A method and device for clustering alarms

Abstract

The present application provides an alarm clustering method and device, which relates to the field of communication technology and can be used to improve the accuracy of alarm clustering. The method includes: obtaining M alarm information, where M is an integer greater than 1; dividing the M alarm information into N third alarm groups, where the third alarm group includes one or more adjacent alarm information, where N is an integer greater than 1; determining the characteristic information of each third alarm group, where the characteristic information of the third alarm group includes a date tag, and the date tag is used to reflect the generation date of the alarm information in the third alarm group; clustering the N third alarm groups according to the characteristic information of the N third alarm groups to obtain multiple cluster sets, where the cluster sets include one or more third alarm groups with the same date tag.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an alarm clustering method and device. Background Art

[0002] As communication technology matures, network scale expands, and network architecture becomes increasingly complex, a large number of alarms may be generated every day during network operation, and alarms caused by different reasons are intertwined, affecting maintenance personnel's network fault diagnosis and fault location. Therefore, it is necessary to comprehensively analyze these alarms in order to more accurately determine network faults.

[0003] Currently, when performing alarm analysis, the k-means clustering algorithm can be used to cluster the alarm information to obtain multiple clustering results, so as to further analyze the cause of the alarm based on the clustering results of the alarm. The clustering results of the alarm are the basis for subsequent mining the root cause of the alarm and locating the alarm.

[0004] However, the existing alarm clustering method based on the K-means algorithm obtains the initial cluster center by weighting, outlier deletion, density calculation, etc., which may cluster alarm information with a large alarm time interval into the same cluster set, and its clustering result is not accurate enough. Summary of the invention

[0005] The present application provides an alarm clustering method and device, which can be used to improve the accuracy of alarm clustering.

[0006] In a first aspect, the present application provides an alarm clustering method, the method comprising: obtaining M alarm information, where M is an integer greater than 1; dividing the M alarm information into N third alarm groups, where the third alarm group includes one or more adjacent alarm information, and N is an integer greater than 1; determining characteristic information of each third alarm group, the characteristic information of the third alarm group includes a date tag, and the date tag is used to reflect the generation date of the alarm information in the third alarm group; clustering the N third alarm groups according to the characteristic information of the N third alarm groups to obtain multiple cluster sets, and the cluster sets include one or more third alarm groups with the same date tag.

[0007] The technical solution provided by the present application brings at least the following beneficial effects: on the one hand, since the third alarm group includes one or more adjacent alarm information, and the characteristic information of the third alarm group includes a date tag, the alarm information in each cluster set obtained based on the method has a high correlation in the alarm time dimension. On the other hand, the cluster set obtained in the present application includes one or more third alarm groups with the same date tag, that is, the alarm information with different generation dates will not be clustered together in the present application. Therefore, the embodiment of the present application can improve the accuracy of the alarm clustering results, so that the operation and maintenance personnel can more accurately find the correlation rules between the alarm information and the alarm root cause in each cluster set according to the clustering results, and provide assistance for the subsequent alarm root cause location search, thereby improving the operation and maintenance efficiency.

[0008] Optionally, M alarm information is divided into N third alarm groups, including: according to the alarm time of each alarm information in the M alarm information, the M alarm information is divided into K first alarm groups; wherein the first alarm group includes one or more adjacent alarm information; and, for the first alarm group including at least two alarm information, the time interval between the alarm times of any two alarm information in the first alarm group is less than a preset time interval; K is an integer greater than 1; based on a similarity division rule, the K first alarm groups are divided into P second alarm groups, the second alarm groups including one or more first alarm groups; the similarity division rule includes: according to the adjacent The similarity between two first alarm groups is determined, and two adjacent first alarm groups with a similarity greater than or equal to a threshold are divided into the same second alarm group, and two adjacent first alarm groups with a similarity less than a threshold are divided into different second alarm groups; based on the correlation division rule, P second alarm groups are divided into N third alarm groups; the correlation division rule includes: dividing two adjacent second alarm groups with correlation into the same third alarm group, and dividing two adjacent second alarm groups without correlation into different third alarm groups; wherein, at least one second alarm group of two adjacent second alarm groups with correlation contains only one alarm information.

[0009] Optionally, before dividing P second alarm groups into N third alarm groups based on the correlation division rule, the method also includes: if the i-th second alarm group contains only one alarm information, then determining whether the alarm source of the alarm information in the i-th second alarm group is the same as the alarm source of the alarm information with the latest alarm time in the i-1-th second alarm group, i being a positive integer less than or equal to P; if they are the same, determining that the i-th second alarm group is associated with the i-1-th second alarm group; if they are not the same, then determining whether the alarm source of the alarm information in the i-th second alarm group is the same as the alarm source of the alarm information with the earliest alarm time in the i+1-th second alarm group; if they are the same, determining that the i-th second alarm group is associated with the i+1-th second alarm group.

[0010] Optionally, M alarm information is divided into N third alarm groups, including: according to the alarm time of each alarm information in the M alarm information, the M alarm information is divided into K first alarm groups; wherein, the first alarm group includes one or more adjacent alarm information; and, for a first alarm group containing at least two alarm information, the time interval between the alarm times of any two alarm information in the first alarm group is less than a preset time interval; K is an integer greater than 1; based on a correlation division rule, the K first alarm groups are divided into N third alarm groups; the correlation division rule includes: dividing two adjacent first alarm groups with correlation into the same third alarm group, and dividing two adjacent first alarm groups without correlation into different third alarm groups; wherein, at least one first alarm group of two adjacent first alarm groups with correlation contains only one alarm information.

[0011] Optionally, the characteristic information of the third alarm group also includes the number of alarms or the proportion of the number of alarms of each of the L alarm sources, the number of alarms of the alarm source is equal to the number of alarm messages issued by the alarm source contained in the third alarm group, the proportion of the number of alarms of the alarm source is equal to the ratio between the number of alarm messages issued by the alarm source contained in the third alarm group and the total number of alarm messages contained in the third alarm group, and L is a positive integer.

[0012] In a second aspect, the present application provides an alarm clustering device, which includes: an acquisition unit, used to acquire M alarm information, where M is an integer greater than 1; a processing unit, used to divide the M alarm information into N third alarm groups, where the third alarm group includes one or more adjacent alarm information, and N is an integer greater than 1; the processing unit is also used to determine characteristic information of each third alarm group, the characteristic information of the third alarm group includes a date tag, and the date tag is used to reflect the generation date of the alarm information in the third alarm group; and based on the characteristic information of the N third alarm groups, the N third alarm groups are clustered to obtain multiple cluster sets, and the cluster sets include one or more third alarm groups with the same date tag.

