Alarm information clustering method, device and storage medium

Abstract

The embodiment of the present application provides an alarm information clustering method, device and storage medium, which relates to the field of communication technology and solves the technical problem that the alarm information in historical data cannot be reasonably classified. The alarm information clustering method includes: obtaining alarm information and characteristic information of the alarm information; the alarm information includes the network element that generates the alarm information and the time when the alarm information is generated; according to the alarm information, determining the characteristic information to be clustered; the characteristic information to be clustered includes: network element proportion characteristic information or time difference characteristic information; the network element proportion characteristic information is used to indicate the proportion of the network element that generates the alarm information in the preset network element set; the time difference characteristic information is used to indicate the time difference between the time when the alarm information is generated and the preset time; based on the clustering algorithm, clustering the characteristic information to be clustered and the characteristic information of the alarm information to obtain the clustering result of the alarm information.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to an alarm information clustering method, device and storage medium. Background Art

[0002] During the network operation and maintenance process, network equipment will inevitably fail and generate massive amounts of alarm information.

[0003] However, most alarms are caused by a single root cause alarm. This root cause alarm can generate numerous derivative alarms, necessitating the use of artificial intelligence algorithms to mine alarm correlations from this massive amount of alarm information, identifying both the root cause alarm and its derivatives to aid in fault location.

[0004] Artificial intelligence algorithms rely on extensive historical data. This data, typically several months in length, must be exported from network management storage servers. This historical data often includes more than one fault message, and often only the alarm information within a single fault message is relevant enough for analysis.

[0005] Therefore, how to reasonably classify the alarm information in historical data is a technical problem that needs to be solved urgently. Summary of the Invention

[0006] The embodiments of the present application provide a method, device, and storage medium for clustering alarm information, which solve the current technical problem of being unable to reasonably classify alarm information in historical data.

[0007] To achieve the above objectives, the present invention adopts the following technical solutions:

[0008] In a first aspect, a method for clustering alarm information is provided, comprising:

[0009] Acquire alarm information and its characteristic information; the alarm information includes the network element generating the alarm information and the time when the alarm information is generated;

[0010] Determine characteristic information to be clustered based on the alarm information; the characteristic information to be clustered includes: network element proportion characteristic information or time difference characteristic information; the network element proportion characteristic information is used to indicate the proportion of the network element generating the alarm information in the preset network element set; the time difference characteristic information is used to indicate the time difference between the time when the alarm information is generated and the preset time;

[0011] Based on the clustering algorithm, the characteristic information to be clustered and the characteristic information of the alarm information are clustered to obtain the clustering result of the alarm information.

[0012] Optionally, when the characteristic information to be clustered includes network element proportion characteristic information, determining the characteristic information to be clustered according to the alarm information includes:

[0013] According to the order of the time when the alarm information is generated, the alarm information is divided into multiple sets according to the preset time period; each set includes at least one alarm information;

[0014] For each set, the following operations are performed to obtain the network element ratio characteristic information:

[0015] The proportion of each network element in a set of multiple network elements that generate at least one alarm information is obtained, and feature engineering processing is performed on the proportion to obtain network element proportion feature information of each network element.

[0016] Optionally, when a set includes an alarm information, the alarm information clustering method further includes:

[0017] Determining whether a network element generating an alarm message is consistent with a network element generating a target alarm message; the target alarm message is an alarm message adjacent to an alarm message;

[0018] If they are consistent, one set and the set to which the target alarm information belongs are merged into the same set.

[0019] Optionally, when the feature information to be clustered includes time difference feature information, determining the feature information to be clustered according to the alarm information includes:

[0020] Obtain the time difference between the time when the alarm information is generated and the preset time, and perform feature engineering processing on the time difference to obtain time difference feature information.

[0021] Optionally, the alarm information clustering method further includes:

[0022] When the alarm information includes power outage alarm information, the power outage alarm information is determined as a clustering result corresponding to the power outage alarm information.

[0023] Optionally, the alarm information clustering method further includes:

[0024] Performing a first sorting operation on the initial label value of each result in the clustering result of the alarm information to obtain a first label value of each result;

[0025] The first sorting operation includes:

[0026] For the first result in the clustering result of the alarm information, determine the first label value L′1 of the first result = 1;

[0027] For the i-th result in the clustering result of the alarm information, when the initial label value L of the i-th result i Equal to the initial label value L of the i-1th result i-1 When , determine the first label value L′ of the i-th result i Equal to the first label value L′ of the i-1 resulti-1 ; i is an integer greater than 1;

[0028] When the initial label value L of the i-th result i Not equal to the initial label value L of the i-1th result i-1 , and there is an initial label value L for the j-th result j Equal to the initial label value L of the i-th result i When , determine the first label value L′ of the i-th result i Equal to the first label value L′ of the j-th result j ; j is an integer greater than 1 and less than i;

[0029] When the initial label value L of the i-th result i Not equal to the initial label value L of the i-1th result i-1 , and there is no initial label value L for the j-th result j Equal to the initial label value L of the i-th result i When , determine the first label value L′ of the i-th result i =max{L′ j ,j<i}+1.

[0030] Optionally, after performing a first sorting operation on the initial label value of each result in the clustering result of the alarm information to obtain a first label value of each result, the method further includes:

[0031] Performing a second sorting operation on the first label value of each result to obtain a second label value of each result;

[0032] The second sorting operation includes:

[0033] When the first label value of the i-th result is greater than or equal to the first label value of the i-1-th result, the first label value of the i-th result is determined as the second label value of the i-th result;

[0034] When the first label value of the i-th result is less than the first label value of the i-1-th result, determine the second label value L" of the i-th result i =min(L′ i-1 +1, CLUSTERS), and determine the second label value L″ of the result that is the same as the first label value of the i-th result p =min(L′ i-1 +1, CLUSTERS; p is an integer greater than i; CLUSTERS is the number of categories in the clustering results of the alarm information.

