Information system-based alarm information identification method, device and equipment

Abstract

The application provides an alarm information identification method, device and equipment based on an information system. The method comprises the following steps: obtaining to-be-identified alarm information; matching the to-be-identified alarm information with an alarm feature set to obtain a corresponding matching result; the alarm feature set comprises a plurality of alarm features, and the alarm feature set is determined based on keywords and a result category of historical alarm information; the result category is used to represent whether the historical alarm information represents that a fault occurs in the information system; the matching result represents whether the to-be-identified alarm information matches the alarm features in the alarm feature set; if it is determined that the matching result represents that the to-be-identified alarm information matches the alarm features in the alarm feature set, the to-be-identified alarm information is determined as valid alarm information. The method of the application can quickly and accurately identify valid alarm information, improves the alarm information screening efficiency, helps relevant staff to find and process corresponding faults in time, and improves the fault processing efficiency of the information system.

Description

TECHNICAL FIELD

[0001] The present application relates to the computer technical field, and particularly relates to an alarm information identification method, device and equipment based on an information system. BACKGROUND

[0002] With the development of computer and network technology, information systems are used more and more widely. When a node in the information system fails, it may affect the normal work of the whole system, and therefore the information system needs to be monitored. When a system failure is detected, an alarm information is sent to remind the relevant staff to perform corresponding fault processing.

[0003] At present, each line in the information system is monitored through a monitoring system, and various monitoring indicators can be customized to carry out flexible and mobile monitoring. With the increasing powerfulness and complexity of the information system, the range, time point, state and indicators monitored by the monitoring system are more and more, and the alarm information generated is more and more, and the content is more and more complicated.

[0004] However, there may be a large amount of invalid alarm information in the alarm information generated by the monitoring system, so that the effective alarm information is submerged, and the relevant staff needs to spend a lot of time to screen out important and urgent alarm information from the alarm information with a large amount and complicated content, the alarm information screening efficiency is low, and then the fault processing efficiency of the information system is affected. SUMMARY

[0005] The present application provides an alarm information identification method, device and equipment based on an information system to solve the problem of low alarm information screening efficiency.

[0006] In a first aspect, the present application provides an alarm information identification method based on an information system, comprising:

[0007] obtaining to-be-identified alarm information;

[0008] matching the to-be-identified alarm information with a preset alarm feature set to obtain a corresponding matching result; the alarm feature set includes a plurality of alarm features, and the alarm feature set is determined based on keywords and result categories of historical alarm information; the result category is used to indicate whether the historical alarm information represents that a failure of the information system occurs; and the matching result represents whether the to-be-identified alarm information matches the alarm features in the alarm feature set;

[0009] if it is determined that the matching result represents that the to-be-identified alarm information matches the alarm features in the alarm feature set, the to-be-identified alarm information is determined as effective alarm information.

[0010] In a second aspect, the present application provides an alarm information recognition device based on an information system, comprising:

[0011] an acquisition module, configured to acquire alarm information to be recognized;

[0012] a matching module, configured to match the alarm information to be recognized with a preset alarm feature set, and obtain a corresponding matching result; the alarm feature set comprises a plurality of alarm features, and the alarm feature set is determined based on keywords and a result category of historical alarm information; the result category is used to indicate whether the historical alarm information indicates that a fault occurs in the information system; and the matching result indicates whether the alarm information to be recognized matches the alarm features in the alarm feature set;

[0013] a determination module, configured to determine that the alarm information to be recognized is valid alarm information if it is determined that the matching result indicates that the alarm information to be recognized matches the alarm features in the alarm feature set.

[0014] In a third aspect, the present application provides a computer device, comprising a processor and a memory connected with the processor in communication; the memory stores computer execution instructions; and the processor executes the computer execution instructions stored in the memory to implement the method according to the first aspect.

[0015] In a fourth aspect, the present application provides a computer readable storage medium, wherein the computer readable storage medium stores computer execution instructions; and the computer execution instructions are executed by a processor to implement the method according to the first aspect.

[0016] In a fifth aspect, the present application provides a computer program product, comprising a computer program; and the computer program is executed by a processor to implement the method according to the first aspect.

[0017] The application provides an alarm information recognition method, device and equipment based on an information system. The method comprises the following steps: obtaining to-be-recognized alarm information; matching the to-be-recognized alarm information with an alarm feature set to obtain a corresponding matching result; the alarm feature set comprises a plurality of alarm features and is determined based on keywords and a result category of historical alarm information; the result category is used to represent whether the historical alarm information represents a fault of the information system; the matching result represents whether the to-be-recognized alarm information matches the alarm features in the alarm feature set; if it is determined that the matching result represents that the to-be-recognized alarm information matches the alarm features in the alarm feature set, the to-be-recognized alarm information is determined as valid alarm information. The alarm feature set objectively reflects features that may have high fault risks and can be used as a basis for evaluating the effectiveness and importance of alarm information. Through the matching result of the alarm information and the alarm feature set, valid alarm information can be quickly and accurately recognized, the alarm information screening efficiency is improved, and relevant staff can find and handle corresponding faults in time, thereby improving the fault handling efficiency of the information system. BRIEF DESCRIPTION OF DRAWINGS

[0018] The accompanying drawings, which are incorporated herein and form a part of the specification, illustrate embodiments consistent with the present application and, together with the description, further serve to explain the principles of the application.

[0019] Figure 1 A flowchart of a method for recognizing alarm information based on an information system in an embodiment;

[0020] Figure 2 A flowchart of a method for obtaining a first alarm feature set in an embodiment;

[0021] Figure 3 A flowchart of a step for extracting keywords based on all historical alarm information to obtain a first keyword set of all historical alarm information in an embodiment;

[0022] Figure 4 A flowchart of a step for obtaining a first alarm feature set according to the keywords and weights in each first feature vector in an embodiment;

[0023] Figure 5 A flowchart of a method for obtaining a second alarm feature set in an embodiment;

[0024] Figure 6 A flowchart of a step for extracting keywords based on all first-class historical alarm information to obtain a second keyword set of all first-class historical alarm information in an embodiment;

[0025] Figure 7 A flowchart of a method for recognizing alarm information based on an information system in an embodiment;

[0026] Figure 8 Structure diagram of an information system based alarm information identification device in an embodiment;

[0027] Figure 9 Structure diagram of an information system based alarm information identification device in an embodiment;

[0028] Figure 10 Structure diagram of a computer device in an embodiment;

[0029] Figure 11 Block diagram of a computer device in an embodiment.