[0013] Optionally, the processing unit is specifically used to: divide the M alarm information into K first alarm groups according to the alarm time of each alarm information in the M alarm information; wherein the first alarm group includes one or more adjacent alarm information; and, for the first alarm group including at least two alarm information, the time interval between the alarm times of any two alarm information in the first alarm group is less than a preset time interval; K is an integer greater than 1; based on a similarity division rule, divide the K first alarm groups into P second alarm groups, the second alarm groups including one or more first alarm groups; the similarity division rule includes: according to two adjacent first alarm groups, Similarity between alarm groups: two adjacent first alarm groups with similarity greater than or equal to a threshold are divided into the same second alarm group, and two adjacent first alarm groups with similarity less than a threshold are divided into different second alarm groups; based on the correlation division rule, P second alarm groups are divided into N third alarm groups; the correlation division rule includes: two adjacent second alarm groups with correlation are divided into the same third alarm group, and two adjacent second alarm groups without correlation are divided into different third alarm groups; wherein, at least one second alarm group of two adjacent second alarm groups with correlation contains only one alarm information.

[0014] Optionally, the processing unit is also used to: if the i-th second alarm group contains only one alarm information, then determine whether the alarm source of the alarm information in the i-th second alarm group is the same as the alarm source of the alarm information with the latest alarm time in the i-1-th second alarm group, where i is a positive integer less than or equal to P; if they are the same, determine that the i-th second alarm group is associated with the i-1-th second alarm group; if they are not the same, then determine whether the alarm source of the alarm information in the i-th second alarm group is the same as the alarm source of the alarm information with the earliest alarm time in the i+1-th second alarm group; if they are the same, determine that the i-th second alarm group is associated with the i+1-th second alarm group.

[0015] Optionally, the processing unit is specifically used to: divide the M alarm information into K first alarm groups according to the alarm time of each alarm information in the M alarm information; wherein the first alarm group includes one or more adjacent alarm information; and, for a first alarm group containing at least two alarm information, the time interval between the alarm times of any two alarm information in the first alarm group is less than a preset time interval; K is an integer greater than 1; based on a correlation division rule, divide the K first alarm groups into N third alarm groups; the correlation division rule includes: dividing two adjacent first alarm groups with correlation into the same third alarm group, and dividing two adjacent first alarm groups without correlation into different third alarm groups; wherein, at least one first alarm group among two adjacent first alarm groups with correlation contains only one alarm information.

[0016] Optionally, the characteristic information of the third alarm group also includes the number of alarms or the proportion of the number of alarms of each of the L alarm sources, the number of alarms of the alarm source is equal to the number of alarm messages issued by the alarm source contained in the third alarm group, the proportion of the number of alarms of the alarm source is equal to the ratio between the number of alarm messages issued by the alarm source contained in the third alarm group and the total number of alarm messages contained in the third alarm group, and L is a positive integer.

[0017] According to a third aspect, an alarm clustering device is provided, which includes one or more processors and a memory; wherein the memory stores one or more computer programs, and the one or more computer programs include instructions, which, when executed by the alarm clustering device, enable the alarm clustering device to execute any one of the methods provided in the first aspect.

[0018] According to a fourth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and when the computer instructions are executed on a computer, the computer executes any one of the methods provided in the first aspect.

[0019] The technical effects brought about by any possible solution in the second to fourth aspects mentioned above can be referred to in the corresponding beneficial effect analysis in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 A schematic diagram of an alarm management system provided in an embodiment of the present application;

[0021] Figure 2 A flowchart of an alarm clustering method provided in an embodiment of the present application;

[0022] Figure 3 A flowchart of another alarm clustering method provided in an embodiment of the present application;

[0023] Figure 4 A flowchart of another alarm clustering method provided in an embodiment of the present application;

[0024] Figure 5 A schematic diagram of the composition of an alarm clustering device provided in an embodiment of the present application;

[0025] Figure 6 A schematic diagram of the hardware structure of an alarm clustering device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0027] The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, unless otherwise specified, "plurality" means two or more.

[0028] In the description of this application, it should be noted that, unless otherwise clearly specified and limited, the terms "connected" and "connection" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to specific circumstances. In addition, when describing a pipeline, the "connected" and "connection" used in this application have the meaning of conduction. The specific meaning needs to be understood in conjunction with the context.

[0029] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0030] As described in the background technology, in the communication network operation and maintenance scenario, it is very important to find the root cause in time and repair it quickly, and clustering the alarm information is one of the key steps to quickly locate the fault. The existing alarm clustering method based on the K-means algorithm obtains the initial cluster center by weighting, outlier deletion, density calculation, etc., and there will be a situation where alarm information with extremely large alarm time intervals and extremely different alarm types are clustered into the same cluster set, which will lead to inaccurate clustering results.

[0031] In view of this, an embodiment of the present application provides an alarm clustering method, the method comprising: obtaining M alarm information, where M is an integer greater than 1; dividing the M alarm information into N third alarm groups, where the third alarm group includes one or more adjacent alarm information, and N is an integer greater than 1; determining characteristic information of each third alarm group, the characteristic information of the third alarm group includes a date tag, and the date tag is used to reflect the generation date of the alarm information in the third alarm group; clustering the N third alarm groups according to the characteristic information of the N third alarm groups to obtain multiple cluster sets, and the cluster sets include one or more third alarm groups with the same date tag.

[0032] In an embodiment of the present application, the third alarm group includes one or more adjacent alarm information, and the characteristic information of the third alarm group includes a date tag, so the alarm information in each cluster set obtained based on the method has a high correlation in the alarm time dimension. In addition, the cluster set obtained in the present application includes one or more third alarm groups with the same date tag, that is, the alarm information with different generation dates will not be clustered together in the present application. Therefore, the embodiment of the present application can improve the accuracy of the alarm clustering results, so that the operation and maintenance personnel can more accurately find the correlation rules between the alarm information and the alarm root cause in each cluster set according to the clustering results, and provide assistance for the subsequent alarm root cause location search, thereby improving the operation and maintenance efficiency.

[0033] For example, Figure 1 Figure 1 is a schematic diagram of the alarm management system. Figure 1 As shown, the alarm management system includes a communication network and an alarm management device.

[0034] Exemplarily, the communication network includes at least one network element, and each network element can generate alarm information during operation. The network element can be any object that needs to be managed in the communication network. In one example, the network element can be implemented by software, such as a virtual machine, a container, an application, a service, a microservice, a module, a submodule, a class or a function, etc. The network element can be software running in one device or a collection of software running in multiple devices. In another example, the network element can also be implemented by hardware, which can be a server, a base station, a switch, a router, a relay, a bridge, a firewall, a mobile terminal, a personal computer, a laptop computer, a disk, a solid state drive (SSD), a disk array (RAID), a storage area network (SAN), an Internet Protocol (IP) SAN, a Fiber Channel (FC) SAN, a network attached storage (NAS), a load balancer, a mobility management entity (MME), a home subscriber server (HSS), a serving-gateway (SGW), a packet data network gateway (PGW), a policy and charging rules function (PCRF) network element, an optical network terminal (ONT), an optical network unit (ONU), a splitter, an Internet of Things terminal, a sensor, etc.; the network element can be implemented by an independent hardware or by multiple hardwares connected by a wired or wireless network. This embodiment does not limit the specific form of the network element.

