Alarm aggregation method, device, equipment and storage medium

Abstract

The present application provides an alarm aggregation method, device, equipment and storage medium. The method includes: for each alarm event, intercepting the alarm timing subgraph in each alarm accompanying time period where the alarm event is located from the formed alarm timing landscape, the alarm timing landscape is formed by the time sequence distribution of each of the alarm events; for each alarm event, determining the alarm correlation relationship under the alarm event according to the accompanying alarm hotspot after the alarm timing subgraphs in each of the alarm accompanying time periods where the alarm event is located are superimposed; according to the alarm correlation relationship under each alarm event, performing alarm aggregation on each of the alarm events. The present application determines the alarm correlation relationship under each alarm event from the perspective of global accompanying alarms, realizes comprehensive detection of alarm correlation relationships, ensures the comprehensiveness of alarm event aggregation, further reduces the number of alarms in the business system, and avoids the generation of alarm storms.

Description

Technical Field

[0001] The embodiments of the present application relate to the technical field of alarm processing, and specifically to an alarm aggregation method, apparatus, device, and storage medium. Background Art

[0002] With the rapid development of internet technology, the scale and complexity of various business systems have gradually increased, leading to increasingly stringent requirements for detecting alarm events within these systems. To comprehensively detect alarm events within business systems, multiple alarm detection conditions are typically defined to detect the presence of alarm events from multiple dimensions. However, a single anomaly within a business system may trigger the generation of alarm events across multiple dimensions, creating an alarm storm and rendering the alarm events ineffective. Therefore, to avoid alarm storms within business systems, it is necessary to aggregate multiple alarm events caused by a single anomaly to reduce the number of alarms within the business system.

[0003] At present, various probability-based causal reasoning models or pattern recognition algorithms are usually used to analyze the correlation between each two alarm events in the business system. Then, based on the binary correlation between each two alarm events, the multivariate correlation between global alarm events is uniformly analyzed, and then the alarm events are aggregated according to the global multivariate correlation.

[0004] However, the actual multi-dimensional relationships between multiple alarm events within a business system cannot all be constructed from multiple binary relationships. For example, alarm event E represents "primary service unavailable," alarm event C represents "replica service unavailable," and alarm event D represents "business service offline." E and C can jointly deduce D, indicating a ternary relationship between E, C, and D. However, D cannot be derived from E or C alone, indicating that there is no binary relationship between E and D or between C and D. Therefore, the existing method cannot construct a ternary relationship between E, C, and D. Furthermore, the phenomenon that the actual multi-dimensional relationships between alarm events in a business system cannot be constructed from the corresponding binary relationships is common. Therefore, the existing aggregated alarm cannot achieve comprehensive aggregation of alarm events within the business system, and the problem of excessive alarm counts still exists. Summary of the Invention

[0005] The present application provides an alarm aggregation method, apparatus, device and storage medium, which analyzes the alarm correlation relationship under each alarm event from the perspective of global accompanying alarms, ensures the comprehensiveness of the alarm correlation relationship, realizes the comprehensive aggregation of alarm events, and thus greatly reduces the number of alarms in the business system and avoids the occurrence of alarm storms.

[0006] In a first aspect, an embodiment of the present application provides an alarm aggregation method, the method comprising:

[0007] For each alarm event, extract an alarm time sequence subgraph within each alarm accompanying period of the alarm event from the formed alarm time sequence graph, wherein the alarm time sequence graph is formed by the time sequence distribution of each alarm event;

[0008] For each alarm event, determine the alarm association relationship under the alarm event according to the accompanying alarm hotspots after superimposing the alarm time sequence subgraphs in each of the alarm accompanying time periods in which the alarm event is located;

[0009] According to the alarm association relationship under each alarm event, alarm aggregation is performed on the alarm events.

[0010] Furthermore, for each alarm event, determining the alarm association relationship under the alarm event according to the accompanying alarm hotspots obtained by superimposing the alarm time sequence subgraphs within the alarm accompanying time period in which the alarm event is located includes:

[0011] For each alarm event, superimpose the alarm time sequence subgraphs in each of the alarm accompanying time periods in which the alarm event is located to determine the frequency of accompanying alarms that occur with each alarm event;

[0012] According to the frequency of accompanying alarms that occur with each alarm event, the alarm correlation between each alarm event and the alarm event is calculated to determine the accompanying alarm hotspots under the alarm event;

[0013] Between the directed alarm events accompanying the alarm hotspots, an alarm association relationship under the alarm event is generated.

[0014] Furthermore, the superimposing of the alarm time sequence subgraphs in each of the alarm accompanying time periods in which the alarm event is located to determine the frequency of accompanying alarms that occur with each alarm event includes:

[0015] The frequency of accompanying alarms that occur with each alarm event is determined based on the cumulative number of occurrences of each alarm event after the alarm time sequence subgraphs are superimposed.

[0016] Furthermore, the calculation of the alarm correlation between each alarm event and the alarm event according to the frequency of accompanying alarms that occur with each alarm event includes:

[0017] Calculate the time series concentration of each alarm event accompanying the alarm event according to the time series distribution distance between each alarm event and the alarm event in each of the alarm time series subgraphs;

[0018] Based on the frequency and time series concentration of the accompanying alarms that occur with each alarm event, the alarm correlation between each alarm event and the alarm event is calculated.