[0030] The specific embodiments of the present application have been shown through the above-described drawings, and will be described in more detail hereinafter. These drawings and written descriptions are not intended to limit the scope of the present application by any means, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0031] The exemplary embodiments will be described in detail herein with reference to the attached drawings. The same reference numbers in different drawings represent the same or similar elements unless otherwise represented. The embodiments described in the following exemplary embodiments do not represent all the embodiments consistent with the present application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the present application as detailed in the appended claims.

[0032] First, the terms involved in the present application are explained:

[0033] Alarm information: refers to the failure related information sent out by the monitoring unit after detecting the failure of the information system;

[0034] Effective alarm information: refers to the alarm information that the relevant staff need to perform certain operations to solve the failure after receiving the failure signal from the monitoring unit;

[0035] Weight: refers to the importance of a certain factor or index relative to a certain thing, which not only reflects the percentage of a certain factor or index, but also emphasizes the relative importance of certain factors or indexes, and is more inclined to contribution or importance.

[0036] The specific application scenario of the present application is a monitoring and alarm system for monitoring and alarming a bank information system. The monitoring and alarm system monitors each line (such as a technology line and a business line) in the bank information system. When a failure (including a hardware failure and a software failure) of the bank information system is detected, corresponding alarm information is sent to remind relevant staff to perform corresponding failure processing.

[0037] With the increasing powerfulness and complexity of the bank information system, the monitoring and alarm system needs to monitor more and more ranges, time points, states and indexes, and generates more and more alarm information with more and more complicated contents. However, a large amount of invalid alarm information may exist in the alarm information generated by the monitoring and alarm system, so that the valid alarm information is submerged. The existing monitoring and alarm system lacks a method for identifying the effectiveness and importance of alarm information, so that the relevant staff needs to spend a lot of time to screen important and urgent alarm information from the alarm information with a large amount and complicated contents, the alarm information screening efficiency is low, and then the failure processing efficiency of the information system is affected.

[0038] The information system-based alarm information identification method, device and equipment provided by the present application are aimed at solving the above technical problems of the prior art.

[0039] The technical solutions of the present application and how the technical solutions of the present application solve the above technical problems will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes can not be described in detail in some embodiments. The embodiments of the present application will be described below with reference to the drawings.

[0040] In one embodiment, as shown in Figure 1 a flowchart of an information system-based alarm information identification method is provided, and the method includes the following steps S101 to S103.

[0041] S101, obtaining alarm information to be identified.

[0042] The execution subject of the present embodiment can be a server, or a terminal, or a system containing a server and a terminal, and is not limited. The present embodiment is introduced with the execution subject being a server where the monitoring and alarm system is located.

[0043] The server obtains alarm information to be identified from the alarm information generated by the monitoring and alarm system. The alarm information to be identified here can be understood as each piece of alarm information generated by the monitoring and alarm system.

[0044] In one example, the server periodically identifies the alarm information generated by the monitoring alarm system, and feeds back the valid alarm information to the relevant staff for processing. For example, the server obtains all the alarm information generated by the monitoring alarm system in the previous day at 9:00 am every day, takes each piece of alarm information as the to-be-identified alarm information, and identifies whether it is valid alarm information.

[0045] In one example, the server periodically identifies the alarm information generated by the monitoring alarm system, and feeds back the valid alarm information to the relevant staff for processing. For example, the server obtains all the alarm information generated by the monitoring alarm system in the previous day at 9:00 am every day, takes each piece of alarm information as the to-be-identified alarm information, and identifies whether it is valid alarm information.

[0046] The historical alarm information refers to the alarm information generated by the monitoring alarm system in the past, and the result category of the historical alarm information is known. The result category of the historical alarm information includes two categories, the first category indicates that the information system has failed, and the second category does not indicate that the information system has failed.

[0047] For example, the first category of historical alarm information can be alarm information containing hardware failure, or webpage error, or payment error, or index anomaly, etc. This kind of alarm information means that the system has indeed failed, and needs to be fed back to the relevant staff for corresponding processing.

[0048] For example, the second category of historical alarm information can include but is not limited to alarm information for testing (alarm information for testing generated by the monitoring alarm system when the to-be-monitored system is first connected to the monitoring alarm system), alarm information lacking key content (such as system name, module name, specific fault description, etc.). This kind of alarm information is not fault information, or it is not determined whether it is fault information, or it has no practical significance for fault solving, and can not be fed back to the relevant staff.

[0049] In one example, the result category of the historical alarm information can be identified by a fault mark. For example, if the relevant staff determines that a certain alarm information indicates that the information system has failed, or performs corresponding fault processing on a certain alarm information, a fault mark is added to the alarm information, which indicates that the alarm information indicates that the information system has failed. Therefore, when a certain historical alarm information carries a fault mark, it is determined that the result category of the historical alarm information is the first category.

[0050] The keywords of the historical alarm information can be understood as words that are important for distinguishing the result categories. For example, if an alarm information contains one or more keywords that are more inclined to a first result category, the alarm information is more likely to be an alarm information representing a failure of the information system, i.e., the alarm information can be considered as an effective alarm information that needs to be fed back to the relevant staff for corresponding processing.

[0051] The alarm feature set is determined based on the keywords of the historical alarm information and the result categories. Each alarm feature in the alarm feature set can be a keyword selected from the keywords of the historical alarm information, or a keyword combination composed of multiple keywords selected from the keywords of the historical alarm information, which objectively reflects the features that may have a high failure risk and can be used as a basis for evaluating the effectiveness and importance of the alarm information.

[0052] In an example, matching the to-be-identified alarm information with the alarm feature set includes matching the to-be-identified alarm information with each alarm feature in the alarm feature set, and determining whether the to-be-identified alarm information matches the alarm feature by whether the to-be-identified alarm information contains the alarm feature. If the to-be-identified alarm information contains an alarm feature, it is considered that the to-be-identified alarm information matches the alarm feature; if the to-be-identified alarm information does not contain an alarm feature, it is considered that the to-be-identified alarm information does not match the alarm feature.

[0053] S103, if it is determined that the matching result represents that the to-be-identified alarm information matches an alarm feature in the alarm feature set, determining that the to-be-identified alarm information is an effective alarm information.

[0054] In an example, when the to-be-identified alarm information matches at least one alarm feature in the alarm feature set, it is determined that the to-be-identified alarm information is an effective alarm information. That is, as long as the to-be-identified alarm information matches an alarm feature, it is considered that the to-be-identified alarm information is an effective alarm information, which is conducive to more comprehensively screening out effective alarm information.

[0055] In an example, when the to-be-identified alarm information matches at least a preset proportion of alarm features in the alarm feature set, it is determined that the to-be-identified alarm information is an effective alarm information. For example, assuming that the number of alarm features in the alarm feature set is 10 and the preset proportion is 50%, when the to-be-identified alarm information matches at least 5 alarm features in the alarm feature set, it is determined that the to-be-identified alarm information is an effective alarm information, which is conducive to more accurately screening out effective alarm information.