[0035] In a second aspect, an alarm information clustering device is provided, the alarm information clustering device comprising: an acquisition unit and a processing unit;

[0036] An acquisition unit, configured to acquire alarm information and characteristic information of the alarm information; the alarm information includes the network element generating the alarm information and the time when the alarm information is generated;

[0037] The processing unit is configured to determine characteristic information to be clustered based on the alarm information; the characteristic information to be clustered includes: network element proportion characteristic information or time difference characteristic information; the network element proportion characteristic information is used to indicate the proportion of network elements generating the alarm information in a preset network element set; the time difference characteristic information is used to indicate the time difference between the time when the alarm information is generated and the preset time;

[0038] The processing unit is further configured to cluster the characteristic information to be clustered and the characteristic information of the alarm information based on a clustering algorithm to obtain a clustering result of the alarm information.

[0039] Optionally, when the feature information to be clustered includes network element proportion feature information, the processing unit is specifically configured to:

[0040] According to the order of the time when the alarm information is generated, the alarm information is divided into multiple sets according to the preset time period; each set includes at least one alarm information;

[0041] For each set, the following operations are performed to obtain the network element ratio characteristic information:

[0042] The proportion of each network element in a set of multiple network elements that generate at least one alarm information is obtained, and feature engineering processing is performed on the proportion to obtain network element proportion feature information of each network element.

[0043] Optionally, when a set includes an alarm message, the processing unit is further configured to:

[0044] Determining whether a network element generating an alarm message is consistent with a network element generating a target alarm message; the target alarm message is an alarm message adjacent to an alarm message;

[0045] If they are consistent, one set and the set to which the target alarm information belongs are merged into the same set.

[0046] Optionally, when the feature information to be clustered includes time difference feature information, the processing unit is specifically configured to:

[0047] Obtain the time difference between the time when the alarm information is generated and the preset time, and perform feature engineering processing on the time difference to obtain time difference feature information.

[0048] Optionally, the processing unit is further configured to, when the alarm information includes power outage alarm information, determine the power outage alarm information as a clustering result corresponding to the power outage alarm information.

[0049] Optionally, the processing unit is further configured to perform a first sorting operation on the initial label value of each result in the clustering result of the alarm information to obtain a first label value of each result;

[0050] The first sorting operation includes:

[0051] For the first result in the clustering result of the alarm information, determine the first label value L′1 of the first result = 1;

[0052] For the i-th result in the clustering result of the alarm information, when the initial label value L of the i-th result i Equal to the initial label value L of the i-1th result i-1 When , determine the first label value L′ of the i-th result i Equal to the first label value L′ of the i-1 result i-1 ; i is an integer greater than 1;

[0053] When the initial label value L of the i-th result i Not equal to the initial label value L of the i-1th result i-1 , and there is an initial label value L for the j-th result j Equal to the initial label value L of the i-th result i When , determine the first label value L′ of the i-th result i Equal to the first label value L′ of the j-th result j ; j is an integer greater than 1 and less than i;

[0054] When the initial label value L of the i-th result i Not equal to the initial label value L of the i-1th result i-1 , and there is no initial label value L for the j-th result j Equal to the initial label value L of the i-th result i When , determine the first label value L′ of the i-th result i =max{L′ j ,j<i}+1.

[0055] Optionally, the processing unit is further configured to perform a second sorting operation on the first label value of each result to obtain a second label value of each result;

[0056] The second sorting operation includes:

[0057] When the first label value of the i-th result is greater than or equal to the first label value of the i-1-th result, the first label value of the i-th result is determined as the second label value of the i-th result;

[0058] When the first label value of the i-th result is less than the first label value of the i-1-th result, determine the second label value L" of the i-th resulti =min(L′ i-1 +1, CLUSTERS), and determine the second label value L″ of the result that is the same as the first label value of the i-th result p =min(L′ i-1 +1, CLUSTERS; p is an integer greater than i; CLUSTERS is the number of categories in the clustering results of the alarm information.

[0059] In a third aspect, an alarm information clustering device is provided, comprising a memory and a processor. The memory is configured to store computer-executable instructions, and the processor and the memory are connected via a bus. When the alarm information clustering device is in operation, the processor executes the computer-executable instructions stored in the memory, causing the alarm information clustering device to perform the alarm information clustering method described in the first aspect.

[0060] The alarm information clustering device may be a network device, or a portion of a network device, such as a chip system within the network device. The chip system is configured to support the network device in implementing the functions involved in the first aspect and any possible implementation thereof, such as receiving, determining, and diverting the data and / or information involved in the above-described alarm information clustering method. The chip system includes a chip and may also include other discrete devices or circuit structures.

[0061] In a fourth aspect, a computer-readable storage medium is provided, the computer-readable storage medium including computer execution instructions, which, when executed on a computer, enable the computer to execute the alarm information clustering method described in the first aspect.

[0062] In a fifth aspect, a computer program product is provided. When the computer program product is run on a computer, the computer is caused to execute the alarm information clustering method as described in the first aspect and any possible design thereof.

[0063] It should be noted that the above-mentioned computer instructions may be stored in whole or in part on the first computer storage medium. The first computer storage medium may be packaged together with the processor of the alarm information clustering device, or may be packaged separately from the processor of the alarm information clustering device, and this embodiment of the application does not limit this.

[0064] The description of the second, third, fourth and fifth aspects of the present invention can refer to the detailed description of the first aspect; and the beneficial effects of the second, third, fourth and fifth aspects can refer to the analysis of the beneficial effects of the first aspect, which will not be repeated here.