[0019] Furthermore, determining the accompanying alarm hotspots under the alarm event includes:

[0020] According to the alarm correlation between each alarm event and the alarm event, the corresponding outlier alarm event is filtered out;

[0021] The remaining alarm events except the outlier alarm event are combined to obtain the accompanying alarm hotspots under the alarm event.

[0022] Furthermore, for each alarm event, the alarm sequence subgraph within each alarm accompanying period of the alarm event is intercepted from the formed alarm sequence graph, including:

[0023] For each alarm event, taking each alarm time point where the alarm event is located in the alarm timing diagram as the starting point, the alarm timing diagram is intercepted according to the preset alarm accompaniment duration to obtain the alarm timing sub-diagram within each alarm accompaniment period where the alarm event is located.

[0024] Furthermore, the alarm aggregation of each alarm event according to the alarm association relationship under each alarm event includes:

[0025] Merge and remove duplicate alarm associations under each alarm event to obtain an alarm association set;

[0026] Alarm aggregation is performed on alarm events that meet any alarm association relationship in the alarm association set.

[0027] Furthermore, before extracting, for each alarm event, the alarm sequence subgraph within each alarm accompanying period in which the alarm event is located from the formed alarm sequence graph, the method further includes:

[0028] The alarm time sequence picture is formed according to the alarm distribution of each alarm event changing with time.

[0029] In a second aspect, an embodiment of the present application provides an alarm aggregation device, the device comprising:

[0030] An alarm subgraph interception module is used to intercept, for each alarm event, an alarm time sequence subgraph within each alarm accompanying period of the alarm event from the formed alarm time sequence landscape, wherein the alarm time sequence landscape is formed by the time sequence distribution of each of the alarm events;

[0031] A correlation relationship determination module is used to determine, for each alarm event, the alarm correlation relationship under the alarm event based on the accompanying alarm hotspots obtained by superimposing the alarm time sequence subgraphs within the alarm accompanying time period in which the alarm event is located;

[0032] The alarm aggregation module is used to aggregate the alarm events according to the alarm association relationship under each alarm event.

[0033] In a third aspect, an embodiment of the present application provides an electronic device, the electronic device comprising:

[0034] A processor and a memory, the memory being used to store a computer program, and the processor being used to call and run the computer program stored in the memory to execute the alarm aggregation method provided in the first aspect of the present application.

[0035] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program enables a computer to execute the alarm aggregation method provided in the first aspect of the present application.

[0036] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program / instruction, characterized in that when the computer program / instruction is executed by a processor, it implements the alarm aggregation method provided in the first aspect of the present application.

[0037] An alarm aggregation method, apparatus, device and storage medium provided in an embodiment of the present application form an alarm time sequence picture in advance by distributing each alarm event in time sequence, and then for each alarm event, respectively intercept the alarm time sequence subgraphs in each alarm accompanying time period in which the alarm event is located from the alarm time sequence picture, and then analyze the accompanying alarm hot spots after the superposition of each alarm time sequence subgraph, so as to determine the alarm correlation relationship under the alarm event from the perspective of global accompanying alarm. The alarm correlation relationship under each alarm event can be obtained in the above manner, thereby realizing comprehensive detection of the alarm correlation relationship, ensuring the comprehensiveness of alarm event aggregation, further reducing the number of alarms in the business system, and avoiding the generation of alarm storms. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0039] Figure 1 This is a flow chart of an alarm aggregation method shown in an embodiment of the present application;

[0040] Figure 2 A schematic diagram of an alarm timing diagram according to an embodiment of the present application;

[0041] Figure 3 This is a schematic diagram showing the principle of intercepting and superimposing alarm timing subgraphs according to an embodiment of the present application;

[0042] Figure 4 This is a flow chart of another alarm aggregation method shown in an embodiment of the present application;

[0043] Figure 5 This is a principle block diagram of an alarm aggregation device shown in an embodiment of the present application;

[0044] Figure 6 It is a schematic block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0045] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0046] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way are interchangeable where appropriate so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0047] Taking into account the problem that by analyzing the binary correlation between each two alarm events in the business system, it is impossible to fully construct the actual multi-correlation between the alarm events in the business system, which leads to the inability to achieve comprehensive aggregation of alarm events, the embodiment of the present application designs a method to explore the various alarm correlations that actually exist between the alarm events in the business system from the perspective of global accompanying alarms. By superimposing the accompanying alarm hotspots after the alarm time series subgraphs in each alarm accompanying period of each alarm event are used, the alarm correlation under each alarm event is analyzed from a holistic perspective, thereby achieving comprehensive detection of the multi-correlation between the alarm events in the business system, ensuring the comprehensiveness of the aggregation of alarm events, and avoiding the generation of alarm storms in the business system.

[0048] Figure 1 This is a flow chart of an alarm aggregation method shown in an embodiment of the present application. Figure 1 , the method may specifically include the following steps:

[0049] S110 , for each alarm event, extracting an alarm sequence subgraph within each alarm accompanying period where the alarm event is located from the formed alarm sequence graph.