[0035] Exemplarily, the alarm management device may be an electronic device with data processing capabilities, such as a computing device or a computing device cluster. It may be used to receive alarm information reported by each network element in the communication system and manage the received alarm information. Specifically, the alarm management device may be connected to the communication system. When any network element in the communication system generates alarm information, the network element may send the alarm information to the alarm management device. The alarm management device may receive the alarm information sent by the network element so as to process the alarm information. Among them, the alarm management device may store a large amount of alarm information through its own or external storage medium.

[0036] It should be noted that the executor of the alarm clustering method provided in the embodiment of the present application is an alarm clustering device, which may be the above-mentioned alarm management device, or may be the central processing unit (CPU) of the above-mentioned alarm management device.

[0037] It should be understood that Figure 1 This is only an exemplary system architecture, which is provided for ease of understanding only and should not limit the scope of application of this application.

[0038] The embodiments provided in this application are described in detail below in conjunction with the accompanying drawings.

[0039] like Figure 2 As shown, the embodiment of the present application provides an alarm clustering method, which includes the following steps:

[0040] S101. An alarm clustering device obtains M alarm information.

[0041] Among them, the alarm information can be regarded as a response generated by the network element to the detected abnormal event. When the network element in the network system detects an abnormal event, it will generate notification information, and the notification information is the alarm information in the embodiment of the present application.

[0042] Optionally, an alarm message may include an alarm source and an alarm time of the alarm message.

[0043] The alarm source of an alarm message is the network element that generates the alarm message. In addition, the alarm time is the time when the alarm message occurs, that is, the time when the alarm source corresponding to the alarm message occurs an abnormal event.

[0044] It should be understood that an alarm message may also include other information besides the alarm source and alarm time, such as one or more of the alarm characteristics such as alarm type, alarm name, location information and topology information, and the embodiments of the present application are not limited to this.

[0045] Wherein, M is an integer greater than 1.

[0046] It should be noted that the alarm clustering device can obtain all historical alarm information within a period of time to perform alarm clustering, so that the operation and maintenance personnel can find the correlation between the alarm information in each cluster set and the root cause of the fault according to the clustering results. Exemplarily, the alarm clustering device obtains all alarm information within 5 days, 1 week, 1 month or other reasonable time periods, and the above M is the number of alarm information within these 5 days, 1 week, 1 month or other reasonable time periods.

[0047] In some embodiments, the alarm clustering device may obtain raw alarm data within a period of time, and extract multiple alarm information from the raw alarm data.

[0048] Optionally, if the above-mentioned original alarm data is a spreadsheet file (such as an Excel workbook) in the form of multiple sheet objects and multiple headers, the alarm clustering device can convert the spreadsheet file in the form of multiple sheet objects and multiple headers into a spreadsheet file in the form of a single sheet object and a single header.

[0049] Optionally, the alarm clustering device may concatenate the original alarm data of multiple sheet objects into a same sheet object, so that the original alarm data may be stored as a spreadsheet file including a single sheet object.

[0050] Exemplarily, if the original alarm data includes sheet1 (as shown in Table 1) and sheet2 (as shown in Table 2), the alarm clustering device may determine that the original alarm data is a spreadsheet file of multiple sheet objects.

[0051] Therefore, the alarm clustering device can convert the original alarm data into the alarm data shown in Table 3.

[0052] Table 1

[0053] Route-name 1xxx-2xxx Port-id Error-type Handle-time Port-level 1111-1-11 R_LOS 2019 / 09 / 11 8:55:51 5.5

[0054] Table 2

[0055] Route-name 3xxx-4xxx Port-id Error-type Handle-time Port-level 2222-2-22 REM_SF 2019 / 09 / 11 8:56:51 6.5

[0056] Table 3

[0057] Route-name 1xxx-2xxx Port-id Error-type Handle-time Port-level 1111-1-11 R_LOS 2019 / 09 / 11 8:55:51 5.5 Route-name 3xxx-4xxx Port-id Error-type Handle-time Port-level 2222-2-22 REM_SF 2019 / 09 / 11 8:56:51 6.5

[0058] Furthermore, after splicing the original alarm data of multiple sheet objects into an electronic spreadsheet file including a single sheet object, the alarm clustering device may convert the original alarm data into single-header data.

[0059] Exemplarily, the original alarm data shown in Table 1 and Table 2 are also the above-mentioned multi-header data. As shown in Table 1, the "Route-name" in the first row and the first column is the header of the first row of data, and the header of such a row of data can be called a first-class header. In addition, the "Port-id" in the first column of the second row is the header of the data "1111-1-11" in the first column, the "Error-type" in the second row and the second column is the header of the data "R_LOS" in the second column, the "Handle-time" in the third column of the second row is the header of the data "2019 / 09 / 11 8:55:51" in the third column, and the "Port-level" in the fourth column of the second row is the header of the data "5.5" in the first column. Except for the first row of data, "Port-id", "Error-type", "Handle-time" and "Port-level" are respectively the header of the first column of data, the header of the second column of data, the header of the third column of data, and the header of the fourth column of data. The header of this type of column of data can be called the second type of header.

[0060] Among them, data having both the first type header and the second type header as shown in Table 1 and Table 2 is multi-header data. In addition, data having only the first type header or only the second type header is single-header data. Since the alarm clustering device cannot directly identify the multi-header data shown in Table 1 and Table 2, the alarm clustering device needs to convert the multi-header data into single-header data.

[0061] Exemplarily, after the alarm clustering device converts the original alarm data shown in Tables 1 and 2 into a spreadsheet file including a single sheet object as shown in Table 2, the alarm clustering device can execute the following steps S1-S5 to further convert the alarm data shown in Table 3 (including alarm data in the form of a single sheet object and multiple headers) into single header data as shown in Table 4.

[0062] S1. Convert the data in Table 3 into a list.

[0063] Exemplarily, the data in Table 3 above may be converted into a list format as follows:

[0064] "Route-name,1XXX-2XXX,\n,Port-id,Error-type,Handle-time,

[0065] Port-level,\n,1111-1-11,R_LOS,2019 / 09 / 11 8:55:51,5.5,\n,

[0066] Route-name,3XXX-4XXX,\n,Port-id,Error-type,Handle-time,Port-level,\n,2222-2-22,REM_SF,2019 / 09 / 11 8:56:51,6.5,\n”

[0067] S2. Convert the table header "Route-name" in Table 3 into the form of key-value.

[0068] Among them, key-value is a data form that exists in the form of key-value pairs, and each key corresponds to a unique value.

[0069] For example, the key value may be the header "Route-name" of the first row of data in Table 3, and the value value may be "1xxx-2xxx" in the first row of data in Table 3. In addition, the key value may also be the header "Route-name" of the fourth row of data in Table 3, and the value value may be "1xxx-2xxx" in the first row of data in Table 3.

[0070] S3. Read the next row of data where the key value is located (that is, the second type of header in Table 3), and insert the key value after the last string of the row of data.