[0056] In this embodiment, the to-be-identified alarm information is acquired; the to-be-identified alarm information is matched with the alarm feature set to obtain a corresponding matching result; the alarm feature set includes a plurality of alarm features, and the alarm feature set is determined based on keywords and a result category of historical alarm information; the result category is used to indicate whether the historical alarm information indicates that a fault occurs in the information system; the matching result indicates whether the to-be-identified alarm information matches the alarm features in the alarm feature set; if it is determined that the matching result indicates that the to-be-identified alarm information matches the alarm features in the alarm feature set, it is determined that the to-be-identified alarm information is valid alarm information. The alarm feature set objectively reflects features that may have high fault risks, and can be used as a basis for evaluating the effectiveness and importance of alarm information. Through the matching result of the alarm information and the alarm feature set, valid alarm information can be identified more quickly and accurately, thereby improving the alarm information screening efficiency, helping relevant staff to find and handle corresponding faults in time, and improving the fault handling efficiency of the information system.

[0057] In one embodiment, the alarm feature set includes a first alarm feature set and / or a second alarm feature set; wherein the alarm features in the first alarm feature set include alarm features obtained based on all historical alarm information in a preset historical period; the alarm features in the second alarm feature set include alarm features obtained based on first type historical alarm information in the preset historical period, and the first type historical alarm information is historical alarm information indicating that a fault occurs in the information system.

[0058] The preset historical period can be set according to actual needs, for example, the past three months, the past six months, the past year, etc., and no limitation is made thereto.

[0059] All historical alarm information in the preset historical period refers to all historical alarm information generated by the monitoring alarm system in the preset historical period, which includes both first type historical alarm information indicating that a fault occurs in the information system and second type historical alarm information not indicating that a fault occurs in the information system. The fusion of the first type historical alarm information and the second type historical alarm information makes the information more rich and comprehensive. The second type historical alarm information may contain fault information with potential fault risks, and has a certain auxiliary effect on the identification of the effectiveness and importance of alarm information.

[0060] In an example, the alarm feature set can only include the first alarm feature set. The first alarm feature set obtained by comprehensively considering the first type historical alarm information and the second type historical alarm information can more comprehensively reflect features that may have high fault risks, so that through the matching result of the alarm information and the first alarm feature set, valid alarm information can be more accurately identified.

[0061] The first type of historical alarm information in a preset historical period refers to historical alarm information in which the information system has failed, which is generated by the monitoring alarm system in the preset historical period, and does not include historical alarm information in which the information system has not failed.

[0062] In an example, the alarm feature set can only include the second alarm feature set. The second alarm feature set obtained by only considering the first type of historical alarm information can more specifically reflect features that may have a high failure risk, and the matching result of the alarm information and the second alarm feature set can more accurately identify obvious effective alarm information.

[0063] In an example, the alarm feature set can also include the first alarm feature set and the second alarm feature set. The first alarm feature set and the second alarm feature set can have the same elements or different elements. The alarm feature set is the union of the first alarm feature set and the second alarm feature set, and the matching result of the alarm information and the union can comprehensively and accurately identify effective alarm information.

[0064] It should be noted that the alarm feature set of the embodiment is determined by the server in advance. When identifying newly generated alarm information, the server can directly obtain the pre-determined alarm feature set and match the alarm information with the pre-determined alarm feature set, without the need to generate the alarm feature set in real time. In an example, the server updates the alarm feature set periodically, for example, the server updates the alarm feature set once every quarter.

[0065] In one embodiment, as shown in FIG. 1, Figure 2 a flowchart of a method for obtaining the first alarm feature set is provided, which includes the following steps S201 to S206.

[0066] S201, obtaining all historical alarm information in a preset historical period, the all historical alarm information including the first type of historical alarm information in which the information system has failed and the second type of historical alarm information in which the information system has not failed.

[0067] For a detailed description of this step, please refer to the previous embodiment, which will not be repeated here.

[0068] S202, performing keyword extraction based on the all historical alarm information to obtain a first keyword set of the all historical alarm information.

[0069] Existing keyword extraction algorithms (such as TextRank algorithm) or future possible keyword extraction algorithms can be used to extract keywords in the all historical alarm information, and the first keyword set is obtained based on the extracted keywords.

[0070] In an example, as shown in FIG. 1, keyword extraction is performed based on all historical alarm information to obtain a first keyword set of the all historical alarm information. The keyword extraction can include the following steps S301-S304. Figure 3

[0071] S301, the all historical alarm information is segmented into multiple sentences, and each sentence is subjected to word segmentation and part-of-speech tagging processing, and words of a specified part-of-speech are determined as first candidate keywords.

[0072] The all historical alarm information is taken as a text T, and the text T is segmented according to complete sentences to obtain multiple sentences, i.e.

[0073] T = [S1, S2, S3,..., SM] M ]

[0074] S i represents a segmented sentence, 1≤i≤M, and the sentence S i is subjected to word segmentation and part-of-speech tagging processing, and only words of a specified part-of-speech (such as nouns, verbs, and adjectives) are retained as candidate keywords, i.e.

[0075] S i = [t i1 , t i2 , t i3 ,..., t in ]

[0076] t ij represents a candidate keyword of the sentence S i , 1≤j≤n. Accordingly, candidate keywords of each sentence can be obtained, and the candidate keywords of all sentences are taken as first candidate keywords.

[0077] S302, weights of the first candidate keywords are calculated according to co-occurrence relationships of different first candidate keywords in a preset vocabulary length window.

[0078] The co-occurrence relationships of different first candidate keywords in the preset vocabulary length window refer to whether different first candidate keywords appear simultaneously in the preset vocabulary length window of the text T. The preset vocabulary length refers to the number of words, for example, the preset vocabulary length is set to K, i.e. the window size is K, and at most K words co-occur.

[0079] A first candidate keyword graph G = (V, E) is constructed, where V represents nodes, i.e. the first candidate keywords, and E represents edges between nodes, which are constructed by using the co-occurrence relationships of different first candidate keywords in the preset vocabulary length window. When the words corresponding to two nodes co-occur in the preset vocabulary length window, there is an edge between the two nodes. According to the following formula:

[0080] ​

[0081] The weights of each node are iteratively propagated until convergence, and the weights of each first candidate keyword are obtained. Wherein, WS(V i ) represents the weight of node V i ; WS(V j ) represents the weight of node V j ; In(V i ) represents a set of nodes pointing to node V i ; Out(V i ) represents a set of nodes pointed by node V i ; ω ji represents the weight of an edge between node V i and node V j , and the edges between different nodes have different importance levels; and d represents a damping coefficient, and the value range is 0-1.