[0050] Specifically, any alarm event within a business system may trigger multiple alarms at different time points. Therefore, to comprehensively analyze the actual multi-dimensional relationships between alarm events within the business system, it is first necessary to analyze the time points at which each alarm event is triggered within the business system. This will determine the temporal distribution of each alarm event and, subsequently, whether there is any correlation between the alarm events in this temporal distribution.

[0051] As an optional implementation scheme in the embodiment of the present application, in order to intuitively and completely describe the time series distribution of each alarm event in the business system, in the present application, an alarm time series diagram can be formed by the time series distribution of each alarm event.

[0052] For example, the formation process of the alarm sequence diagram can be mainly based on the alarm distribution of each alarm event over time. That is to say, for each alarm event, first the time point at which the alarm event triggers each alarm in the business system, and then the alarm distribution of the alarm event over time is analyzed. According to the above steps, the alarm distribution of each alarm event over time can be determined. Then, Figure 2 As shown, with the time series change as the horizontal axis and each alarm event as the vertical axis, the corresponding distributed alarm events are plotted at different time points to obtain the alarm time series view.

[0053] It should be understood that the various alarm events in the currently formed alarm time series are independently distributed over time, and it is impossible to intuitively describe the correlation between the various alarm events. However, for other alarm events that have a certain correlation with a certain alarm event, each time the alarm event initiates an alarm, other alarm events will in most cases also initiate corresponding alarms along with the alarm event, while other alarm events that do not have any correlation with the alarm event will not initiate alarms along with the alarm event. From this, it can be seen that each time any alarm event initiates an alarm, by analyzing whether each other alarm event also initiates a corresponding alarm each time along with the alarm event, the alarm frequency of each other alarm event accompanying the alarm event can be determined, thereby obtaining other alarm events that have a correlation with the alarm event.

[0054] In this application, in order to intuitively analyze whether each other alarm event also initiates a corresponding alarm each time an alarm event initiates an alarm, first, for each alarm event, the current alarm accompanying time period will be set each time the alarm event initiates an alarm. Then, the image segments within each alarm accompanying time period in which the alarm event is located can be respectively cut out from the formed alarm sequence image, and the alarm sequence subgraph within each alarm accompanying time period in which the alarm event is located can be obtained. Among them, each alarm sequence subgraph can intuitively describe the other alarm events that also initiate corresponding alarms within the current alarm accompanying time period after the alarm event initiates the alarm this time. Subsequently, by superimposing the various alarm sequence subgraphs of the alarm event, the alarm frequency of other alarm events that also initiate corresponding alarms within each alarm accompanying time period accompanying the alarm event is analyzed, and it can be determined whether each other alarm event initiates a corresponding alarm along with the alarm event, or initiates an alarm randomly.

[0055] As an optional implementation scheme in the embodiment of the present application, since the alarm timing subgraph within each alarm accompanying time period in which the alarm event is located is mainly used to analyze the alarm frequency of each other alarm event accompanying the alarm event after each alarm is initiated by the alarm event, for each alarm event, the alarm accompanying time period set each time the alarm event is initiated can be a time period starting from each alarm time point in the alarm timing graph where the alarm event is located and a preset alarm accompanying duration, wherein the alarm accompanying duration is an empirical value set by analyzing the alarm frequency of each alarm event in the business system.

[0056] At this time, for each alarm event, the interception of the alarm sequence subgraph in each alarm accompanying period of the alarm event can be mainly based on each alarm time point of the alarm event in the alarm sequence scene as the starting point, and the alarm sequence scene is intercepted according to the preset alarm accompanying duration to obtain the alarm sequence subgraph in each alarm accompanying period of the alarm event. In other words, Figure 3 As shown, taking each alarm time point where the alarm event is located in the alarm timing graph as the starting point, the various alarm accompanying time periods where the alarm event is located are determined according to the preset alarm accompanying duration, and then the picture segments of the alarm event in each alarm accompanying time period are respectively cut out from the alarm timing graph to obtain the alarm timing subgraph in each alarm accompanying time period where the alarm event is located.

[0057] S120 , for each alarm event, determine the alarm association relationship under the alarm event according to the accompanying alarm hot spots formed by superimposing the alarm time sequence subgraphs in each alarm accompanying period in which the alarm event is located.

[0058] Specifically, for each alarm event, after extracting the alarm timing subgraph within each alarm accompanying time period in which the alarm event is located, since each alarm timing subgraph contains other alarm events that also initiate corresponding alarms at different time points within the current alarm accompanying time period after the alarm event is initiated this time, it is impossible to determine whether the other alarm events are alarms initiated along with the alarm event or alarms initiated randomly.

[0059] Therefore, in order to accurately determine whether the other alarm events in each alarm sequence subgraph are alarms initiated along with the alarm event or alarms initiated randomly, this application will superimpose the alarm sequence subgraphs of each alarm accompanying period in which the alarm event is located for each alarm event, such as Figure 3 As shown, by accumulating the number of alarm events at the same relative alarm time point within each alarm sequence subgraph, and analyzing the alarm frequency associated with each alarm event within each alarm sequence subgraph, an accompanying alarm hotspot is obtained after the alarm sequence subgraphs are superimposed. This accompanying alarm hotspot consists of the alarm event and other alarm events with higher alarm frequencies. At this point, the other alarm events represented by the accompanying alarm hotspot can be regarded as the alarm events that initiate the corresponding alarm associated with the alarm event, and have a certain alarm association relationship with the alarm event, thereby determining the alarm association relationship under the alarm event.