[0071] Exemplarily, the second row of data in Table 4 is "Port-id, Error-type, Handle-time, Port-level, \n". If the key value is inserted after the last string of the row of data, it will be "Port-id, Error-type, Handle-time, Port-level, Route-name, \n".

[0072] S4. Read the data between the row where the key value is located and the row where the next key value is located (that is, the third row of data in Table 3), and insert the value value after the last string of each row of data.

[0073] For example, the third row of data in Table 3 is "1111-1-11, R_LOS, 2019 / 09 / 118:55:51, 5.5, \n". The value is inserted after the last string of the row of data, then it is "1111-1-11, R_LOS, 2019 / 09 / 118:55:51, 5.5, 1xxx-2xxx, \n".

[0074] S5. Repeat the above steps S1-S4 until the last row of data in Table 3 is converted. The changed list data is written into a new electronic spreadsheet, as shown in Table 4.

[0075] Table 4

[0076] Port-id Error-type Handle-time Port-level Route-name 1111-1-11 R_LOS 2019 / 09 / 11 8:55:51 5.5 1xxx-2xxx 2222-2-22 REM_SF 2019 / 09 / 11 8:56:51 6.5 3xxx-4xxx

[0077] Optionally, the alarm clustering device may also remove a large amount of noise signals from the acquired original alarm data to obtain multiple alarm information.

[0078] Specifically, the large amount of noise signals mentioned above may include repeated alarm information, frequent alarm information in the original alarm data, or other useless alarm information that can be screened out based on alarm features such as alarm time, alarm source, alarm name, positioning information or topology information.

[0079] It should be understood that the alarm clustering device filters the original alarm data to remove a large amount of noise signals in the original alarm data, which can eliminate invalid data and reduce the computational complexity, thereby making the alarm clustering result more accurate.

[0080] S102: The alarm clustering device divides the M alarm information into N third alarm groups.

[0081] The third alarm group includes one or more adjacent alarm information, and N is an integer greater than 1.

[0082] In some embodiments, the alarm clustering device may divide the M alarm information into K first alarm groups according to the alarm time of each alarm information in the M alarm information.

[0083] The first alarm group includes one or more adjacent alarm information; and, for the first alarm group including at least two alarm information, the time interval between the alarm times of any two alarm information in the first alarm group is less than the preset time interval; K is an integer greater than 1.

[0084] The above-mentioned preset time interval can be 2 minutes, 3 minutes, 5 minutes or other reasonable durations. Exemplarily, when the preset time interval can be 2 minutes, if the alarm time of alarm information 1 is 2021-11-01 00:00:20, the alarm time of alarm information 2 is 2021-11-01 00:00:45, the alarm time of alarm information 3 is 2021-11-01 00:01:20, and the alarm time of alarm information 4 is 2021-11-01 00:05:10. Since the time interval between any two alarm information between alarm information 1, alarm information 2 and alarm information 3 is less than 2 minutes, the alarm clustering device can determine that alarm information 1, alarm information 2 and alarm information 3 belong to a first alarm group, while alarm information 4 does not belong to the first alarm group.

[0085] Furthermore, the alarm clustering device may adopt a preset division rule to divide the K first alarm groups into N third alarm groups.

[0086] Optionally, the above-mentioned preset division rules include similarity division rules and association division rules.

[0087] S103: The alarm clustering device determines characteristic information of each third alarm group.

[0088] The characteristic information of the third alarm group includes a date tag, and the date tag is used to reflect the generation date of the alarm information in the third alarm group.

[0089] Exemplarily, if the third alarm group includes alarm information 1, alarm information 2, and alarm information 3, the alarm time of alarm information 1 is 2021-11-01 00:00:20, the alarm time of alarm information 2 is 2021-11-01 00:00:45, and the alarm time of alarm information 3 is 2021-11-01 00:01:20. Thus, the alarm clustering device can determine that the date label of the third alarm group is 2021-11-01.

[0090] Optionally, the characteristic information of the third alarm group also includes the number of alarms or the proportion of the number of alarms of each alarm source among the L alarm sources.

[0091] Among them, the number of alarms of the alarm source is equal to the number of alarm information sent by the alarm source contained in the third alarm group, and the proportion of the number of alarms of the alarm source is equal to the ratio between the number of alarm information sent by the alarm source contained in the third alarm group and the total number of alarm information contained in the third alarm group. In addition, L is a positive integer, and L is the number of alarm source alarms in the M alarm information obtained by the alarm clustering device.

[0092] Exemplarily, in the case that the alarm sources of M alarm information obtained by the alarm clustering device include 5 types, namely network element 1, network element 2, network element 3, network element 4 and network element 5, if a third alarm group has a total of 8 alarm information, of which the alarm source of 3 alarm information is network element 1, the alarm source of 4 alarm information is network element 3, and the alarm source of 1 alarm information is network element 4, then the alarm number of each alarm source of the third alarm group can be expressed as (3, 0, 4, 1, 0), or the proportion of the alarm number of each alarm source can be expressed as (0.375, 0, 0.5, 0.125, 0).

[0093] Optionally, the characteristic information of the third alarm group also includes a time tag.

[0094] The time label corresponding to the third alarm group is related to the alarm time included in the third alarm group.

[0095] Exemplarily, the alarm clustering device may arrange the alarm information in the third alarm group in chronological order, and the time label corresponding to the third alarm group is determined according to the alarm time of the first alarm information in the third alarm group.

[0096] Exemplarily, if the alarm information in a first alarm group includes alarm information 1, alarm information 2 and alarm information 3, the alarm time of alarm information 1 is 2021-11-01 00:01:20, the alarm time of alarm information 2 is 2021-11-01 00:00:20, and the alarm time of alarm information 3 is 2021-11-01 00:00:45, the alarm information in the first alarm group is arranged in chronological order as alarm information 2, alarm information 3 and alarm information 1, then the time mark group corresponding to the first alarm can be the alarm time of alarm information 2 2021-11-01 00:00:20.

[0097] S104. The alarm clustering device clusters the N third alarm groups according to the characteristic information of the N third alarm groups to obtain a plurality of cluster sets.

[0098] A cluster set includes one or more third alarm groups having the same date label.

[0099] In some embodiments, the alarm clustering device may cluster the N third alarm groups according to the characteristic information of the N third alarm groups using an improved k-means clustering algorithm to obtain a plurality of cluster sets.

[0100] Among them, the k-means clustering algorithm is an iterative clustering analysis algorithm. Due to its simplicity and efficiency, it has become the most widely used algorithm among all clustering algorithms.

[0101] In some embodiments, the alarm clustering device may perform clustering processing on the N third alarm groups by following steps a to f to obtain multiple cluster sets:

[0102] Step a: The alarm clustering device generates a first feature vector of each third alarm group according to feature information of the N third alarm groups.

[0103] In some embodiments, the first feature vector may include multiple dimensions, wherein the value of each dimension in the first feature vector may be determined according to the feature information of each third alarm group.

[0104] Exemplarily, if the time label of a third alarm group is 2021-11-01 00:00:20, the alarm clustering device can determine that the value of the first dimension of the first feature vector of the first alarm group is 20211101000020.