[0082] The weight of the first candidate keyword is used to represent the importance of the first candidate keyword in the historical alarm information. The greater the weight of the first candidate keyword, the more important the first candidate keyword in the historical alarm information, and the more important the identification of the effective alarm information.

[0083] S303, the weights of each first candidate keyword are sorted from large to small, and the first candidate keywords with a preset number of weight rankings are taken as the first keywords. If multiple first keywords form adjacent word groups in the historical alarm information, the multiple first keywords are combined into second keywords.

[0084] The weights of each first candidate keyword are sorted from large to small, and the first candidate keywords with a preset number of weight rankings are taken as the first keywords. If multiple first keywords form adjacent word groups in the historical alarm information, the multiple first keywords are combined into second keywords.

[0085] The N first keywords are put into the historical alarm information for marking, and if multiple first keywords form adjacent word groups in the historical alarm information, the multiple first keywords are combined into second keywords. For example, "payment" and "failure" are two first keywords, and the two first keywords form an adjacent word group "payment failure" in the historical alarm information, and the two first keywords "payment" and "failure" are combined into a second keyword "payment failure". It can be understood that the second keyword here refers to keyword combination.

[0086] S304, according to the first keyword and the second keyword, a first keyword set of all historical alarm information is composed.

[0087] The first keyword and the second keyword are merged to obtain the first keyword set of all historical alarm information, that is, the keywords in the first keyword set include the first keyword and the second keyword.

[0088] S203, each first type of historical alarm information is converted into a corresponding first feature vector, and each second type of historical alarm information is converted into a corresponding second feature vector; the first feature vector includes the keywords matched by the corresponding first type of historical alarm information in the first keyword set, and the second feature vector includes the keywords matched by the corresponding second type of historical alarm information in the first keyword set.

[0089] For each first type of historical alarm information, the first type of historical alarm information is matched with each keyword in the first keyword set, and the first feature vector corresponding to the first type of historical alarm information is formed based on the matched keywords. For each second type of historical alarm information, the second type of historical alarm information is matched with each keyword in the first keyword set, and the second feature vector corresponding to the second type of historical alarm information is formed based on the matched keywords. Accordingly, a certain historical alarm information T i Can be converted into a feature vector S composed of n keywords i As follows:

[0090] T i -->S i =[S i1 ,S i2 ,S i3 ...,S in ]

[0091] The result category of the historical alarm information is defined as S R , S R is 1, indicating the first type of historical alarm information, S R is -1, indicating the second type of historical alarm information, S R is added to the feature vector S i , to obtain an alarm vector S inew containing keywords and results:

[0092] S inew =[S i1 ,S i2 ,S i3 ...,S in ,S R ]

[0093] S204, selecting one of the first feature vector and the second feature vector, determining the same-class neighbor feature vectors according to the Euclidean distance between the feature vector and the same-class feature vectors, and determining the different-class neighbor feature vectors according to the Euclidean distance between the feature vector and the different-class feature vectors.

[0094] The same-class feature vectors refer to the feature vectors of the historical alarm information of the same class as the selected feature vector, and the different-class feature vectors refer to the feature vectors of the historical alarm information of different classes from the selected feature vector.

[0095] For example, if the selected feature vector is the first feature vector, which corresponds to the first-class historical alarm information, the same-class feature vectors include the first feature vectors of all other first-class historical alarm information, and the different-class feature vectors include the second feature vectors of all second-class historical alarm information.

[0096] The Euclidean distances between the selected feature vector and each same-class feature vector are calculated, and the k same-class feature vectors with the closest Euclidean distances are taken as the same-class neighbor feature vectors. The Euclidean distances between the selected feature vector and each different-class feature vector are calculated, and the k different-class feature vectors with the closest Euclidean distances are taken as the different-class neighbor feature vectors. k is a positive integer, and the specific value can be set according to actual requirements, which is not limited here.

[0097] S205, obtaining the weights of the keywords in the first keyword set according to the distribution differences of the keywords in the first keyword set in the same-class neighbor feature vectors and the different-class neighbor feature vectors.

[0098] If the keyword is related to classification, the distribution of the keyword in the same-class neighbor feature vectors should be similar, and the distribution of the keyword in the different-class neighbor feature vectors should be different. Based on this, the weights of the keywords in the first keyword set can be calculated according to the distribution differences of the keywords in the first keyword set in the same-class neighbor feature vectors and the different-class neighbor feature vectors. The weights here are used to represent the classification ability of the keywords. The greater the weight of a keyword, the higher the contribution of the keyword to classification, that is, the stronger the classification ability of the keyword, and thus the more important the keyword to the identification of effective alarm information.

[0099] The existing feature selection algorithm (such as ReliefF algorithm) or the future possible feature selection algorithm can be used to calculate the weights of the keywords in the first keyword set.

[0100] In an example, the weights (W init ) of the keywords in the first keyword set are calculated by the following formula:

[0101]

[0102] Where, diff(A,R,H) j ) represents the eigenvector R and the eigenvectors H of the same type and their nearest neighbors. j The difference on feature A, if feature A exists in both R and H j In the middle, then diff(A,R,H) j If ) = 0, and feature A does not exist simultaneously in R and H j In the middle, then diff(A,R,H) j ) = 1; diff(A,R,M) j (c) represents the feature vector R and the feature vectors of different class nearest neighbors M. j (c) The difference on feature A, if feature A exists in both R and M. j In (c), then diff(A,R,M) j (c))=0, if feature A does not exist simultaneously in R and H j In the middle, then diff(A,R,M) j (c))=1; m represents the total number of feature vectors; P(c) is the proportion of categories that are different from the randomly selected feature vector categories, and P(class(R)) is the proportion of randomly selected feature vector categories.

[0103] S206. Based on each keyword and its weight in each first feature vector, obtain the first alarm feature set.

[0104] Based on the weight of each keyword in each first feature vector, keywords with lower weights in each first feature vector are filtered out, and keywords with higher weights in each first feature vector are retained. The first alarm feature set is obtained based on all the retained keywords.

[0105] In one example, such as Figure 4 As shown, the steps for obtaining the first alarm feature set based on each keyword and its weight in each first feature vector may specifically include the following steps S401 to S403.

[0106] S401, calculate the median and average weights of all keywords in each first feature vector, and take the maximum value of the median and average as the weight threshold corresponding to each first feature vector.