[0060] It should be noted that for each alarm event, by executing the same steps of S110 and S120 above, the alarm correlation relationship under each alarm event can be obtained, thereby comprehensively analyzing the alarm correlation relationship between various alarm events in the business system from the perspective of global accompanying alarms, and realizing comprehensive correlation detection between alarm events.

[0061] S130: Aggregate alarms for each alarm event according to the alarm association relationship under each alarm event.

[0062] When the alarm correlation relationship under each alarm event is obtained, the alarm correlation relationships under each alarm event will be unified and merged to construct a multi-correlation relationship representing the global whole between each alarm event in the business system. Then, the multi-correlation relationship representing the global whole is used to aggregate the alarms of each alarm event in the business system, so that only one alarm operation is performed after the aggregation of multiple alarm events, thereby ensuring the comprehensiveness of the aggregation of alarm events, further reducing the number of alarms in the business system, and avoiding the occurrence of alarm storms.

[0063] For example, considering that there may be alarm associations between various alarm events, the alarm association relationships under each alarm event will be repeated. Therefore, for the alarm aggregation of alarm events, the alarm association relationships under each alarm event can be merged and deduplicated to obtain an alarm association set; and alarm aggregation is performed on alarm events that meet any alarm association relationship in the alarm association set. In other words, the merged and deduplicated alarm association set is used as a multi-dimensional association relationship representing the global whole in the business system. By analyzing whether the execution sequence between the various alarm events in the business system meets any alarm association relationship in the alarm association set, if so, the multiple alarm events are aggregated and an alarm operation is performed.

[0064] The technical solution provided by the embodiment of the present application is to form an alarm time sequence landscape in advance by distributing each alarm event in time sequence, and then for each alarm event, respectively intercept the alarm time sequence subgraphs in each alarm accompanying time period in which the alarm event is located from the alarm time sequence landscape, and then analyze the accompanying alarm hotspots after the superposition of each alarm time sequence subgraph, so as to determine the alarm correlation relationship under the alarm event from the perspective of global accompanying alarm. The alarm correlation relationship under each alarm event can be obtained in the above manner, thereby realizing comprehensive detection of the alarm correlation relationship, ensuring the comprehensiveness of alarm event aggregation, further reducing the number of alarms in the business system, and avoiding the generation of alarm storms.

[0065] As an optional implementation scheme in the embodiment of the present application, the present application will take an alarm event among the alarm events in the business system as an example to exemplarily describe in detail the specific steps of determining the alarm association relationship under each alarm event.

[0066] Figure 4 This is a flow chart of another alarm aggregation method shown in an embodiment of the present application. Figure 4 As shown, the method may specifically include the following steps:

[0067] S410 , for each alarm event, extract an alarm sequence subgraph within each alarm accompanying period of the alarm event from the formed alarm sequence graph, wherein the alarm sequence graph is formed by the alarm events distributed in time sequence.

[0068] S420 , for each alarm event, superimpose the alarm time sequence subgraphs in each alarm accompanying time period in which the alarm event is located, to determine the frequency of accompanying alarms that occur with each alarm event.

[0069] Optionally, for each alarm event in the business system, considering that in the alarm timing subgraph of each alarm accompanying period in which the alarm event is located, there will be various other alarm events that initiate alarms within the alarm accompanying period, it is necessary to analyze the correlation between each other alarm event and the alarm event by judging whether the other alarm events within each alarm accompanying period are alarms initiated along with the alarm event or alarms initiated randomly.

[0070] Specifically, considering that for other alarm events with a higher correlation with the alarm event, when the alarm event initiates an alarm, the other alarm events will also initiate an alarm along with the alarm event in many cases, and the alarm sequence subgraphs of each alarm accompanying time period in which the alarm event is located can represent the alarm conditions of each other alarm event after the alarm event initiates an alarm. Therefore, by superimposing the alarm sequence subgraphs of each alarm accompanying time period in which the alarm event is located, the present application can analyze the alarm conditions of each other alarm event in each alarm time interval after the alarm event initiates an alarm, thereby obtaining the frequency of accompanying alarms for each alarm event accompanying the alarm event.

[0071] It should be understood that when superimposing the alarm sequence subgraphs within each alarm accompanying period in which the alarm event occurs, the alarm counts for the alarm events present at each alarm interval time point after the alarm event is initiated within each alarm sequence subgraph are superimposed. This allows the calculation of the cumulative number of occurrences of each alarm event after the superposition of the alarm sequence subgraphs. Furthermore, based on the cumulative number of occurrences of each alarm event after the superposition of the alarm sequence subgraphs, the frequency of accompanying alarms associated with each alarm event is determined.

[0072] Since each alarm sequence subgraph is captured starting from the alarm time point when the alarm event initiates an alarm each time, the cumulative number of occurrences of the alarm event is the total number of each alarm sequence subgraph in which the alarm event is located.