[0105] Further, when the alarm sources among the M alarm information obtained by the alarm clustering device are 5 types, namely network element 1, network element 2, network element 3, network element 4 and network element 5, the values ​​of the second dimension, third dimension, fourth dimension, fifth dimension and sixth dimension of the first characteristic vector of the third alarm group are respectively the number or proportion of alarm information in the third alarm group whose alarm sources are network element 1, network element 2, network element 3, network element 4 and network element 5. If the third alarm group has a total of 8 alarm information, of which the alarm source of 3 alarm information is network element 1, the alarm source of 4 alarm information is network element 3, and the alarm source of 1 alarm information is network element 4, the alarm clustering device can determine that the time vector corresponding to the third alarm group is (20211101000020,3,0,4,1,0) or (20211101000020,0.375,0,0.5,0.125,0).

[0106] It should be understood that the above-mentioned method of determining the first feature vector corresponding to the third alarm group is only an example, and the first feature vector can also be generated by other methods, and the present application does not impose any limitation on this.

[0107] Step b: The alarm clustering device determines the initial cluster center under each date label, and determines the first eigenvector of the initial cluster center.

[0108] Exemplarily, the alarm clustering device may obtain all date tags and determine all third alarm groups with the same date tags. The alarm clustering device may select one or more third alarm groups from all third alarm groups with the same date tags as initial clustering centers. Thus, one date tag may correspond to one or more initial clustering centers.

[0109] The number of initial cluster centers corresponding to a date label can be manually set. For example, for all third alarm groups with a date label of 20211101, if the number of alarm fault processing times on November 1, 2021 corresponding to the date label is K times, the alarm clustering device can randomly select K third alarm groups from all third alarm groups with a date label of 20211101 as initial cluster centers.

[0110] It should be understood that the number of initial cluster centers corresponding to each date label may be the same or different.

[0111] It should be noted that for the same fault, the network element can generate multiple alarm information, the time interval between the alarm times of these alarm information will not be too large, and usually, the multiple alarm information caused by the same fault root cause have the same generation date. Therefore, the alarm clustering device obtains one or more initial cluster centers on the same day (that is, the same date label), and further performs clustering operations, and the obtained cluster set will include one or more third alarm groups with the same date label, so that the clustering result is more accurate.

[0112] Step c: for each of the N third alarm groups, after determining multiple initial cluster centers, the alarm clustering device can first determine the initial cluster center with the same date label as the third alarm group; thereafter, the alarm clustering device can determine the distance between the third alarm group and each initial cluster center under the same date label, and divide the third alarm group into the cluster set where the initial cluster center corresponding to the minimum distance is located.

[0113] Thus, the alarm clustering device can obtain multiple initial clustering sets.

[0114] The distance between the third alarm group and the initial cluster center can be calculated based on the first eigenvector of the third alarm group and the first eigenvector of the initial cluster center. The distance between the third alarm group and the initial cluster center can be Euclidean distance, Chebyshev distance, Chebyshev distance, etc., which is not limited in this embodiment.

[0115] Step d: For each of the multiple initial cluster sets, the alarm clustering device may re-determine a new cluster center in the initial cluster set according to the first feature vector of each third alarm group in the initial cluster set.

[0116] Exemplarily, the alarm clustering device may calculate the mean of each first feature vector in an initial clustering set as the new clustering center of the initial clustering set.

[0117] Step e: After determining the new cluster centers in each initial cluster set, the alarm clustering device can divide each third alarm group into the cluster set where the new cluster center corresponding to the minimum distance is located again by the minimum distance. Thus, the alarm clustering device can obtain multiple new cluster sets.

[0118] Step f: The alarm clustering device may continuously and iteratively obtain new cluster centers and new cluster sets until a preset termination condition is met.

[0119] The preset termination condition may include that no third alarm group is reallocated to a different cluster set, the cluster center no longer changes, and the sum of squared errors is locally minimized.

[0120] Optionally, after the alarm clustering device obtains multiple cluster sets, the alarm information in each cluster set may be determined according to the third alarm group in each cluster set.

[0121] For each cluster set, a cluster set includes one or more third alarm groups, a third alarm group includes one or more alarm information, and a cluster set includes one or more alarm information. The alarm clustering device can add a clustering label to each alarm information in a cluster set to indicate the cluster set to which the alarm information belongs.

[0122] Exemplarily, after determining each alarm information in multiple cluster sets, the alarm clustering device may add a cluster identifier of the cluster set to which each alarm information belongs. For example, the cluster identifier may be cluster set 1, cluster set 2, ..., for distinguishing alarm information in different cluster sets.

[0123] Furthermore, the alarm clustering device can store the alarm information with the same clustering identifier together according to the clustering identifier of each alarm information. For example, the alarm information with the same clustering identifier can be stored in the same sheet object of a spreadsheet file, so as to intuitively display each clustering result, which is convenient for operation and maintenance personnel to view and analyze.

[0124] The technical solution provided by the present application brings at least the following beneficial effects: on the one hand, since the third alarm group includes one or more adjacent alarm information, and the characteristic information of the third alarm group includes a date tag, the alarm information in each cluster set obtained based on the method has a high correlation in the alarm time dimension. On the other hand, the cluster set obtained in the present application includes one or more third alarm groups with the same date tag, that is, the alarm information with different generation dates will not be clustered together in the present application. Therefore, the embodiment of the present application can improve the accuracy of the alarm clustering results, so that the operation and maintenance personnel can more accurately find the correlation rules between the alarm information and the alarm root cause in each cluster set according to the clustering results, and provide assistance for the subsequent alarm root cause location search, thereby improving the operation and maintenance efficiency.

[0125] In some embodiments, according to Figure 2 In the embodiment shown in FIG. 1 , if the preset division rule includes a similarity division rule and a correlation division rule, then Figure 3 As shown, the above step S102 can be specifically implemented as follows:

[0126] S1021. The alarm clustering device divides the M alarm information into K first alarm groups according to the alarm time of each alarm information in the M alarm information.

[0127] Optionally, after the alarm clustering device divides the M alarm information into K first alarm groups, it may add a group identifier corresponding to the first alarm group to which the alarm information belongs to each alarm information.

[0128] Exemplarily, the group identifier of the first alarm group can be a digital identifier such as 1, 2, 3, or an alphabetic identifier such as a, b, c, or a text identifier such as the first group, the second group, the third group, etc., and this application does not limit this.

[0129] S1022: The alarm clustering device divides the K first alarm groups into P second alarm groups based on a similarity division rule.

[0130] Among them, the second alarm group includes one or more first alarm groups, and the above-mentioned similarity division rules include: according to the similarity between two adjacent first alarm groups, two adjacent first alarm groups with a similarity greater than or equal to a threshold are divided into the same second alarm group, and two adjacent first alarm groups with a similarity less than a threshold are divided into different second alarm groups.

[0131] In some embodiments, the alarm clustering device may determine the second characteristic information of each first alarm group, and determine the similarity between every two adjacent first alarm groups based on the second characteristic information of each first alarm group.