[0065] In the embodiments of the present application, the name of the alarm information clustering device does not limit the device or functional module itself. In actual implementation, these devices or functional modules may appear with other names. As long as the functions of each device or functional module are similar to those of the present invention, they are within the scope of the claims of the present invention and their equivalents.

[0066] These and other aspects of the present invention will become more apparent from the following description.

[0067] The technical solution provided by this application brings at least the following beneficial effects:

[0068] In the present application, the alarm information clustering device can obtain the alarm information and the characteristic information of the alarm information and determine the characteristic information to be clustered based on the alarm information. Subsequently, the alarm information clustering device clusters the characteristic information to be clustered and the characteristic information of the alarm information based on the clustering algorithm to obtain the clustering result of the alarm information. The present application takes into account that the time when the alarm information of the same type is generated is relatively close, and the derived alarm information may be different alarm information issued by the same network element. Therefore, the present application can determine the clustering result based on the characteristic information to be clustered including the network element proportion characteristic information (used to indicate the proportion of the network element that generates the alarm information in the preset network element set) or the time difference characteristic information (used to indicate the time difference between the time when the alarm information is generated and the preset time), thereby improving the accuracy of the alarm information clustering. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 A schematic diagram of the hardware structure of an alarm information clustering device provided in an embodiment of the present application;

[0070] Figure 2 A schematic diagram of the hardware structure of another alarm information clustering device provided in an embodiment of the present application;

[0071] Figure 3 A schematic diagram of a process for training an alarm information clustering model provided in an embodiment of the present application;

[0072] Figure 4 A schematic diagram of the structure of an alarm information clustering device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0073] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0074] It should be noted that in the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be interpreted as being more preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0075] In order to facilitate a clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish between identical or similar items with basically the same functions and effects. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order.

[0076] As described in the background, AI algorithms rely on large amounts of historical data. This data, typically several months in length, must be exported from network management storage servers. This historical data often contains more than one fault message, and often only the alarm information within a single fault message is relevant enough for analysis.

[0077] Therefore, how to reasonably classify the alarm information in historical data is a technical problem that needs to be solved urgently.

[0078] In response to the above problems, an embodiment of the present application provides an alarm information clustering method, in which an alarm information clustering device can obtain alarm information and characteristic information of alarm information and determine characteristic information to be clustered based on the alarm information. Subsequently, the alarm information clustering device clusters the characteristic information to be clustered and the characteristic information of the alarm information based on a clustering algorithm to obtain a clustering result of the alarm information. The present application takes into account that the time when alarm information of the same type is generated is relatively close, and the derived alarm information may be different alarm information issued by the same network element. Therefore, the present application can determine the clustering result based on the characteristic information to be clustered including network element proportion characteristic information (used to indicate the proportion of network elements that generate alarm information in a preset network element set) or time difference characteristic information (used to indicate the time difference between the time when the alarm information is generated and the preset time), thereby improving the accuracy of alarm information clustering.

[0079] The alarm information clustering device may be a device for predicting the performance of the device and line corresponding to the target port, or may be a chip in the device, or may be a system on chip in the device.

[0080] Optionally, the device may be a physical machine, such as a desktop computer, mobile phone, tablet computer, notebook computer, ultra-mobile personal computer (UMPC), netbook, personal digital assistant (PDA) and other terminal devices.

[0081] Optionally, the alarm information clustering device may also implement the functions to be implemented by the alarm information clustering device through a virtual machine (VM) deployed on a physical machine.

[0082] For ease of understanding, the structure of the alarm information clustering device in the embodiment of the present application is described below.

[0083] Figure 1 FIG. 1 shows a hardware structure diagram of the alarm information clustering device provided in an embodiment of the present application. Figure 1 As shown, the alarm information clustering device includes a processor 11, a memory 12, a communication interface 13, and a bus 14. The processor 11, the memory 12, and the communication interface 13 can be connected via the bus 14.

[0084] Processor 11 is the control center of the alarm information clustering device and can be a single processor or a collective term for multiple processing elements. For example, processor 11 can be a general-purpose central processing unit (CPU) or other general-purpose processor. The general-purpose processor can be a microprocessor or any conventional processor.

[0085] As an embodiment, the processor 11 may include one or more CPUs, such as Figure 1 CPU 0 and CPU 1 are shown in Figure 1.

[0086] The memory 12 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0087] In one possible implementation, the memory 12 may exist independently of the processor 11 and may be connected to the processor 11 via a bus 14 for storing instructions or program codes. When the processor 11 calls and executes the instructions or program codes stored in the memory 12, the alarm information clustering method provided in the embodiment of the present invention can be implemented.

[0088] In another possible implementation, the memory 12 may also be integrated with the processor 11 .

[0089] The communication interface 13 is used to connect to other devices via a communication network. The communication network may be Ethernet, a wireless access network, a wireless local area network (WLAN), etc. The communication interface 13 may include a receiving unit for receiving data and a sending unit for sending data.

[0090] The bus 14 can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 1 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0091] It should be pointed out that Figure 1 The structure shown does not constitute a limitation on the alarm information clustering device. Figure 1 In addition to the components shown, the warning information clustering device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0092] Figure 2 FIG. 2 shows another hardware structure of the alarm information clustering device in the embodiment of the present application. Figure 2 As shown, the communication device may include a processor 21 and a communication interface 22. The processor 21 is coupled to the communication interface 22.

[0093] The functions of the processor 21 may refer to the description of the processor 11. In addition, the processor 21 also has a storage function, which may refer to the function of the memory 12.

[0094] The communication interface 22 is used to provide data to the processor 21. The communication interface 22 can be an internal interface of the communication device, or an external interface of the alarm information clustering device (equivalent to the communication interface 13).