[0073] For example, using {X1, X2, ..., X n} represents each alarm event in the business system, for each alarm event X i , the alarm event X i The alarm sequence subgraph in each alarm accompanying period is represented as W j =[x j1 , x j2 , x j3 ,…,x jn ], where x j1 , x j2 , x j3 ,…,x jnRepresents each alarm event X1, X2, ..., X n In the alarm sequence subgraph W j The alarm time point and the alarm event X i In the alarm sequence subgraph W j The time interval between the alarm time points within the range.

[0074] Among them, the alarm event X i In the alarm sequence subgraph W j The alarm time point in the alarm sequence subgraph W j Moreover, considering that there may be an alarm event in the alarm event X i Alarm sequence subgraph W j If the alarm does not occur within the alarm timing subgraph W j =[x j1 , x j2 , x j3 ,…,x jn ] can be marked with a specific space or "-1" in the alarm sequence sub-diagram W j The alarm event does not exist in the alarm event X i Alternatively, there may be an alarm event in the alarm timing subgraph W j If multiple alarms occur at different time intervals within the alarm sequence subgraph W j =[x j1 , x j2 , x j3 ,…,x jn ] can be used with the alarm event X i It is expressed as the latest alarm time interval.

[0075] Therefore, the alarm event X can be obtained i Each alarm sequence subgraph {W1, W2, ..., W j ,…}, in order to describe each alarm event and the alarm event X i The accompanying and sequential alarm relationship between them, this application can be used to separate the alarm sequential subgraphs {W1, W2, ..., W j , ...} are transposed and merged to obtain the alarm event X i The historical event matrix The historical event matrix M ji Each row in the table represents each alarm event {X1, X2, ..., X n}In the alarm event X i The time interval in each alarm timing subgraph.

[0076] At this time, use Counti [j]=M j [X i ] to calculate the number of non-empty elements of the alarm events represented by each row, and use this as the cumulative number of occurrences of each alarm event after superimposing each alarm time series subgraph. Then, the frequency of accompanying alarms of each alarm event can be analyzed.

[0077] S430 , calculating the alarm correlation between each alarm event and the alarm event according to the frequency of the accompanying alarms that occur with the alarm event, so as to determine the accompanying alarm hotspots under the alarm event.

[0078] After calculating the frequency of accompanying alarms for each alarm event, we can use this frequency to analyze whether each alarm event occurred after the alarm was triggered or occurred randomly. We can then use the ratio of the frequency of accompanying alarms for each alarm event to the total number of alarm time series subgraphs for that alarm event to calculate the alarm correlation between each alarm event and the alarm event. For example, the higher the frequency of accompanying alarms for a particular alarm event, the higher the alarm correlation between the two events.

[0079] For example, considering that the time intervals between each alarm event and the alarm event initiating an alarm in the same alarm timing subgraph are also different, the higher the correlation between a certain alarm event and the alarm event, the closer the time intervals between the alarms in the same alarm timing subgraph are. Therefore, in order to ensure the accuracy of the alarm correlation between each alarm event, the present application calculates the alarm correlation between each alarm event and the alarm event according to the frequency of the accompanying alarm that accompanies each alarm event. This can be mainly divided into calculating the time concentration of each alarm event accompanying the alarm event according to the time distribution distance between each alarm event and the alarm event in each alarm timing subgraph; and calculating the alarm correlation between each alarm event and the alarm event based on the frequency and time concentration of the accompanying alarm that accompanies each alarm event.

[0080] The temporal distribution distance between each alarm event and the alarm event in each alarm timing subgraph is the time interval between the alarm time point of each alarm event in each alarm timing subgraph and the alarm time point of the alarm event. Furthermore, the temporal distribution distance between the same alarm event and the alarm event in different alarm timing subgraphs varies. Therefore, to accurately analyze the impact of each alarm event on the association with the alarm event, we first need to determine the average temporal distribution distance between each alarm event and the alarm event based on the temporal distribution distance between each alarm event and the alarm event in each alarm timing subgraph. This serves as the temporal concentration of each alarm event with the alarm event.

[0081] Exemplarily, the standard interquartile range method can be used in this application to calculate the time series concentration of each alarm event accompanying the alarm event. For each other alarm event, by sorting the time series distribution distances of the other alarm events in each alarm time series subgraph, and then determining the time series distribution distances of the other alarm events under the first quartile and the third quartile respectively, the interquartile range of the other alarm event is calculated as the time series concentration of the other alarm events accompanying the alarm event. Among them, the standard interquartile range used is publicized as follows:

[0082] Norm-IOR i [j]=(M j [X i ].getPercentile(75)-M j [X i ].getPercentile(25))*0.7413.

[0083] Among them, Norm-IOR i [j] represents each alarm event {X1, X2, ..., X n}Accompanying the alarm event X i The temporal concentration of occurrence, M j [X i ].getPercentile(75) represents each alarm event {X1, X2, ..., X n Time series distribution distance under the third quartile, M j [X i ].getPercentile(25) represents each alarm event {X1, X2, ..., X n}Time series distribution distance under the first quartile.