[0132] Optionally, the second characteristic information of the first alarm group may be determined according to the alarm source of each alarm information in the alarm.

[0133] Exemplarily, the second characteristic information of the first alarm group may include multiple dimensions, wherein the value of the first dimension of the second characteristic vector may be determined according to the group identifier of each first alarm group, and the values ​​of other dimensions of the second characteristic vector may be determined according to the alarm source of each alarm information in the first alarm group.

[0134] Exemplarily, the alarm clustering device can preset corresponding values ​​for group identifiers, for example, group identifier 1, a or the first group can correspond to value 1, group identifier 2, b or the second group can correspond to value 2, etc. For any first alarm group, the alarm clustering device can search for the preset corresponding value of the group identifier according to its group identifier, and use it as the value of the first dimension of the feature vector of the second alarm group.

[0135] In addition, when the alarm sources of the M alarm information obtained by the alarm clustering device include 5 types, namely network element 1, network element 2, network element 3, network element 4 and network element 5, at this time, the values ​​of the second dimension, third dimension, fourth dimension, fifth dimension and sixth dimension of the second characteristic vector of each first alarm group are respectively the number of network element 1, network element 2, network element 3, network element 4 and network element 5 corresponding to the alarm sources of the alarm information in each first alarm group.

[0136] If a first alarm group has 5 alarm information in total, of which 3 alarm information have alarm sources from network element 1, 1 alarm information has alarm source from network element 2, and 1 alarm information has alarm source from network element 4. And the group label of the first alarm group is 2, the alarm clustering device can determine that the feature vector of the first alarm group is (2, 3, 1, 0, 1, 0).

[0137] Furthermore, after determining the characteristic vectors of each first alarm group, the alarm clustering device can sort all the first alarm groups in chronological order according to the alarm time of the alarm information they include, and further calculate the similarity of the second characteristic vectors of each two adjacent first alarm groups to determine the similarity between each two adjacent first alarm groups.

[0138] Optionally, the similarity between the feature vectors may be obtained by, but not limited to, cosine similarity, Euclidean distance, Chebyshev distance, Chebyshev distance, etc., which is not limited in this embodiment.

[0139] Furthermore, the alarm clustering device divides two adjacent first alarm groups whose similarity is greater than or equal to a threshold into the same second alarm group, and divides two adjacent first alarm groups whose similarity is less than the threshold into different second alarm groups.

[0140] Among them, the above preset threshold can be preset according to historical alarm data.

[0141] Optionally, after the alarm clustering device classifies two second alarm groups with similarities greater than a preset threshold into one third alarm group, the group identifier of each alarm information in the two second alarm groups may be changed to the same group identifier.

[0142] S1023: The alarm clustering device divides the P second alarm groups into N third alarm groups based on a correlation division rule.

[0143] Among them, the correlation division rules include: dividing two adjacent second alarm groups with correlation into the same third alarm group, and dividing two adjacent second alarm groups without correlation into different third alarm groups; and at least one second alarm group among the two adjacent second alarm groups with correlation contains only one alarm information.

[0144] In some embodiments, the alarm clustering device may determine whether two adjacent second alarm groups are associated by performing the following steps 1 to 4:

[0145] Step 1: If the i-th second alarm group contains only one alarm information, the alarm clustering device determines whether the alarm source of the alarm information in the i-th second alarm group is the same as the alarm source of the alarm information with the latest alarm time in the i-1-th second alarm group, where i is a positive integer less than or equal to P.

[0146] Step 2: If they are the same, the alarm clustering device determines that there is a correlation between the i-th second alarm group and the i-1-th second alarm group.

[0147] Step 3: If they are not the same, the alarm clustering device determines whether the alarm source of the alarm information in the i-th second alarm group is the same as the alarm source of the alarm information with the earliest alarm time in the i+1-th second alarm group.

[0148] Step 4: If they are the same, determine that there is a correlation between the i-th second alarm group and the (i+1)-th second alarm group.

[0149] It should be noted that if the second alarm group includes only one alarm information, due to the small amount of alarm information, the clustering result of the time vector of the second alarm group is highly random and difficult to control, and the error may be large. Therefore, the alarm clustering device divides the P second alarm groups into N third alarm groups based on the correlation division rule, which can further improve the accuracy of alarm clustering.

[0150] For example, for each second alarm group, the alarm clustering device can represent each alarm information in the second alarm group in the form of key: value. The key value can be the group identifier corresponding to the alarm information, and the value can be the alarm source of the alarm information. For example, alarm information 1 can be represented as 1 (key): network element 1 (value).

[0151] Optionally, the alarm clustering device may identify a key value of each alarm message. If a key value appears only once in all the alarm messages, the alarm clustering device may determine that the second alarm group to which the alarm message corresponding to the key value belongs includes only one alarm message.

[0152] Furthermore, for each second alarm group that includes only one alarm message, the alarm clustering device can identify the value of each alarm message in the second alarm group adjacent to the second alarm group. If the adjacent second alarm group has the same value as an alarm message in the second alarm group, the alarm clustering device can classify the second alarm group and its adjacent second alarm group into a first alarm group.

[0153] In addition, for each second alarm group including only one alarm information, if its adjacent second alarm group does not have the same value as the alarm information in the second alarm group, the alarm clustering device can classify the second alarm group into an independent third alarm group.

[0154] based on Figure 3 In the illustrated embodiment, the alarm clustering device can divide M alarm information into K first alarm groups according to the alarm time, and further merge the first alarm groups according to the similarity division rule and the correlation division rule, which can further improve the accuracy of alarm clustering.

[0155] In some embodiments, according to Figure 2 In the embodiment shown, if the preset division rule includes a relevance division rule, then Figure 4 As shown, the above step S102 can be specifically implemented as follows:

[0156] S1024. The alarm clustering device divides the M alarm information into K first alarm groups according to the alarm time of each alarm information in the M alarm information.

[0157] The first alarm group includes one or more adjacent alarm information; and, for the first alarm group including at least two alarm information, the time interval between the alarm times of any two alarm information in the first alarm group is less than the preset time interval; K is an integer greater than 1.

[0158] S1025. The alarm clustering device divides the K first alarm groups into N third alarm groups based on a correlation division rule.

[0159] Among them, the correlation division rules include: dividing two adjacent first alarm groups with correlation into the same third alarm group, and dividing two adjacent first alarm groups without correlation into different third alarm groups; among them, at least one first alarm group among the two adjacent first alarm groups with correlation contains only one alarm information.

[0160] Optionally, the alarm clustering device may determine the correlation between two adjacent first alarm groups according to the alarm sources of the alarm information in each first alarm group.

[0161] In one implementation, the alarm clustering device may perform the following steps 1 to 4 to determine whether two adjacent first alarm groups are associated with each other:

[0162] Step 1: If the xth first alarm group contains only one alarm information, the alarm clustering device determines whether the alarm source of the alarm information in the xth first alarm group is the same as the alarm source of the alarm information with the latest alarm time in the x-1th first alarm group, where x is a positive integer less than or equal to K.