[0107] Specifically, for the first eigenvector S i The keyword is S. i1 ,S i2 ,S i3 ,…,S in The weight of each keyword is W. i1 W i2 W i3 ,…,Win , where n represents the number of keywords in the first feature vector. The first feature vector S i The median weight (W) of all keywords in the text. mid The calculation formula for ) is as follows:

[0108]

[0109] The first eigenvector S i The average weight of all keywords in the text (W) aver ) through the first eigenvector S i The sum of the weights of all keywords in the first feature vector S divided by the first feature vector S i The number of keywords in the text is calculated. The median (W) is taken. mid ) and average (W) aver The maximum value of ) is taken as the first eigenvector S. i The corresponding weight threshold (W) hold ),Right now:

[0110] W hold =max(W mid W aver )

[0111] S402, filter out keywords in each first feature vector whose weight is lower than the corresponding weight threshold to obtain the first alarm feature of each first type of historical alarm information.

[0112] Specifically, for the first eigenvector S i The weights of each keyword are compared with the weight threshold (W). hold If the keyword's weight is lower than the weight threshold (W), then... hold If the keyword is removed from the first feature vector S, then the keyword will be removed from the first feature vector S. i Delete, and the final first feature vector S i The keywords retained in the text form the first feature vector S. i The corresponding first alarm feature, that is, the first feature vector S i The first alarm feature corresponding to the first category of historical alarm information. It can be understood that the first alarm feature includes one or more keywords.

[0113] S403. Based on the first alarm features of all first-type historical alarm information, obtain the first alarm feature set.

[0114] After obtaining the first alarm feature of each first-type historical alarm message, the first alarm features of all first-type historical alarm messages are merged to obtain the first alarm feature set.

[0115] In this embodiment, first, keywords are extracted from all historical alarm information by a keyword extraction algorithm to obtain a first keyword set, and then keywords with high weights are filtered from the keywords matched in the first keyword set by the first type of historical alarm information by a feature selection algorithm to form a first alarm feature set that can more comprehensively reflect the features that may exist high fault risk, so that the matching result of the to-be-identified alarm information and the first alarm feature set can more accurately identify the effective alarm information. In addition, in the feature selection algorithm, the maximum of the median and the average of the keyword weights is used as the weight threshold for filtering the keywords, which can prevent the extreme distribution of the keyword weights from affecting the filtering effect, and the keywords filtered accordingly can more accurately reflect the features that may exist high fault risk, thereby helping to further improve the identification accuracy of the effective alarm information.

[0116] In one embodiment, as shown in Figure 5 , a flowchart of a method for obtaining a second alarm feature set is provided, which includes the following steps S501 to S504.

[0117] S501, obtaining the first type of historical alarm information in a preset historical period.

[0118] For specific description of this step, please refer to the foregoing embodiments, which will not be repeated here.

[0119] S502, performing keyword extraction based on all the first type of historical alarm information to obtain a second keyword set of all the first type of historical alarm information.

[0120] Existing keyword extraction algorithms (such as TextRank algorithm) or future possible keyword extraction algorithms can be used to extract keywords from all the first type of historical alarm information, and based on the extracted keywords, a second keyword set is obtained.

[0121] In an example, as shown in Figure 6 , the step of performing keyword extraction based on all the first type of historical alarm information to obtain a second keyword set of all the first type of historical alarm information can specifically include the following steps S601 to S604.

[0122] S601, dividing all the first type of historical alarm information into multiple sentences, performing word segmentation and part-of-speech tagging processing on each sentence, and determining the words with specified parts of speech as second candidate keywords.

[0123] All the first type of historical alarm information is taken as a text T, and the text T is divided according to complete sentences to obtain multiple sentences, i.e.:

[0124] T=[S1,S2,S3...,S M ]

[0125] S i denotes the segmented sentence, 1≤i≤M, and S i is segmented and tagged, and only the words with specified parts of speech (such as nouns, verbs, and adjectives) are kept as candidate keywords, i.e.

[0126] S i = [t i1 ,t i2 ,t i3 ...t in ]

[0127] t ij denotes the candidate keywords of the sentence S i , 1≤j≤n. Accordingly, the candidate keywords of each sentence can be obtained, and the candidate keywords of all sentences are taken as second candidate keywords.

[0128] S602, according to the co-occurrence relationship of different second candidate keywords in a preset vocabulary length window, the weight of each second candidate keyword is calculated.

[0129] The co-occurrence relationship of different second candidate keywords in a preset vocabulary length window refers to whether different second candidate keywords appear simultaneously in a preset vocabulary length window of the text T. The preset vocabulary length refers to the number of words, for example, the preset vocabulary length is set to K, that is, the window size is K, and at most K words co-occur.

[0130] A second candidate keyword graph G=(V, E) is constructed, where V represents nodes, i.e. each second candidate keyword; E represents the edges between nodes, which is constructed using the co-occurrence relationship of different second candidate keywords in a preset vocabulary length window. When the vocabulary corresponding to two nodes co-occurs in a preset vocabulary length window, there is an edge between the two nodes. According to the following formula:

[0131]

[0132] The weight of each node is iteratively propagated until convergence, and the weight of each second candidate keyword is obtained. Wherein, WS(V i ) represents the weight of node V i ; WS(V j ) represents the weight of node V j ; In(V i ) represents the set of nodes pointing to node V i ; Out(V i ) represents the set of nodes pointed to by node V i ; ω ji represents the node V i and node V jThe weight of the edge between two nodes is different, and the edge between different nodes has different importance; d represents a damping coefficient, and the value range is 0-1.

[0133] The weight of the second candidate keyword is used to represent the importance of the second candidate keyword in the first type of historical alarm information. The greater the weight of the second candidate keyword, the more important the second candidate keyword is in the first type of historical alarm information, and the more important the second candidate keyword is for identifying effective alarm information.

[0134] S603, the weights of the second candidate keywords are sorted from large to small, and the second candidate keywords with the top weights in the preset number are taken as third keywords. If multiple third keywords form adjacent word groups in the first type of historical alarm information, the multiple third keywords are combined into fourth keywords.

[0135] The weights of the second candidate keywords are sorted from large to small, and the second candidate keywords with the top weights are taken as third keywords. If multiple third keywords form adjacent word groups in the first type of historical alarm information, the multiple third keywords are combined into fourth keywords.

[0136] The N third keywords are put into the first type of historical alarm information for marking. If multiple third keywords form adjacent word groups in the first type of historical alarm information, the multiple third keywords are combined into fourth keywords. For example, "payment" and "failure" are two third keywords, and the two third keywords form an adjacent word group "payment failure" in the first type of historical alarm information. Therefore, the two third keywords "payment" and "failure" are combined into a fourth keyword "payment failure". It can be understood that the fourth keyword here refers to keyword combination.

[0137] S604, according to the third keywords and the fourth keywords, a second keyword set of all the first type of historical alarm information is formed.

[0138] The third keywords and the fourth keywords are merged to obtain a second keyword set of all the first type of historical alarm information, that is, the keywords in the second keyword set include the third keywords and the fourth keywords.