[0084] Then, after calculating the temporal concentration of each alarm event accompanying the alarm event, since the closer the temporal distribution distance between each alarm event and the alarm event, the higher the correlation between the two, and the higher the frequency of the accompanying alarms that each alarm event accompanies the alarm event, the higher the correlation between the two. Therefore, the alarm correlation between each alarm event and the alarm event can be uniformly calculated by using the positive impact of the accompanying alarm frequency of each alarm event accompanying the alarm event on the alarm correlation and the negative impact of the temporal concentration of each alarm event accompanying the alarm event on the alarm correlation. In this way, the alarm correlation between each alarm event and the alarm event can be further analyzed by additionally referring to the temporal distribution distance between each alarm event and the alarm event, thereby ensuring the accuracy of the alarm correlation between each alarm event.

[0085] For example, the calculation formula for the alarm correlation between each alarm event and the alarm event may be:

[0086] In addition, after calculating the alarm correlation between each alarm event and the alarm event, in order to determine the accompanying alarm hotspots under the alarm event, the corresponding outlier alarm events can be screened out according to the alarm correlation between each alarm event and the alarm event; the remaining alarm events except the outlier alarm events are combined to obtain the accompanying alarm hotspots under the alarm event.

[0087] That is to say, according to the alarm correlation between each alarm event and the alarm event, the alarm events can be sorted, and then other alarm events with an alarm correlation lower than a preset threshold are screened out as the outlier alarm events in this application. At this time, the remaining alarm events except the outlier alarm event can be considered to have a corresponding correlation relationship with the alarm event. By combining the remaining alarm events except the outlier alarm event, the accompanying alarm hotspots under the alarm event can be obtained.

[0088] For example, the present application may adopt a density-based local outlier factor (LOF) algorithm to calculate the coefficient of the alarm event. i [j] is processed to filter out Coefficient i The outliers in [j] are regarded as outlier alarm events in this application.

[0089] S440: Generate an alarm association relationship between the alarm events pointed to by the alarm hotspots.

[0090] The accompanying alarm hotspot in this application is obtained by combining the remaining alarm events except the outlier alarm event, indicating that there is a corresponding correlation between the alarm events pointed to in the accompanying alarm hotspot. Therefore, according to the alarm timing distribution relationship between the alarm events pointed to in the accompanying alarm hotspot and the alarm event, the alarm correlation relationship under the alarm event can be generated.

[0091] S450: Aggregate alarms for each alarm event according to the alarm association relationship under each alarm event.

[0092] The technical solution provided by the embodiment of the present application is to form an alarm time sequence picture in advance by distributing each alarm event in time sequence, and then for each alarm event, respectively intercept the alarm time sequence subgraph in each alarm accompanying time period in which the alarm event is located from the alarm time sequence picture, and then comprehensively analyze the alarm correlation between each alarm event and the alarm event from two aspects: the frequency of accompanying alarms accompanying the alarm event and the time sequence concentration, so as to ensure the accuracy of the alarm correlation, thereby determining the accompanying alarm hotspots under the alarm event, and thereby determining the alarm correlation relationship under the alarm event from the perspective of global accompanying alarms. The alarm correlation relationship under each alarm event can be obtained in the above manner, thereby realizing comprehensive detection of the alarm correlation relationship, ensuring the comprehensiveness of alarm event aggregation, further reducing the number of alarms in the business system, and avoiding the generation of alarm storms.

[0093] Figure 5 This is a principle block diagram of an alarm aggregation device shown in an embodiment of the present application. Figure 5 As shown, the apparatus 500 may include:

[0094] An alarm subgraph interception module 510 is configured to intercept, for each alarm event, an alarm time sequence subgraph within each alarm accompanying period of the alarm event from the formed alarm time sequence landscape, wherein the alarm time sequence landscape is formed by the time sequence distribution of the alarm events;

[0095] The correlation relationship determination module 520 is configured to determine, for each alarm event, the alarm correlation relationship of the alarm event based on the accompanying alarm hotspots obtained by superimposing the alarm time sequence subgraphs within the alarm accompanying time period in which the alarm event is located;

[0096] The alarm aggregation module 530 is configured to aggregate the alarm events according to the alarm association relationship under each alarm event.

[0097] Furthermore, the association relationship determination module 520 may specifically include:

[0098] An alarm frequency determination unit is configured to, for each alarm event, superimpose the alarm time sequence subgraphs within each of the alarm accompanying time periods in which the alarm event is located, so as to determine the accompanying alarm frequency of each alarm event accompanying the alarm event;

[0099] An alarm hotspot determining unit is configured to calculate the alarm correlation between each alarm event and the alarm event according to the frequency of accompanying alarms that occur with each alarm event, so as to determine the accompanying alarm hotspot under the alarm event;

[0100] The association relationship generating unit is used to generate an alarm association relationship under the alarm event between the alarm events pointed to by the accompanying alarm hotspots.

[0101] Furthermore, the alarm frequency determination unit may be specifically configured to:

[0102] The frequency of accompanying alarms that occur with each alarm event is determined based on the cumulative number of occurrences of each alarm event after the alarm time sequence subgraphs are superimposed.

[0103] Furthermore, the alarm hotspot determination unit may be specifically configured to:

[0104] Calculate the time series concentration of each alarm event accompanying the alarm event according to the time series distribution distance between each alarm event and the alarm event in each of the alarm time series subgraphs;

[0105] Based on the frequency and time series concentration of the accompanying alarms that occur with each alarm event, the alarm correlation between each alarm event and the alarm event is calculated.