[0163] Step 2: If they are the same, the alarm clustering device determines that there is a correlation between the xth first alarm group and the x-1th first alarm group.

[0164] Step 3: If they are not the same, the alarm clustering device determines whether the alarm source of the alarm information in the xth first alarm group is the same as the alarm source of the alarm information with the earliest alarm time in the x+1th first alarm group.

[0165] Step 4: If they are the same, determine that there is a correlation between the xth first alarm group and the x+1th first alarm group.

[0166] Optionally, the alarm clustering device can identify all the first alarm groups of K first alarm groups that contain only one alarm message. For each first alarm group that contains only one alarm message, the high alarm station type device can further perform the above steps 1 to 4 to determine whether there is a correlation between the first alarm group and its adjacent first alarm group. And divide the two adjacent first alarm groups with correlation into the same third alarm group, and divide the two adjacent first alarm groups without correlation into different third alarm groups.

[0167] based on Figure 4 In the illustrated embodiment, the alarm clustering device can divide M alarm information into K first alarm groups according to the alarm time, and further merge the first alarm groups according to the correlation division rule, so as to reduce the complexity of alarm clustering.

[0168] The above mainly introduces the solution provided by the present application from the perspective of the method. It can be understood that in order to realize the above functions, the alarm clustering device includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the algorithm steps of each example described in the embodiments disclosed herein, the present invention can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0169] The present application can divide the functional modules of the alarm clustering device according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation.

[0170] Figure 5 FIG. 1 is a schematic diagram showing the composition of an alarm clustering device provided in an embodiment of the present application. Figure 5 As shown, the alarm clustering device 1000 includes an acquisition unit 1001 and a processing unit 1002 .

[0171] The acquisition unit 1001 is used to obtain M alarm information, where M is an integer greater than 1.

[0172] Processing unit 1002, for dividing M alarm information into N third alarm groups, the third alarm group includes one or more adjacent alarm information, N is an integer greater than 1.

[0173] The processing unit 1002 is also used to determine characteristic information of each third alarm group, the characteristic information of the third alarm group includes a date tag, and the date tag is used to reflect the generation date of the alarm information in the third alarm group; and based on the characteristic information of the N third alarm groups, the N third alarm groups are clustered to obtain multiple cluster sets, and the cluster sets include one or more third alarm groups with the same date tag.

[0174] Optionally, the processing unit 1002 is specifically used to: divide the M alarm information into K first alarm groups according to the alarm time of each alarm information in the M alarm information; wherein the first alarm group includes one or more adjacent alarm information; and, for the first alarm group including at least two alarm information, the time interval between the alarm times of any two alarm information in the first alarm group is less than a preset time interval; K is an integer greater than 1; based on a similarity division rule, divide the K first alarm groups into P second alarm groups, the second alarm groups including one or more first alarm groups; the similarity division rule includes: according to two adjacent first alarm groups, Similarity between alarm groups, two adjacent first alarm groups with similarity greater than or equal to a threshold are divided into the same second alarm group, and two adjacent first alarm groups with similarity less than a threshold are divided into different second alarm groups; based on the correlation division rule, P second alarm groups are divided into N third alarm groups; the correlation division rule includes: two adjacent second alarm groups with correlation are divided into the same third alarm group, and two adjacent second alarm groups without correlation are divided into different third alarm groups; wherein, at least one second alarm group of two adjacent second alarm groups with correlation contains only one alarm information.

[0175] Optionally, the processing unit 1002 is also used to: if the i-th second alarm group contains only one alarm information, then determine whether the alarm source of the alarm information in the i-th second alarm group is the same as the alarm source of the alarm information with the latest alarm time in the i-1-th second alarm group, where i is a positive integer less than or equal to P; if they are the same, determine that the i-th second alarm group is associated with the i-1-th second alarm group; if they are not the same, then determine whether the alarm source of the alarm information in the i-th second alarm group is the same as the alarm source of the alarm information with the earliest alarm time in the i+1-th second alarm group; if they are the same, determine that the i-th second alarm group is associated with the i+1-th second alarm group.

[0176] Optionally, the processing unit 1002 is specifically used to: divide the M alarm information into K first alarm groups according to the alarm time of each alarm information in the M alarm information; wherein the first alarm group includes one or more adjacent alarm information; and, for a first alarm group containing at least two alarm information, the time interval between the alarm times of any two alarm information in the first alarm group is less than a preset time interval; K is an integer greater than 1; based on a correlation division rule, divide the K first alarm groups into N third alarm groups; the correlation division rule includes: dividing two adjacent first alarm groups with correlation into the same third alarm group, and dividing two adjacent first alarm groups without correlation into different third alarm groups; wherein, at least one first alarm group among two adjacent first alarm groups with correlation contains only one alarm information.

[0177] Optionally, the characteristic information of the third alarm group also includes the number of alarms or the proportion of the number of alarms of each of the L alarm sources, the number of alarms of the alarm source is equal to the number of alarm messages issued by the alarm source contained in the third alarm group, the proportion of the number of alarms of the alarm source is equal to the ratio between the number of alarm messages issued by the alarm source contained in the third alarm group and the total number of alarm messages contained in the third alarm group, and L is a positive integer.

[0178] Figure 5 The units in the system may also be referred to as modules. For example, a processing unit may be referred to as a processing module. Figure 5 In the illustrated embodiment, the names of the various units may not be the names shown in the figure. For example, the acquisition unit may also be called a communication unit.

[0179] Figure 5 If each unit in the embodiment is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The storage medium for storing computer software products includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program codes.

[0180] The embodiment of the present application also provides a hardware structure diagram of an alarm clustering device, such as Figure 6 As shown, the alarm clustering device 2000 includes a processor 2001, and optionally, further includes a memory 2002 and a transceiver 2003 connected to the processor 2001. The processor 2001, the memory 2002 and the transceiver 2003 are connected via a bus 2004.

[0181] Processor 2001 may be a central processing unit (CPU), a general-purpose processor network processor (NP), a digital signal processor (DSP), a microprocessor, a microcontroller, a programmable logic device (PLD), or any combination thereof. Processor 2001 may also be any other device having a processing function, such as a circuit, a device, or a software module. Processor 2001 may also include multiple CPUs, and processor 2001 may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. The processor here may refer to one or more devices, circuits, or processing cores for processing data (such as computer program instructions).

[0182] The memory 2002 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of an instruction or data structure and can be accessed by a computer, and the present embodiment of the application does not impose any restrictions on this. The memory 2002 may exist independently or be integrated with the processor 2001. Among them, the memory 2002 may contain a computer program code. The processor 2001 is used to execute the computer program code stored in the memory 2002, so as to realize the method provided in the embodiment of the present application.

[0183] The transceiver 2003 can be used to communicate with other devices or communication networks (such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.) The transceiver 2003 can be a module, a circuit, a transceiver or any device capable of achieving communication.

