementation, the technology described herein can be implemented by a unit that performs the functions described herein. The software code can be stored in a memory and executed by a processor. The memory can be implemented in the processor or outside the processor.

[0130] The alarm level determination device provided in this embodiment may be as follows Figure 4 The alarm level determination device shown in , can be executed as follows Figure 1-3 All steps of the method for determining the alarm level in Figure 1-3 For details, please refer to the technical effect of the method for determining the alarm level shown in Figure 1-3 For the sake of brevity, the relevant description is not repeated here.

[0131] The embodiment of the present invention also provides a storage medium (computer-readable storage medium). The storage medium here stores one or more programs. The storage medium may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a read-only memory, a flash memory, a hard disk or a solid-state drive; the memory may also include a combination of the above-mentioned types of memory.

[0132] When one or more programs in the storage medium can be executed by one or more processors, the alarm level determination method executed on the alarm level determination device side is implemented.

[0133] The processor is used to execute the alarm level determination program stored in the memory to implement the following steps of the alarm level determination method performed on the alarm level determination device side:

[0134] Determine the target feature corresponding to the target alarm; query the target level corresponding to the target feature from the association relationship, wherein the association relationship stores a plurality of sets of correspondences between preset features and alarm levels, and the target level is the alarm level corresponding to the preset feature that is closest to the target feature; use the target level as the alarm level of the target alarm.

[0135] In one possible implementation, a set of historical alarm data within a preset time period is obtained, each historical alarm data is provided with corresponding features and alarm levels; the historical alarm data set is clustered and grouped using a K-means clustering algorithm to obtain a plurality of historical alarm data subsets, each of which is provided with preset features; the average alarm level corresponding to each of the historical alarm data subsets is determined to obtain a plurality of average alarm levels; and the association relationship is constructed based on the plurality of average alarm levels and the corresponding plurality of preset features.

[0136] In one possible implementation, a feature corresponding to a historical alarm data is randomly selected from the historical alarm data set as the first K value; N-1 features corresponding to N-1 historical alarm data are selected from the historical alarm data set according to a preset rule as the second to N K values, wherein N is greater than 1; the historical alarm data set is clustered and grouped using the N K values ​​to obtain N historical alarm data subsets; for any of the N historical alarm data subsets, when the average feature of the historical alarm data subset and the corresponding K value do not meet the preset conditions, the K value in each of the historical alarm data subsets is updated, and the step of clustering and grouping the historical alarm data set is re-executed so that the average feature of the re-clustered and grouped historical alarm data subset and the corresponding K value meet the preset conditions.

[0137] In a possible implementation, when the average feature of the historical alarm data subsets and the corresponding K value meet a preset condition, the updated K value in each of the historical alarm data subsets is used as the corresponding preset feature.

[0138] In a possible implementation, the average characteristic of the historical alarm data subset after re-clustering and grouping is the same as the corresponding K value; or, the average characteristic of the historical alarm data subset after re-clustering and grouping is closest to the corresponding K value.

[0139] In a possible implementation, the features include: text data; segmenting the features, and using the Jaccard distances corresponding to the features after segmentation as the distances between the features.

[0140] In a possible implementation manner, the features include: numerical data; and the difference between the features is used as the distance between the features.