[0095] It should be pointed out that Figure 1 (or Figure 2 ) does not constitute a limitation on the alarm information clustering device, except Figure 1 (or Figure 2 ) In addition to the components shown in the figure, the alarm information clustering device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0096] The alarm information clustering method provided in the embodiment of the present application is described in detail below with reference to the accompanying drawings.

[0097] like Figure 3 As shown, the alarm information clustering method provided in the embodiment of the present application specifically includes:

[0098] S301: The alarm information clustering device obtains alarm information and feature information of the alarm information.

[0099] Specifically, the alarm information clustering device may obtain the alarm information from a database storing the alarm information or a network element generating the alarm information.

[0100] The alarm information includes the network element that generates the alarm information and the time when the alarm information is generated.

[0101] The alarm information clustering device can also obtain characteristic information of the alarm information.

[0102] Optionally, after acquiring the alarm information, the alarm information clustering device may perform feature engineering processing on the alarm information to obtain feature information of the alarm information.

[0103] Feature engineering refers to the process of converting raw data into training data for the model. Its purpose is to obtain better training data features so that the machine learning model approaches this upper limit.

[0104] Feature engineering can improve model performance, sometimes even achieving good results on simple models. Feature engineering plays a crucial role in machine learning and is generally considered to include three parts: feature construction, feature extraction, and feature selection.

[0105] Both feature extraction and feature selection aim to find the most effective features from the original features. The difference between them is that feature extraction emphasizes obtaining a set of features with obvious physical or statistical significance through feature transformation.

[0106] Feature selection, on the other hand, involves selecting a subset of features from a set of features that have significant physical or statistical significance. Both can help reduce feature dimensionality and data redundancy. Feature extraction can sometimes reveal more meaningful feature attributes, while the feature selection process often indicates the importance of each feature to model building.

[0107] S302: The alarm information clustering device determines feature information to be clustered based on the alarm information.

[0108] Specifically, after obtaining the alarm information, the alarm information clustering device may determine the feature information to be clustered based on the alarm information.

[0109] Among them, the characteristic information to be clustered includes: network element proportion characteristic information or time difference characteristic information; network element proportion characteristic information is used to indicate the proportion of network elements generating alarm information in the preset network element set; time difference characteristic information is used to indicate the time difference between the time when the alarm information is generated and the preset time.

[0110] Optionally, when the characteristic information to be clustered is network element ratio characteristic information, the method for the alarm information clustering apparatus to determine the characteristic information to be clustered based on the alarm information specifically includes:

[0111] The alarm information clustering device divides the alarm information into multiple sets according to the preset time periods based on the order of the times when the alarm information is generated.

[0112] A set includes at least one warning information.

[0113] The alarm information clustering device performs the following operations for each set to obtain network element proportion feature information:

[0114] The proportion of each network element in a set of multiple network elements that generate at least one alarm information is obtained, and feature engineering processing is performed on the proportion to obtain network element proportion feature information of each network element.

[0115] Exemplarily, the alarm information clustering device may pre-group the acquired alarm information according to the order of the time when the alarm information is generated, and group the alarm information that occurs within two minutes.

[0116] For example, the occurrence time is within two minutes and grouped together. The time interval between groups is adjusted based on the continuous experimental results. It should be noted that the time interval for pre-grouping must be selected to ensure that the number of groups formed after the initial grouping is greater than or equal to the number of alarm groups.

[0117] Each group of alarm information can be represented by a vector (a,b,c,d,e,…,t). a,b,c,d,e,… are different network element numbers, the length of the vector is the total number of network elements, and t represents the time when the first alarm information in this group was generated.

[0118] Next, the alarm information clustering device counts the proportion of each network element in each group.

[0119] For example, in a group of 10 alarm messages, the vector (0, 0.5, 0.2, 0, 0.3, t) indicates that network element a appeared 0 times, network element b appeared 5 times, network element c appeared 2 times, network element d appeared 0 times, and network element e appeared 3 times. The total percentage of all network elements should be 1.

[0120] Optionally, when a set includes an alarm information, the alarm information clustering device determines whether the network element generating the alarm information is consistent with the network element generating the target alarm information.

[0121] The target alarm information is the alarm information adjacent to an alarm information (ie, the last alarm information of the previous group or the first alarm information of the next group).

[0122] If they are consistent, the alarm information clustering device merges one set and the set to which the target alarm information belongs into the same set.

[0123] If they are inconsistent, the alarm information clustering device will treat this set as a separate group.

[0124] Optionally, when the characteristic information to be clustered includes time difference characteristic information, the method for the alarm information clustering apparatus to determine the characteristic information to be clustered based on the alarm information specifically includes:

[0125] The alarm information clustering device obtains the time difference between the time when the alarm information is generated and the preset time, and performs feature engineering processing on the time difference to obtain time difference feature information.

[0126] Exemplarily, the alarm information clustering device may sort the acquired alarm information in the order of the time when the alarm information is generated, and mark the order s of each alarm information.

[0127] Next, the alarm information clustering device calculates the time difference between each alarm information, sets the time difference of the first alarm information to 0, and then calculates the time difference between each alarm information and the previous one (uniformly converted to seconds as the unit of measurement), and records it as t.

[0128] In this case, the alarm information clustering device can perform feature engineering on the time difference to obtain time difference feature information. Each alarm information can be represented by a vector (a, b, c, d, e, ..., t, s), where a, b, c, d, e, ... are different network element numbers. The length of the vector is the total number of network elements.

[0129] S303: The alarm information clustering device clusters the characteristic information to be clustered and the characteristic information of the alarm information based on a clustering algorithm to obtain a clustering result of the alarm information.

[0130] Specifically, after determining the feature information to be clustered according to the alarm information, the alarm information clustering device may cluster the feature information to be clustered and the feature information of the alarm information based on a clustering algorithm to obtain a clustering result of the alarm information.