[0106] Furthermore, the alarm hotspot determining unit may be specifically configured to:

[0107] According to the alarm correlation between each alarm event and the alarm event, the corresponding outlier alarm event is filtered out;

[0108] The remaining alarm events except the outlier alarm event are combined to obtain the accompanying alarm hotspots under the alarm event.

[0109] Furthermore, the alarm sub-graph interception module 510 may be specifically configured to:

[0110] For each alarm event, taking each alarm time point where the alarm event is located in the alarm timing diagram as the starting point, the alarm timing diagram is intercepted according to the preset alarm accompaniment duration to obtain the alarm timing sub-diagram within each alarm accompaniment period where the alarm event is located.

[0111] Furthermore, the alarm aggregation module 530 may be specifically configured to:

[0112] Merge and remove duplicate alarm associations under each alarm event to obtain an alarm association set;

[0113] Alarm aggregation is performed on alarm events that meet any alarm association relationship in the alarm association set.

[0114] Furthermore, the alarm aggregation device 500 may further include:

[0115] The time sequence picture forming module is used to form the alarm time sequence picture according to the alarm distribution of each alarm event changing with time.

[0116] In an embodiment of the present application, an alarm timing landscape is formed in advance by the time series distribution of each alarm event, and then for each alarm event, the alarm timing subgraphs in each alarm accompanying time period in which the alarm event is located are respectively intercepted from the alarm timing landscape, and then the accompanying alarm hotspots after the superposition of each alarm timing subgraph are analyzed, so as to determine the alarm correlation relationship under the alarm event from the perspective of the global accompanying alarm. The alarm correlation relationship under each alarm event can be obtained in the above manner, thereby realizing comprehensive detection of the alarm correlation relationship, ensuring the comprehensiveness of the alarm event aggregation, further reducing the number of alarms in the business system, and avoiding the generation of alarm storms.

[0117] It should be understood that the device embodiment and the method embodiment may correspond to each other, and similar descriptions may refer to the method embodiment. To avoid repetition, they will not be described here. Specifically, Figure 5 The device 500 shown can execute any method embodiment provided in the present application, and the aforementioned and other operations and / or functions of each module in the device 500 are respectively for implementing the corresponding processes in each method of the embodiment of the present application. For the sake of brevity, they will not be repeated here.

[0118] The above describes the device 500 of the embodiment of the present application from the perspective of functional modules in conjunction with the accompanying drawings. It should be understood that the functional module can be implemented in hardware form, can be implemented by instructions in software form, and can also be implemented by a combination of hardware and software modules. Specifically, the steps of the method embodiment in the embodiment of the present application can be completed by the hardware integrated logic circuit and / or software form instructions in the processor, and the steps of the method disclosed in the embodiment of the present application can be directly embodied as being executed by a hardware decoding processor, or can be executed by a combination of hardware and software modules in the decoding processor. Optionally, the software module can be located in a mature storage medium in the art such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps in the above method embodiment in conjunction with its hardware.

[0119] Figure 6 It is a schematic block diagram of an electronic device 600 provided in an embodiment of the present application.

[0120] like Figure 6 As shown, the electronic device 600 may include:

[0121] The memory 610 and the processor 620 are configured to store computer programs and transmit the program code to the processor 620. In other words, the processor 620 can call and run the computer program from the memory 610 to implement the method in the embodiment of the present application.

[0122] For example, the processor 620 may be configured to execute the above method embodiments according to instructions in the computer program.

[0123] In some embodiments of the present application, the processor 620 may include but is not limited to:

[0124] General-purpose processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, etc.

[0125] In some embodiments of the present application, the memory 610 includes but is not limited to:

[0126] Volatile memory and / or non-volatile memory. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus random access memory (DR RAM).

[0127] In some embodiments of the present application, the computer program may be divided into one or more modules, which are stored in the memory 610 and executed by the processor 620 to implement the method provided by the present application. The one or more modules may be a series of computer program instruction segments capable of implementing specific functions, and the instruction segments are used to describe the execution process of the computer program in the electronic device.

[0128] like Figure 6 As shown, the electronic device may further include:

[0129] The transceiver 630 may be connected to the processor 620 or the memory 610 .

[0130] The processor 620 may control the transceiver 630 to communicate with other devices. Specifically, the processor 620 may send information or data to other devices or receive information or data sent by other devices. The transceiver 630 may include a transmitter and a receiver. The transceiver 630 may further include one or more antennas.

[0131] It should be understood that the various components in the electronic device are connected via a bus system, wherein the bus system includes not only a data bus but also a power bus, a control bus and a status signal bus.

[0132] The present application also provides a computer storage medium having a computer program stored thereon, which, when executed by a computer, enables the computer to perform the method of the above-mentioned method embodiment. In other words, the present application also provides a computer program product containing instructions, which, when executed by a computer, enables the computer to perform the method of the above-mentioned method embodiment.

[0133] When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a digital video disc (DVD)), or a semiconductor medium (e.g., a solid state drive (SSD)).