[0141] The professionals should further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0142] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0143] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for determining an alarm level, characterized in that: include: Determine the target characteristics corresponding to the target alarm; Querying a target level corresponding to the target feature from the association relationship, wherein the association relationship stores a plurality of sets of correspondences between preset features and alarm levels, the target level is the alarm level corresponding to the preset feature closest to the target feature, and the association relationship is determined based on the average alarm level corresponding to each subset of historical alarm data and the corresponding preset feature; Using the target level as the alarm level of the target alarm; The association relationship is constructed in the following way: Obtain a set of historical alarm data within a preset time period, each historical alarm data being provided with corresponding features and alarm levels; obtain corresponding meta information from the historical alarm data set, classify the historical alarm data set according to the alarm type in the meta information, obtain a set of historical alarm data corresponding to each alarm type, and for the set of historical alarm data corresponding to each alarm type, perform clustering and grouping processing on the historical alarm data set using a K-means clustering algorithm to obtain a plurality of historical alarm data subsets, each of which being provided with preset features; determine an average alarm level corresponding to each of the historical alarm data subsets, and obtain a plurality of average alarm levels; and construct the association relationship based on the plurality of average alarm levels and the corresponding plurality of preset features; The historical alarm data set is clustered and grouped using the K-means clustering algorithm to obtain multiple historical alarm data subsets, including: A feature corresponding to a historical alarm data is randomly selected from the historical alarm data set as the first K value; N-1 features corresponding to N-1 historical alarm data are selected from the historical alarm data set according to a preset rule as the second to N K values, wherein N is greater than 1, and the Nth K value is the feature that is farthest from the sum of the distances to the first K value, the second K value, the third K value, ... and the N-1th K value; the historical alarm data set is clustered and grouped using the N K values ​​to obtain N historical alarm data subsets; for any of the N historical alarm data subsets, when the average feature of the historical alarm data subset does not meet the preset condition with the corresponding K value, the K value in each historical alarm data subset is updated, and the step of clustering and grouping the historical alarm data set is re-executed, so that the average feature of the historical alarm data subset after re-clustering and grouping is the same as the corresponding K value, or the average feature of the historical alarm data subset after re-clustering and grouping is closest to the corresponding K value; The method further comprises: When the average feature of the historical alarm data subsets and the corresponding K value meet the preset conditions, the updated K value in each of the historical alarm data subsets is used as the corresponding preset feature.

2. The method according to claim 1, characterized in that The features include: text data; The distance between the features is calculated by: The features are segmented, and the Jaccard distances corresponding to the features after segmentation are used as the distances between the features.

3. The method according to claim 1, characterized in that The features include: numerical data; The distance between the features is calculated by: The difference between the features is taken as the distance between the features.

4. A device for determining an alarm level, characterized in that: include: A determination module, used to determine target features corresponding to the target alarm; A query module is used to query the target level corresponding to the target feature from the association relationship, wherein the association relationship stores the correspondence relationship between multiple groups of preset features and alarm levels, the target level is the alarm level corresponding to the preset feature closest to the target feature, the association relationship is determined based on the average alarm level and the corresponding preset feature corresponding to each historical alarm data subset, and the association relationship is constructed in the following manner: obtaining a historical alarm data set within a preset time period, each historical alarm data is set with a corresponding feature and an alarm level; obtaining corresponding meta information from the historical alarm data set, classifying the historical alarm data set according to the alarm type in the meta information, and obtaining a historical alarm data set corresponding to each alarm type; for the historical alarm data set corresponding to each alarm type, clustering and grouping the historical alarm data set using the K-means clustering algorithm to obtain multiple historical alarm data subsets, each of which is set with a preset feature; determining the average alarm level corresponding to each of the historical alarm data subsets to obtain multiple average alarm levels; constructing the association relationship based on the multiple average alarm levels and the corresponding multiple preset features; The method uses the K-means clustering algorithm to perform clustering and grouping processing on the historical alarm data set to obtain multiple historical alarm data subsets, including: randomly selecting a feature corresponding to a historical alarm data from the historical alarm data set as the first K value; selecting N-1 features corresponding to N-1 historical alarm data from the historical alarm data set according to a preset rule as the second to N K values, wherein N is greater than 1, and the Nth K value is the feature with the farthest sum of distances from the first K value, the second K value, the third K value, ... and the N-1th K value; using the N K values ​​to perform clustering and grouping processing on the historical alarm data set Perform clustering and grouping processing to obtain N historical alarm data subsets; for any of the N historical alarm data subsets, when the average characteristics of the historical alarm data subset and the corresponding K value do not meet the preset conditions, update the K value in each of the historical alarm data subsets, and re-execute the step of clustering and grouping the historical alarm data set, so that the average characteristics of the historical alarm data subset after re-clustering and grouping are the same as the corresponding K value, or the average characteristics of the historical alarm data subset after re-clustering and grouping are closest to the corresponding K value; The determination module is further configured to use the target level as the alarm level of the target alarm; The device also includes a module, which is used to use the updated K value in each of the historical alarm data subsets as the corresponding preset feature when the average feature of the historical alarm data subsets and the corresponding K value meet the preset conditions.

5. A computer device, characterized in that: include: A processor and a memory, wherein the processor is used to execute an alarm level determination program stored in the memory to implement the alarm level determination method according to any one of claims 1 to 3.

6. A storage medium, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method for determining the alarm level according to any one of claims 1 to 3.

Images