[0131] Optionally, the clustering algorithm may also be a k-means-random algorithm, a k-means++ algorithm, or other clustering algorithms.

[0132] Optionally, when the characteristic information to be clustered is network element ratio characteristic information, the alarm information clustering device can cluster the alarm information occurring on the same day based on the network element ratio characteristic information using a k-means clustering algorithm, which will not be repeated here.

[0133] When the characteristic information to be clustered is the network element proportion characteristic information, the clustering includes two characteristics: the network element proportion characteristic information and the alarm information characteristic information, and the data representation difference between the network element proportion characteristic information and the alarm information characteristic information is relatively large (for example, the network element proportion characteristic information may be 0 to 1, and the time characteristic information in the alarm information characteristic information may be thousands of seconds when converted to seconds).

[0134] In this case, in order to eliminate differences, the alarm information clustering device needs to uniformly map different feature intervals to the same interval, that is, normalize the data and scale the data so that it falls into the [0,1] interval.

[0135] Furthermore, in clustering, each element to be clustered has a eigenvector that measures its position. The core of the clustering algorithm is to classify elements based on their distances. For data from different days, the distance is multiplied by a large outlier factor to ensure that data from different days are not grouped together.

[0136] Optionally, when the characteristic information to be clustered is time difference characteristic information, the alarm information clustering device can cluster the alarm information occurring on the same day based on the time difference characteristic information using a k-means clustering algorithm, which will not be described in detail here.

[0137] When the feature information to be clustered is time difference feature information, the clustering includes three features: time difference feature information, network element feature information in the feature information of the alarm information, and sequence feature information, and the data representation differences between the above three features are relatively large (for example, the feature information of 20 network elements may be 1 to 20, the time feature information in the feature information of the alarm information may be thousands of seconds, and the sequence feature information may be hundreds).

[0138] In this case, in order to eliminate differences, the alarm information clustering device needs to uniformly map different feature intervals to the same interval, that is, normalize the data and scale the data so that it falls into the [0,1] interval.

[0139] Furthermore, in clustering, each element to be clustered has a feature vector that measures its position. The core of the clustering algorithm is to classify elements based on the distance between them. For alarms from different days, the distance is multiplied by a large anomaly coefficient to ensure that alarms from different days are not grouped together when determining the feature information to be clustered.

[0140] Optionally, the alarm information clustering method further includes: when the alarm information includes power outage alarm information, the alarm information clustering device determines the power outage alarm information as a clustering result corresponding to the power outage alarm information.

[0141] Specifically, for power failure alarm information, such as alarm information with the alarm name POWER_FAIL, since the power failure alarm needs to be reported separately, the power failure alarm information is separately classified into a category.

[0142] For example, assuming that the alarm information needs to be divided into 18 groups in total, but a power failure alarm message appears, then the other data should be divided into 17 groups.

[0143] S304: The alarm information clustering device performs a first sorting operation on the initial label value of each result in the clustering result of the alarm information to obtain a first label value of each result.

[0144] The first sorting operation includes:

[0145] For the first result in the clustering result of the alarm information, determine the first label value L′1 of the first result = 1;

[0146] For the i-th result in the clustering result of the alarm information, when the initial label value L of the i-th result i Equal to the initial label value L of the i-1th result i-1 When , determine the first label value L′ of the i-th result i Equal to the first label value L′ of the i-1 result i-1; i is an integer greater than 1;

[0147] When the initial label value L of the i-th result i Not equal to the initial label value L of the i-1th result i-1 , and there is an initial label value L for the j-th result i Equal to the initial label value L of the i-th result i When , determine the first label value L′ of the i-th result i Equal to the first label value L′ of the j-th result j ; j is an integer greater than 1 and less than i;

[0148] When the initial label value L of the i-th result i Not equal to the initial label value L of the i-1th result i-1 , and there is no initial label value L for the j-th result j Equal to the initial label value L of the i-th result i When , determine the first label value L′ of the i-th result j =max{L′ j ,j<i}+1.

[0149] Exemplarily, the initial label values ​​of the clustering result of the alarm information are (1, 3, 2, 3, 3, 4, 5).

[0150] For the initial label value of the first result, which is 1, the first label value of the first result is directly determined to be 1.

[0151] For the second result, the initial label value is 3. The initial label value 3 of the second result is not equal to the initial label value 1 of the first result, and there is no previous result with the same label value as 3. In this case, the first label value of the second result is determined to be 2, which is the largest first label value 1 among the previous results plus 1.

[0152] The initial label value of the third result is 2. The initial label value of 2 is not equal to the initial label value of 3 of the second result, and there is no previous result with the same label value as 2. In this case, the first label value of the third result is determined to be 3, which is the largest first label value of 2 among the previous results plus 1.

[0153] The initial label value of the fourth result is 3. If the initial label value of 3 is not equal to the initial label value of 2 of the third result, and there is a second result with the same initial label value of 3 before the fourth result, then the first label value of the fourth result is determined to be 2, the first label value of the second result.

[0154] For the initial label value of the fifth result, 3, the initial label value of the fifth result is equal to the initial label value of the fourth result, 3. In this case, the first label value of the fifth result is determined to be the first label value of the fourth result, 2.

[0155] The initial label value of the sixth result is 4. The initial label value of 4 is not equal to the initial label value of 3 of the fifth result, and there is no previous result with the same label value as 4. In this case, the first label value of the sixth result is determined to be 4, which is the largest first label value of 3 among the previous results plus 1.

[0156] The initial label value of the seventh result is 5. The initial label value of 5 is not equal to the initial label value of 4 of the sixth result, and there is no previous result with the same label value as 5. In this case, the first label value of the seventh result is determined to be 5, which is the largest first label value of 4 among the previous results plus 1.