[0134] Those skilled in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0135] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the modules is merely a logical function division. In actual implementation, there may be other division methods, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0136] Modules described as separate components may or may not be physically separate, and components displayed as modules may or may not be physical modules, i.e., they may be located in one place or distributed across multiple network elements. Some or all of the modules may be selected based on actual needs to achieve the purpose of the present embodiment. For example, the functional modules in the various embodiments of the present application may be integrated into a processing module, or each module may exist physically separately, or two or more modules may be integrated into a single module.

[0137] The above are only specific embodiments of the present application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. An alarm aggregation method, characterized in that: include: For each alarm event, extract an alarm time sequence subgraph within each alarm accompanying period of the alarm event from the formed alarm time sequence graph, wherein the alarm time sequence graph is formed by the time sequence distribution of each alarm event; For each alarm event, determine the alarm association relationship under the alarm event according to the accompanying alarm hotspots after superimposing the alarm time sequence subgraphs in each of the alarm accompanying time periods in which the alarm event is located; According to the alarm correlation relationship under each alarm event, alarm aggregation is performed on each alarm event; The step of determining the alarm association relationship for each alarm event based on the accompanying alarm hotspots obtained by superimposing the alarm time sequence subgraphs within the alarm accompanying time period in which the alarm event is located includes: For each alarm event, superimpose the alarm time sequence subgraphs in each of the alarm accompanying time periods in which the alarm event is located to determine the frequency of accompanying alarms that occur with each alarm event; According to the frequency of accompanying alarms that occur with each alarm event, the alarm correlation between each alarm event and the alarm event is calculated to determine the accompanying alarm hotspots under the alarm event; Between the alarm events pointed to by the accompanying alarm hotspots, an alarm association relationship under the alarm event is generated.

2. The method according to claim 1, characterized in that The superimposing of the alarm time sequence subgraphs in each of the alarm accompanying time periods in which the alarm event is located to determine the frequency of accompanying alarms that occur with each alarm event includes: The frequency of accompanying alarms that occur with each alarm event is determined based on the cumulative number of occurrences of each alarm event after the alarm time sequence subgraphs are superimposed.

3. The method according to claim 1, characterized in that Calculating the alarm correlation between each alarm event and the alarm event according to the frequency of accompanying alarms that occur with each alarm event includes: Calculate the time series concentration of each alarm event accompanying the alarm event according to the time series distribution distance between each alarm event and the alarm event in each of the alarm time series subgraphs; Based on the frequency and time series concentration of the accompanying alarms that occur with each alarm event, the alarm correlation between each alarm event and the alarm event is calculated.

4. The method according to claim 1, wherein Determining the accompanying alarm hotspots under the alarm event includes: According to the alarm correlation between each alarm event and the alarm event, the corresponding outlier alarm event is filtered out; The remaining alarm events except the outlier alarm event are combined to obtain the accompanying alarm hotspots under the alarm event.

5. The method according to claim 1, wherein For each alarm event, the alarm sequence subgraph within each alarm accompanying period of the alarm event is intercepted from the formed alarm sequence graph, including: For each alarm event, taking each alarm time point where the alarm event is located in the alarm timing diagram as the starting point, the alarm timing diagram is intercepted according to the preset alarm accompaniment duration to obtain the alarm timing sub-diagram within each alarm accompaniment period where the alarm event is located.

6. The method according to claim 1, characterized in that The step of aggregating alarms for each alarm event according to the alarm association relationship under each alarm event includes: Merge and remove duplicate alarm associations under each alarm event to obtain an alarm association set; Alarm aggregation is performed on alarm events that meet any alarm association relationship in the alarm association set.

7. The method according to claim 1, characterized in that Before extracting the alarm time sequence subgraphs within each alarm accompanying period of the alarm event from the generated alarm time sequence graph for each alarm event, the following steps are further included: The alarm time sequence picture is formed according to the alarm distribution of each alarm event changing with time.

8. An alarm aggregation device, characterized in that: include: An alarm subgraph interception module is used to intercept, for each alarm event, an alarm time sequence subgraph within each alarm accompanying period of the alarm event from the formed alarm time sequence landscape, wherein the alarm time sequence landscape is formed by the time sequence distribution of each of the alarm events; A correlation relationship determination module is used to determine, for each alarm event, the alarm correlation relationship under the alarm event based on the accompanying alarm hotspots obtained by superimposing the alarm time sequence subgraphs within the alarm accompanying time period in which the alarm event is located; An alarm aggregation module is used to aggregate the alarm events according to the alarm association relationship under each alarm event; The association relationship determination module is specifically configured to: For each alarm event, superimpose the alarm time sequence subgraphs in each of the alarm accompanying time periods in which the alarm event is located to determine the frequency of accompanying alarms that occur with each alarm event; According to the frequency of accompanying alarms that occur with each alarm event, the alarm correlation between each alarm event and the alarm event is calculated to determine the accompanying alarm hotspots under the alarm event; Between the alarm events pointed to by the accompanying alarm hotspots, an alarm association relationship under the alarm event is generated.

9. An electronic device, characterized in that: include: A processor and a memory, the memory being used to store a computer program, and the processor being used to call and run the computer program stored in the memory to execute the alarm aggregation method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that Used to store a computer program, wherein the computer program enables a computer to execute the alarm aggregation method according to any one of claims 1 to 7.

11. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the alarm aggregation method according to any one of claims 1 to 7 is implemented.

Images