[0184] The bus 2004 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus 2004 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0185] The embodiment of the present application also provides a computer-readable storage medium, including computer-executable instructions, which, when executed on a computer, enable the computer to execute any one of the methods provided in the above embodiments.

[0186] The embodiment of the present application also provides a computer program product including computer-executable instructions, which, when executed on a computer, enables the computer to execute any one of the methods provided in the above embodiments.

[0187] An embodiment of the present application also provides a chip, including: a processor and an interface, wherein the processor is coupled to a memory via the interface, and when the processor executes a computer program or a computer execution instruction in the memory, any one of the methods provided in the above embodiments is executed.

[0188] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer-executable instructions. When the computer-executable instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer-executable instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer-executable instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, data center, etc. that contains one or more servers that can be integrated with the medium. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state disk (SSD)).

[0189] Although the present application is described herein in conjunction with various embodiments, in the process of implementing the claimed application, those skilled in the art may understand and implement other changes to the disclosed embodiments by viewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "one" or "an" does not exclude multiple situations. A single processor or other unit may implement several functions listed in the claims. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

[0190] Although the present application has been described in conjunction with specific features and embodiments thereof, it is obvious that various modifications and combinations may be made thereto without departing from the spirit and scope of the present application. Accordingly, this specification and the drawings are merely exemplary illustrations of the present application as defined by the appended claims, and are deemed to have covered any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, those skilled in the art may make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

[0191] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. An alarm clustering method, characterized in that: The method comprises: Get M alarm information, where M is an integer greater than 1; According to the alarm time of each alarm information in the M alarm information, the M alarm information is divided into K first alarm groups; wherein the first alarm group includes one or more adjacent alarm information; and, for the first alarm group including at least two alarm information, the time interval between the alarm times of any two alarm information in the first alarm group is less than a preset time interval; K is an integer greater than 1; Based on a similarity division rule, the K first alarm groups are divided into P second alarm groups, where the second alarm groups include one or more first alarm groups; the similarity division rule includes: according to the similarity between two adjacent first alarm groups, two adjacent first alarm groups whose similarity is greater than or equal to a threshold are divided into the same second alarm group, and two adjacent first alarm groups whose similarity is less than a threshold are divided into different second alarm groups; Based on a correlation division rule, the P second alarm groups are divided into N third alarm groups; the correlation division rule includes: dividing two adjacent second alarm groups with correlation into the same third alarm group, and dividing two adjacent second alarm groups without correlation into different third alarm groups; wherein, at least one second alarm group of the two adjacent second alarm groups with correlation contains only one alarm information, and the third alarm group contains one or more adjacent alarm information, and N is an integer greater than 1; Determine characteristic information of each third alarm group, wherein the characteristic information of the third alarm group includes a date tag, and the date tag is used to reflect the generation date of the alarm information in the third alarm group; The N third alarm groups are clustered according to the characteristic information of the N third alarm groups to obtain a plurality of cluster sets, wherein the cluster sets include one or more third alarm groups with the same date label.

2. The method according to claim 1, characterized in that Before dividing the P second alarm groups into N third alarm groups based on the association division rule, the method further includes: If the i-th second alarm group contains only one alarm information, determine whether the alarm source of the alarm information in the i-th second alarm group is the same as the alarm source of the alarm information with the latest alarm time in the i-1-th second alarm group, where i is a positive integer less than or equal to P; If they are the same, it is determined that there is a correlation between the i-th second alarm group and the i-1-th second alarm group; If they are not the same, then determine whether the alarm source of the alarm information in the i-th second alarm group is the same as the alarm source of the alarm information with the earliest alarm time in the i+1-th second alarm group; If they are the same, it is determined that there is a correlation between the i-th second alarm group and the (i+1)-th second alarm group.

3. The method according to claim 1 or 2, characterized in that: The characteristic information of the third alarm group also includes the number of alarms or the proportion of the number of alarms of each alarm source among the L alarm sources, the number of alarms of the alarm source is equal to the number of alarm messages issued by the alarm source and contained in the third alarm group, the proportion of the number of alarms of the alarm source is equal to the ratio between the number of alarm messages issued by the alarm source and contained in the third alarm group to the total number of alarm messages contained in the third alarm group, and L is a positive integer.

4. An alarm clustering device, characterized in that: The device comprises: An acquisition unit, used for acquiring M alarm information, where M is an integer greater than 1; A processing unit, configured to divide the M alarm information into K first alarm groups according to the alarm time of each alarm information in the M alarm information; wherein the first alarm group includes one or more adjacent alarm information; and, for a first alarm group including at least two alarm information, the time interval between the alarm times of any two alarm information in the first alarm group is less than a preset time interval; K is an integer greater than 1; The processing unit is further used to divide the K first alarm groups into P second alarm groups based on a similarity division rule, where the second alarm groups include one or more first alarm groups; the similarity division rule includes: according to the similarity between two adjacent first alarm groups, two adjacent first alarm groups whose similarity is greater than or equal to a threshold are divided into the same second alarm group, and two adjacent first alarm groups whose similarity is less than a threshold are divided into different second alarm groups; The processing unit is further used to divide the P second alarm groups into N third alarm groups based on a correlation division rule; the correlation division rule includes: dividing two adjacent second alarm groups with correlation into the same third alarm group, and dividing two adjacent second alarm groups without correlation into different third alarm groups; wherein at least one second alarm group of the two adjacent second alarm groups with correlation contains only one alarm information, and the third alarm group includes one or more adjacent alarm information, and N is an integer greater than 1; The processing unit is also used to determine characteristic information of each third alarm group, the characteristic information of the third alarm group includes a date tag, and the date tag is used to reflect the generation date of the alarm information in the third alarm group; and according to the characteristic information of the N third alarm groups, the N third alarm groups are clustered to obtain multiple cluster sets, and the cluster sets include one or more third alarm groups with the same date tag.

5. The device according to claim 4, characterized in that The processing unit is further used for: If the i-th second alarm group contains only one alarm information, determine whether the alarm source of the alarm information in the i-th second alarm group is the same as the alarm source of the alarm information with the latest alarm time in the i-1-th second alarm group, where i is a positive integer less than or equal to P; If they are the same, it is determined that there is a correlation between the i-th second alarm group and the i-1-th second alarm group; If they are not the same, then determine whether the alarm source of the alarm information in the i-th second alarm group is the same as the alarm source of the alarm information with the earliest alarm time in the i+1-th second alarm group; If they are the same, it is determined that there is a correlation between the i-th second alarm group and the (i+1)-th second alarm group.

6. The device according to claim 4 or 5, characterized in that The characteristic information of the third alarm group also includes the number of alarms or the proportion of the number of alarms of each alarm source among the L alarm sources, the number of alarms of the alarm source is equal to the number of alarm messages issued by the alarm source and contained in the third alarm group, the proportion of the number of alarms of the alarm source is equal to the ratio between the number of alarm messages issued by the alarm source and contained in the third alarm group to the total number of alarm messages contained in the third alarm group, and L is a positive integer.

Images