[0157] That is, after performing the first sorting operation on the initial label value (1, 3, 2, 3, 3, 4, 5) of each result in the clustering result of the alarm information, the first label value of each result is obtained as: (1, 2, 3, 2, 2, 4, 5).

[0158] S305: The alarm information clustering device performs a second sorting operation on the first label value of each result to obtain a second label value of each result.

[0159] The second sorting operation includes:

[0160] When the first label value of the i-th result is greater than or equal to the first label value of the i-1-th result, the first label value of the i-th result is determined as the second label value of the i-th result;

[0161] When the first label value of the i-th result is less than the first label value of the i-1-th result, determine the second label value L" of the i-th result i =min(L′ i-1 +1, CLUSTERS), and determine the second label value L″ of the result that is the same as the first label value of the i-th result p =min(L′ i-1 +1, CLUSTERS); p is an integer greater than i; CLUSTERS is the number of categories of the clustering results of the alarm information.

[0162] In combination with the above example, for the first label value of the first result being 1, the second label value of the first result is directly determined to be 1.

[0163] For the first label value 2 of the second result, if the first label value 2 of the second result is greater than the first label value 1 of the first result, the first label value 2 of the second result is determined as the second label value 2 of the second result.

[0164] For the first label value 3 of the third result, if the first label value 3 of the third result is greater than the first label value 2 of the second result, the first label value 3 of the third result is determined as the second label value 3 of the third result.

[0165] For the first label value of the fourth result, 2. If the first label value of the fourth result, 2, is less than the first label value of the third result, 3, the second label value of the fourth result is determined to be 4, which is the first label value of the third result, 3, plus 1.

[0166] For the first label value 2 of the fifth result, if the first label value 2 of the fifth result is equal to the first label value 2 of the fourth result, the second label value 4 of the fourth result is determined as the second label value 4 of the fifth result.

[0167] For the first label value of the sixth result, 4. If the first label value of the sixth result, 4, is greater than the first label value of the fifth result, 2, the second label value of the sixth result is determined to be 5, which is the sum of the first label value of 4 and 1.

[0168] For the first label value of the seventh result, 5. If the first label value of the seventh result, 5, is greater than the first label value of the sixth result, 4, the second label value of the seventh result is determined to be 6, which is the first label value of the seventh result, 5 plus 1.

[0169] That is, after performing the second sorting operation on the first label values ​​(1, 2, 3, 2, 2, 4, 5), the second label value of each result is obtained as: (1, 2, 3, 4, 4, 5, 6).

[0170] In summary, the alarm information clustering device can obtain the alarm information and the characteristic information of the alarm information and determine the characteristic information to be clustered based on the alarm information. Subsequently, the alarm information clustering device clusters the characteristic information to be clustered and the characteristic information of the alarm information based on the clustering algorithm to obtain the clustering result of the alarm information. The present application takes into account that the time when the alarm information of the same type is generated is relatively close, and the derived alarm information may be different alarm information issued by the same network element. Therefore, the present application can determine the clustering result based on the characteristic information to be clustered including the network element proportion characteristic information (used to indicate the proportion of the network element that generates the alarm information in the preset network element set) or the time difference characteristic information (used to indicate the time difference between the time when the alarm information is generated and the preset time), thereby improving the accuracy of the alarm information clustering.

[0171] Exemplarily, the alarm information clustering provided in this application specifically includes:

[0172] The alarm information clustering device first processes the power outage alarm information, that is, groups the power outage alarm information into a single group, and groups the other alarm information except the power outage alarm information.

[0173] Next, the alarm information clustering device performs feature engineering processing on the grouped alarm information to obtain a feature vector of the alarm information group.

[0174] Next, the alarm information clustering device normalizes the feature vectors of the alarm information group.

[0175] Next, the alarm information clustering device calculates the distance between the normalized alarm information groups. That is, the alarm information clustering device weights the alarm information from different days, multiplying the normalized information by the abnormality coefficient to ensure that the alarm information from different days is not grouped together.

[0176] Next, the alarm information clustering device clusters the above information according to a clustering algorithm to obtain a clustering result.

[0177] Finally, the alarm information clustering device reorganizes the clustering results to obtain clustering results that are sorted in sequence.

[0178] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of method. In order to realize the above functions, it includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily appreciate that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the embodiments of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in a hardware or computer software driven hardware manner depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0179] The embodiment of the present application can divide the functional modules of the alarm information clustering device according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above-mentioned integrated module can be implemented in the form of hardware or in the form of software functional modules. Optionally, the division of modules in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation.

[0180] like Figure 4FIG. 4 is a schematic diagram of the structure of an alarm information clustering device provided in an embodiment of the present application. The alarm information clustering device includes: an acquisition unit 401 and a processing unit 402;

[0181] The acquisition unit 401 is configured to acquire alarm information and characteristic information of the alarm information; the alarm information includes the network element generating the alarm information and the time when the alarm information is generated;

[0182] Processing unit 402 is configured to determine characteristic information to be clustered based on the alarm information; the characteristic information to be clustered includes: network element proportion characteristic information or time difference characteristic information; the network element proportion characteristic information is used to indicate the proportion of network elements generating the alarm information in a preset network element set; the time difference characteristic information is used to indicate the time difference between the time when the alarm information is generated and the preset time;

[0183] The processing unit 402 is further configured to cluster the characteristic information to be clustered and the characteristic information of the alarm information based on a clustering algorithm to obtain a clustering result of the alarm information.

[0184] Optionally, when the feature information to be clustered includes network element proportion feature information, the processing unit 402 is specifically configured to:

[0185] According to the order of the time when the alarm information is generated, the alarm information is divided into multiple sets according to the preset time period; each set includes at least one alarm information;

[0186] For each set, the following operations are performed to obtain the network element ratio characteristic information:

[0187] The proportion of each network element in a set of multiple network elements that generate at least one alarm information is obtained, and feature engineering processing is performed on the proportion to obtain network element proportion feature information of each network element.