[0139] S503, each first type of historical alarm information is converted into a corresponding third feature vector as a second alarm feature corresponding to each first type of historical alarm information, and the third feature vector includes keywords matched by the corresponding first type of historical alarm information in the second keyword set.

[0140] For each piece of first-type historical alarm information, the first-type historical alarm information is matched with each keyword in the second keyword set, a third feature vector corresponding to the first-type historical alarm information is formed based on the matched keyword, and the third feature vector corresponding to the first-type historical alarm information is taken as a second alarm feature of the first-type historical alarm information. It can be understood that the second alarm feature includes one or more keywords.

[0141] S504, a second alarm feature set is obtained according to the second alarm features of all the first-type historical alarm information.

[0142] After obtaining the second alarm feature of each piece of first-type historical alarm information, the second alarm features of all the first-type historical alarm information are combined to obtain the second alarm feature set.

[0143] In this embodiment, the second keyword set is obtained by extracting keywords from all the first-type historical alarm information through a keyword extraction algorithm, and the second alarm feature set which can more specifically reflect the features of possible high-fault risks is formed based on the keywords matched in the second keyword set by the first-type historical alarm information. Therefore, the obvious effective alarm information can be more accurately identified through the matching result of the to-be-identified alarm information and the second alarm feature set.

[0144] In one embodiment, as shown in FIG. 1, a flowchart of a method for identifying alarm information based on an information system is provided, which includes the following steps S701 to S706. Figure 7

[0145] S701, all historical alarm information in a preset historical period is obtained, and a first alarm feature set is obtained based on the all historical alarm information in the preset historical period.

[0146] S702, first-type historical alarm information in the preset historical period is obtained, and a second alarm feature set is obtained based on the first-type historical alarm information in the preset historical period.

[0147] S703, a union set of the first alarm feature set and the first alarm feature set is determined as an alarm feature set, and the alarm feature set includes a plurality of alarm features.

[0148] S704, to-be-identified alarm information is obtained.

[0149] S705, the to-be-identified alarm information is matched with the alarm feature set to obtain a corresponding matching result.

[0150] S706, if it is determined that the matching result represents that the to-be-identified alarm information matches the alarm features in the alarm feature set, the to-be-identified alarm information is determined as effective alarm information.

[0151] ​The specific description of steps S701-S706 can be referred to the foregoing embodiments, and will not be repeated here. In this embodiment, the first alarm feature set obtained based on all the historical alarm information is combined with the second alarm feature set obtained based on the first type of historical alarm information to form an alarm feature set. The alarm feature set objectively and comprehensively reflects the features that may exist high failure risk, and can be used to determine the hidden failure risk of the newly generated alarm information. Taking the alarm feature set as the basis for evaluating the effectiveness and importance of the alarm information, the effective alarm information can be quickly, comprehensively and accurately identified, thereby improving the alarm information screening efficiency, and helping the relevant staff to find and handle the corresponding failure in time, and improving the failure handling efficiency of the information system.

[0152] It should be understood that, although the steps in each flowchart involved in the above embodiments are displayed in sequence according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other orders. Moreover, at least part of the steps in each flowchart involved in the above embodiments can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but can be executed alternately or alternately with at least part of other steps or steps or stages in other steps.

[0153] In one embodiment, as shown in Figure 8 A structural schematic diagram of an alarm information identification device based on an information system is provided, which can be a software module or a hardware module, or a combination of the two as part of a computer device. The device specifically includes an acquisition module 810, a matching module 820, and a determination module 830, wherein:

[0154] The acquisition module 810 is configured to acquire the to-be-identified alarm information.

[0155] The matching module 820 is configured to match the to-be-identified alarm information with a preset alarm feature set to obtain a corresponding matching result. The alarm feature set includes a plurality of alarm features, and the alarm feature set is determined based on keywords and result categories of historical alarm information. The result category is used to indicate whether the historical alarm information indicates that a failure of the information system has occurred. The matching result indicates whether the to-be-identified alarm information matches the alarm features in the alarm feature set.

[0156] The determination module 830 is configured to determine that the to-be-identified alarm information is effective alarm information if it is determined that the matching result indicates that the to-be-identified alarm information matches the alarm features in the alarm feature set.

[0157] In an example, the alarm feature set comprises a first alarm feature set and / or a second alarm feature set; wherein the alarm features in the first alarm feature set comprise alarm features obtained based on all historical alarm information in a preset historical period; the alarm features in the second alarm feature set comprise alarm features obtained based on first type historical alarm information in the preset historical period, the first type historical alarm information being historical alarm information indicating that the information system has failed.

[0158] In one embodiment, as shown in FIG. 8, the apparatus further comprises an alarm feature set obtaining module 840, configured to obtain an alarm feature set. Figure 9

[0159] In an example, the alarm feature set obtaining module 840 comprises a first alarm feature set obtaining module 841, configured to obtain a first alarm feature set. The first alarm feature set obtaining module 841 comprises a first obtaining unit 8411, a first keyword extracting unit 8412, a first converting unit 8413, a distance calculating unit 8414, a weight calculating unit 8415 and a first determining unit 8416, wherein:

[0160] The first obtaining unit 8411 is configured to obtain all historical alarm information in a preset historical period, the all historical alarm information comprising first type historical alarm information indicating that the information system has failed and second type historical alarm information not indicating that the information system has failed.

[0161] The first keyword extracting unit 8412 is configured to perform keyword extraction based on the all historical alarm information to obtain a first keyword set of the all historical alarm information.

[0162] The first converting unit 8413 is configured to convert each first type historical alarm information into a corresponding first feature vector and convert each second type historical alarm information into a corresponding second feature vector; the first feature vector comprising keywords matched by the corresponding first type historical alarm information in the first keyword set, and the second feature vector comprising keywords matched by the corresponding second type historical alarm information in the first keyword set.

[0163] The distance calculating unit 8414 is configured to select one feature vector from the first feature vector and the second feature vector, determine a same-class neighbor feature vector according to the Euclidean distance between the feature vector and the same-class feature vector, and determine a different-class neighbor feature vector according to the Euclidean distance between the feature vector and the different-class feature vector.

[0164] The weight calculating unit 8415 is configured to obtain the weight of each keyword in the first keyword set according to the distribution difference of each keyword in the first keyword set in the same-class neighbor feature vector and the distribution difference of each keyword in the first keyword set in the different-class neighbor feature vector.

[0165] ​The first determination unit 8416 is configured to obtain a first alarm feature set according to each keyword and the weight of each keyword in each first feature vector.