[0188] Optionally, when a set includes an alarm message, the processing unit 402 is further configured to:

[0189] Determining whether a network element generating an alarm message is consistent with a network element generating a target alarm message; the target alarm message is an alarm message adjacent to an alarm message;

[0190] If they are consistent, one set and the set to which the target alarm information belongs are merged into the same set.

[0191] Optionally, when the feature information to be clustered includes time difference feature information, the processing unit 402 is specifically configured to:

[0192] Obtain the time difference between the time when the alarm information is generated and the preset time, and perform feature engineering processing on the time difference to obtain time difference feature information.

[0193] Optionally, the processing unit 402 is further configured to, when the alarm information includes power outage alarm information, determine the power outage alarm information as a clustering result corresponding to the power outage alarm information.

[0194] Optionally, the processing unit 402 is further configured to perform a first sorting operation on the initial label value of each result in the clustering result of the alarm information to obtain a first label value of each result;

[0195] The first sorting operation includes:

[0196] For the first result in the clustering result of the alarm information, determine the first label value L′1 of the first result = 1;

[0197] For the i-th result in the clustering result of the alarm information, when the initial label value L of the i-th result i Equal to the initial label value L of the i-1th result i-1 When , determine the first label value L′ of the i-th result i Equal to the first label value L′ of the i-1 result i-1 ; i is an integer greater than 1;

[0198] When the initial label value L of the i-th result i Not equal to the initial label value L of the i-1th result i-1 , and there is an initial label value L for the j-th result j Equal to the initial label value L of the i-th result i When , determine the first label value L′ of the i-th result i Equal to the first label value L′ of the j-th result j ; j is an integer greater than 1 and less than i;

[0199] When the initial label value L of the i-th result i Not equal to the initial label value L of the i-1th result i-1 , and there is no initial label value L for the j-th result j Equal to the initial label value L of the i-th result i When , determine the first label value L′ of the i-th result i =max{L′ j ,j<i}+1.

[0200] Optionally, the processing unit 402 is further configured to perform a second sorting operation on the first label value of each result to obtain a second label value of each result;

[0201] The second sorting operation includes:

[0202] When the first label value of the i-th result is greater than or equal to the first label value of the i-1-th result, the first label value of the i-th result is determined as the second label value of the i-th result;

[0203] When the first label value of the i-th result is less than the first label value of the i-1-th result, determine the second label value L" of the i-th result i =min(L′ i-1 +1, CLUSTERS), and determine the second label value L″ of the result that is the same as the first label value of the i-th result p =min(L′ i-1 +1, CLUSTERS); p is an integer greater than i; CLUSTERS is the number of categories of the clustering results of the alarm information.

[0204] The present application also provides a computer-readable storage medium including computer-executable instructions. When the computer-executable instructions are executed on a computer, the computer executes the steps performed by the alarm information clustering device in the alarm information clustering method provided in the above embodiment.

[0205] An embodiment of the present application also provides a computer program product, which can be directly loaded into a memory and contains software code. After being loaded and executed by a computer, the computer program product can implement the various steps performed by the alarm information clustering device in the alarm information clustering method provided in the above embodiment.

[0206] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer execution instructions are loaded and executed on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website, computer, server or data center to another website, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more media that can be integrated. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state disk (SSD)).

[0207] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0208] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the modules or units is merely a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms. The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place, or they may be distributed in multiple different places. Some or all of the units can be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0209] In addition, the functional units in the various embodiments of the present invention can be integrated into a processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of a software functional unit. If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a device (which can be a single-chip microcomputer, chip, etc.) or a processor to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program code, such as a USB flash drive, a mobile hard disk, a ROM, a RAM, a magnetic disk, or an optical disk.

[0210] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A method for clustering alarm information, characterized in that: include: Obtaining warning information and characteristic information of the warning information; The alarm information includes the network element that generates the alarm information and the time when the alarm information is generated; Determining feature information to be clustered based on the alarm information; The characteristic information to be clustered includes: network element proportion characteristic information or time difference characteristic information; the network element proportion characteristic information is used to indicate the proportion of the network element generating the alarm information in the preset network element set; the time difference characteristic information is used to indicate the time difference between the time when the alarm information is generated and the preset time; Based on a clustering algorithm, clustering the feature information to be clustered and the feature information of the alarm information to obtain a clustering result of the alarm information; When the characteristic information to be clustered includes the network element proportion characteristic information, determining the characteristic information to be clustered according to the alarm information includes: According to the order of the time when the alarm information is generated, the alarm information is divided into multiple sets according to the preset time period; each set includes at least one alarm information; For each set, the following operations are performed to obtain the network element proportion characteristic information: Obtain the proportion of each network element in the set among the multiple network elements that generate the at least one alarm information, and perform feature engineering processing on the proportion to obtain network element proportion feature information of each network element.

2. The alarm information clustering method according to claim 1, characterized in that: When the set includes one alarm information, the alarm information clustering method further includes: Determining whether a network element generating the one alarm information is consistent with a network element generating target alarm information; the target alarm information is alarm information adjacent to the one alarm information; If they are consistent, the one set and the set to which the target alarm information belongs are merged into the same set.

3. The alarm information clustering method according to claim 1, characterized in that: When the characteristic information to be clustered includes the time difference characteristic information, determining the characteristic information to be clustered according to the alarm information includes: Obtain the time difference between the time when the alarm information is generated and the preset time, and perform feature engineering processing on the time difference to obtain the time difference feature information.

4. The alarm information clustering method according to claim 1, characterized in that: Also includes: When the alarm information includes power outage alarm information, the power outage alarm information is determined as a clustering result corresponding to the power outage alarm information.