[0166] In an example, the first keyword extraction unit 8412 is specifically configured to: divide all historical alarm information into multiple sentences, perform word segmentation and part-of-speech tagging processing on each sentence, and determine words with a specified part of speech as first candidate keywords; calculate the weight of each first candidate keyword according to the co-occurrence relationship of different first candidate keywords in a preset vocabulary length window; sort the weights of each first candidate keyword from large to small, and take a preset number of first candidate keywords with high weight ranking as first keywords; if multiple first keywords form an adjacent word group in the historical alarm information, combine the multiple first keywords into a second keyword; and compose a first keyword set of all historical alarm information according to the first keywords and the second keyword.

[0167] In an example, the first determination unit 8416 is specifically configured to: calculate the median and the average of the weights of all keywords in each first feature vector respectively, take the maximum of the median and the average as the weight threshold corresponding to each first feature vector, filter the keywords in each first feature vector whose weight is lower than the corresponding weight threshold, and obtain the first alarm feature of each first type of historical alarm information; and obtain a first alarm feature set according to the first alarm features of all first type of historical alarm information.

[0168] In one embodiment, as shown in Figure 9 The alarm feature set acquisition module 840 includes a second alarm feature set acquisition module 842 configured to acquire a second alarm feature set. The second alarm feature set acquisition module 842 includes a second acquisition unit 8421, a second keyword extraction unit 8422, a second conversion unit 8423, and a second determination unit 8424, where:

[0169] The second acquisition unit 8421 is configured to acquire first type of historical alarm information in a preset historical period.

[0170] The second keyword extraction unit 8422 is configured to extract keywords based on all first type of historical alarm information to obtain a second keyword set of all first type of historical alarm information.

[0171] The second conversion unit 8423 is configured to convert each first type of historical alarm information into a corresponding third feature vector as a second alarm feature of each first type of historical alarm information, and the third feature vector includes a keyword matched by the corresponding first type of historical alarm information in the second keyword set.

[0172] The second determination unit 8424 is configured to obtain a second alarm feature set according to the second alarm features of all first type of historical alarm information.

[0173] In an example, the second keyword extraction unit 8422 is specifically configured to: divide all the first type of historical alarm information into multiple sentences, perform word segmentation and part-of-speech tagging processing on each sentence, and determine words with a specified part of speech as second candidate keywords; calculate the weights of the second candidate keywords according to the co-occurrence relationship of different second candidate keywords in a preset vocabulary length window; sort the weights of the second candidate keywords from large to small, and take a preset number of second candidate keywords with high weights as third keywords; if multiple third keywords form adjacent word groups in the first type of historical alarm information, combine the multiple third keywords into fourth keywords; and compose a second keyword set of all the first type of historical alarm information according to the third keywords and the fourth keywords.

[0174] In an example, as shown in FIG. 8, the alarm feature set acquisition module 840 includes a first alarm feature set acquisition module 841, a second alarm feature set acquisition module 842, and a merging module 843, wherein: the first alarm feature set acquisition module 841 is configured to acquire a first alarm feature set; the second alarm feature set acquisition module 842 is configured to acquire a second alarm feature set; and the merging module 843 is configured to determine the union of the first alarm feature set and the second alarm feature set as the alarm feature set. Figure 9

[0175] For specific limitations of the alarm information recognition device based on the information system, refer to the limitations of the alarm information recognition method based on the information system in the above, which will not be repeated here. Each module in the above alarm information recognition device based on the information system can be realized by software, hardware, and a combination thereof, in whole or in part. The above modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory in the computer device in software form, so as to be called and executed by the processor to perform the operations corresponding to the above modules.

[0176] In an example, as shown in FIG. 8, the alarm feature set acquisition module 840 includes a first alarm feature set acquisition module 841, a second alarm feature set acquisition module 842, and a merging module 843, wherein: the first alarm feature set acquisition module 841 is configured to acquire a first alarm feature set; the second alarm feature set acquisition module 842 is configured to acquire a second alarm feature set; and the merging module 843 is configured to determine the union of the first alarm feature set and the second alarm feature set as the alarm feature set. Figure 10 The computer device further includes a receiver 1003 and a transmitter 1004. The receiver 1003 is configured to receive instructions and data sent by an external device, and the transmitter 1004 is configured to send instructions and data to the external device.

[0177]

[0178] Figure 11 ​​is a block diagram of a computer device according to an exemplary embodiment, which can be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0179] The apparatus 1100 can include one or more of the following components: a processing component 1102, a memory 1104, a power supply component 1106, a multimedia component 1108, an audio component 1110, an input / output (I / O) interface 1112, a sensor component 1114 and a communication component 816.

[0180] The processing component 1102 usually controls overall operations of the apparatus 1100, such as operations associated with displaying, making phone calls, data communications, camera operations and recording operations. The processing component 1102 can include one or more processors 1120 to execute instructions to complete all or part of steps of the above methods. In addition, the processing component 1102 can include one or more modules to facilitate interaction between the processing component 1102 and other components. For example, the processing component 1102 can include a multimedia module to facilitate the interaction between the multimedia component 1108 and the processing component 1102.

[0181] The memory 1104 is configured to store various types of data to support operations of the apparatus 1100. Examples of these data include instructions for any application or methods operating on the apparatus 1100, contact data, phonebook data, messages, pictures, videos, etc. The memory 1104 can be realized by any type of volatile or nonvolatile storage devices or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0182] The power supply component 1106 supplies electrical power for the various components of the apparatus 1100. The power supply component 1106 can include a power supply management system, one or more power supplies, and other components associated with generating, managing and distributing electrical power for the apparatus 1100.

[0183] The multimedia component 1108 includes a screen providing an output interface between the device 1100 and a user. In some embodiments, the screen can include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touch, swiping, and gestures on the touch panel. The touch sensor can not only sense a boundary of a touching or swiping action, but also detect duration and pressure related to the touching or swiping action. In some embodiments, the multimedia component 1108 includes a front camera and / or a rear camera. When the device 1100 is in an operation mode, such as a shooting mode or a video mode, the front camera and / or the rear camera can receive external multimedia data. Each of the front and rear camera can be a fixed optical lens system or have a focal length and optical zoom capability.

[0184] The audio component 1110 is configured to output and / or input audio signals. For example, the audio component 1110 includes a microphone (MIC) configured to receive external audio signals when the device 1100 is in an operation mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signals can be further stored in the memory 1104 or transmitted via the communication component 1116. In some embodiments, the audio component 1110 also includes a speaker for outputting audio signals.

[0185] The I / O interface 1112 provides an interface between the processing component 1102 and peripheral interface modules, which can be a keypad, a click wheel, buttons, and the like. The buttons can include, but are not limited to, a home button, a volume button, a start button, and a lock button.