5. The alarm information clustering method according to claim 1, characterized in that: Also includes: Performing a first sorting operation on the initial label value of each result in the clustering result of the alarm information to obtain a first label value of each result; The first sorting operation includes: For the first result in the clustering result of the alarm information, determine the first label value of the first result ; For the i-th result in the clustering result of the alarm information, when the initial label value of the i-th result Equal to the initial label value of the i-1th result When the first label value of the i-th result is determined Equal to the first label value of the i-1 results ; i is an integer greater than 1; When the initial label value of the i-th result Not equal to the initial label value of the i-1th result , and there is an initial label value for the jth result Equal to the initial label value of the i-th result When the first label value of the i-th result is determined Equal to the first label value of the j-th result ; j is an integer greater than 1 and less than i; When the initial label value of the i-th result Not equal to the initial label value of the i-1th result , and there is no initial label value for the j-th result Equal to the initial label value of the i-th result When the first label value of the i-th result is determined .

6. The alarm information clustering method according to claim 5, characterized in that: After performing a first sorting operation on the initial label value of each result in the clustering result of the alarm information to obtain the first label value of each result, the method further includes: Performing a second sorting operation on the first label value of each result to obtain a second label value of each result; The second sorting operation includes: When the first label value of the i-th result is greater than or equal to the first label value of the (i-1)-th result, the first label value of the i-th result is determined as the second label value of the i-th result; When the first label value of the i-th result is less than the first label value of the i-1-th result, determine the second label value of the i-th result , and determine the second label value of the result that is the same as the first label value of the i-th result ; p is an integer greater than i; The number of categories of the clustering result of the alarm information.

7. An alarm information clustering device, characterized in that: include: Acquisition unit and processing unit; The acquiring unit is configured to acquire the alarm information and characteristic information of the alarm information; The alarm information includes the network element that generates the alarm information and the time when the alarm information is generated; The processing unit is configured to determine feature information to be clustered based on the alarm information; The characteristic information to be clustered includes: network element proportion characteristic information or time difference characteristic information; the network element proportion characteristic information is used to indicate the proportion of the network element generating the alarm information in the preset network element set; the time difference characteristic information is used to indicate the time difference between the time when the alarm information is generated and the preset time; The processing unit is further configured to cluster the feature information to be clustered and the feature information of the alarm information based on a clustering algorithm to obtain a clustering result of the alarm information; When the characteristic information to be clustered includes the network element proportion characteristic information, the processing unit is specifically configured to: According to the order of the time when the alarm information is generated, the alarm information is divided into multiple sets according to the preset time period; each set includes at least one alarm information; For each set, the following operations are performed to obtain the network element proportion characteristic information: Obtain the proportion of each network element in the set among the multiple network elements that generate the at least one alarm information, and perform feature engineering processing on the proportion to obtain network element proportion feature information of each network element.

8. The alarm information clustering device according to claim 7, characterized in that: When the set includes an alarm message, the processing unit is further configured to: Determining whether a network element generating the one alarm information is consistent with a network element generating target alarm information; the target alarm information is alarm information adjacent to the one alarm information; If they are consistent, the one set and the set to which the target alarm information belongs are merged into the same set.

9. The alarm information clustering device according to claim 7, characterized in that: When the feature information to be clustered includes the time difference feature information, the processing unit is specifically configured to: Obtain the time difference between the time when the alarm information is generated and the preset time, and perform feature engineering processing on the time difference to obtain the time difference feature information.

10. The alarm information clustering device according to claim 7, characterized in that: The processing unit is further configured to, when the alarm information includes power outage alarm information, determine the power outage alarm information as a clustering result corresponding to the power outage alarm information.

11. The alarm information clustering device according to claim 7, characterized in that: The processing unit is further configured to perform a first sorting operation on the initial label value of each result in the clustering result of the alarm information to obtain a first label value of each result; The first sorting operation includes: For the first result in the clustering result of the alarm information, determine the first label value of the first result ; For the i-th result in the clustering result of the alarm information, when the initial label value of the i-th result Equal to the initial label value of the i-1th result When the first label value of the i-th result is determined Equal to the first label value of the i-1 results ; i is an integer greater than 1; When the initial label value of the i-th result Not equal to the initial label value of the i-1th result , and there is an initial label value for the jth result Equal to the initial label value of the i-th result When the first label value of the i-th result is determined Equal to the first label value of the j-th result ; j is an integer greater than 1 and less than i; When the initial label value of the i-th result Not equal to the initial label value of the i-1th result , and there is no initial label value for the j-th result Equal to the initial label value of the i-th result When the first label value of the i-th result is determined .

12. The alarm information clustering device according to claim 11, characterized in that: The processing unit is further configured to perform a second sorting operation on the first label value of each result to obtain a second label value of each result; The second sorting operation includes: When the first label value of the i-th result is greater than or equal to the first label value of the (i-1)-th result, the first label value of the i-th result is determined as the second label value of the i-th result; When the first label value of the i-th result is less than the first label value of the i-1-th result, determine the second label value of the i-th result , and determine the second label value of the result that is the same as the first label value of the i-th result ; p is an integer greater than i; The number of categories of the clustering result of the alarm information.

13. An alarm information clustering device, characterized in that: It includes a memory and a processor; the memory is used to store computer-executable instructions, and the processor is connected to the memory via a bus; When the alarm information clustering device is running, the processor executes the computer-executable instructions stored in the memory, so that the alarm information clustering device performs the alarm information clustering method according to any one of claims 1 to 6.

14. A computer-readable storage medium, characterized in that The computer-readable storage medium includes computer-executable instructions, and when the computer-executable instructions are executed on a computer, the computer is enabled to execute the alarm information clustering method according to any one of claims 1 to 6.

Images