[0186] The sensor component 1114 includes one or more sensors to provide various state assessments for the device 1100. For example, the sensor component 1114 can detect an open / closed state of the device 1100, relative positioning of components, such as a display and a keypad of the device 1100, a change in position of the device 1100 or a component of the device 1100, presence or absence of user contact with the device 1100, an orientation or acceleration / deceleration of the device 1100, and a temperature change of the device 1100. The sensor component 1114 can include a proximity sensor configured to detect presence of a nearby object without any physical touch. The sensor component 1114 can further include a light sensor, such as a CMOS or CCD image sensor, for use in an imaging application. In some embodiments, the sensor component 1114 can further include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0187] The communication component 1116 is configured to facilitate wired or wireless communication between the device 1100 and other devices. The device 1100 can access a wireless network based on a communication standard, such as WiFi, 2G, or 3G, or a combination thereof. In an exemplary embodiment, the communication component 1116 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 1116 further includes a Near Field Communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on Radio Frequency Identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0188] In an exemplary embodiment, the device 1100 can be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, micro-controllers, microprocessors or other electronic elements, for performing the above-described methods.

[0189] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions, such as the memory 1104 including instructions, is also provided, which can be executed by the processor 1120 of the device 1100 to complete the above-described methods. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disc, and an optical data storage device, etc.

[0190] The embodiments of the present application also provide a non-transitory computer-readable storage medium, when instructions in the storage medium are executed by a processor of a computer device, the computer device can execute the method provided by any of the above-described embodiments.

[0191] The embodiments of the present application also provide a computer program product, which includes: a computer program stored in a readable storage medium, at least one processor of a computer device can read the computer program from the readable storage medium, and the at least one processor executes the computer program to make the computer device execute the method provided by any of the above-described embodiments.

[0192] It should be understood that the terms "first", "second" and the like in the above-described embodiments are merely intended for descriptive purposes and are not intended to indicate or imply relative importance or a number of indicated technical features. In addition, in the description of the present application, unless otherwise specified, the meaning of "a plurality of" is at least two.

[0193] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the specification and examples be considered as exemplary only, with the true scope and spirit of the application being indicated by the following claims.

[0194] It is to be understood that the application is not limited to the precise construction herein disclosed and shown in the drawings, and that various changes in shape, size and arrangements of parts can be made without departing from the scope of the application. The scope of the application is limited only by the claims that follow.

Claims

1. A method for identifying alarm information based on an information system, characterized in that, The method includes: Obtain the alarm information to be identified; The alarm information to be identified is matched with a preset alarm feature set to obtain a corresponding matching result; the alarm feature set includes multiple alarm features, and the alarm feature set is determined based on keywords and result categories of historical alarm information; the result category is used to indicate whether the historical alarm information indicates that the information system has failed; the matching result indicates whether the alarm information to be identified has matched an alarm feature in the alarm feature set; If the matching result indicates that the alarm information to be identified has matched an alarm feature in the alarm feature set, then the alarm information to be identified is determined to be a valid alarm information. The method further includes: acquiring all historical alarm information within a preset historical time period, wherein all historical alarm information includes a first type of historical alarm information indicating that the information system has failed and a second type of historical alarm information not indicating that the information system has failed; Based on all the historical alarm information, keywords are extracted to obtain the first keyword set of all historical alarm information; Each of the first type of historical alarm information is converted into a corresponding first feature vector, and each of the second type of historical alarm information is converted into a corresponding second feature vector; the first feature vector includes the keywords matched by the corresponding first type of historical alarm information in the first keyword set, and the second feature vector includes the keywords matched by the corresponding second type of historical alarm information in the first keyword set; Choose any one feature vector from the first feature vector and the second feature vector, determine the nearest neighbor feature vector of the same class based on the Euclidean distance between the feature vector and feature vectors of the same class, and determine the nearest neighbor feature vector of different classes based on the Euclidean distance between the feature vector and feature vectors of different classes. The weights of each keyword in the first keyword set are obtained based on the distribution differences of each keyword in the same type of nearest neighbor feature vector and the distribution differences of each keyword in different types of nearest neighbor feature vector. The first alarm feature set is obtained based on each keyword and its weight in each of the first feature vectors.

2. The method according to claim 1, characterized in that, The alarm feature set includes a first alarm feature set and / or a second alarm feature set; The alarm features in the first alarm feature set include alarm features obtained based on all historical alarm information within a preset historical time period. The alarm features in the second alarm feature set include alarm features obtained based on the first type of historical alarm information within a preset historical time period.

3. The method according to claim 1, characterized in that, Based on all the historical alarm information, keyword extraction is performed to obtain a first keyword set of all historical alarm information, including: All historical alarm information is divided into multiple sentences, and each sentence is processed by word segmentation and part-of-speech tagging. Words with specified parts of speech are identified as the first candidate keywords. The weight of each first candidate keyword is calculated based on the co-occurrence relationship of different first candidate keywords within a preset vocabulary length window; The weights of each first candidate keyword are sorted from largest to smallest, and a preset number of first candidate keywords with the highest weights are taken as first keywords. If multiple first keywords form adjacent word groups in the historical alarm information, the multiple first keywords are combined into a second keyword. Based on the first keyword and the second keyword, a first keyword set is formed for all historical alarm information.

4. The method according to claim 1, characterized in that, Based on each keyword and its weight in each of the first feature vectors, a first alarm feature set is obtained, including: Calculate the median and average weights of all keywords in each of the first feature vectors, and take the maximum value of the median and the average value as the weight threshold corresponding to each of the first feature vectors; Filter out keywords whose weights are lower than the corresponding weight thresholds in each of the first feature vectors to obtain the first alarm features of each of the first type of historical alarm information. The first alarm feature set is obtained based on the first alarm features of all first-type historical alarm information.

5. The method according to any one of claims 2-4, characterized in that, The method further includes: Obtain the first type of historical alarm information within a preset historical time period; Based on all first-type historical alarm information, keywords are extracted to obtain a second set of keywords for all first-type historical alarm information; Each of the first type of historical alarm information is converted into a corresponding third feature vector, which serves as the second alarm feature of each of the first type of historical alarm information. The third feature vector includes the keywords matched by the corresponding first type of historical alarm information in the second keyword set. The second alarm feature set is obtained based on the second alarm features of all first-class historical alarm information.

6. The method according to claim 5, characterized in that, Based on keyword extraction from all first-type historical alarm information, a second keyword set for all first-type historical alarm information is obtained, including: All first-category historical alarm information is segmented into multiple sentences. Each sentence is then processed for word segmentation and part-of-speech tagging, and words with specified parts of speech are identified as second candidate keywords. The weight of each second candidate keyword is calculated based on the co-occurrence relationship of different second candidate keywords within a preset vocabulary length window; The weights of each second candidate keyword are sorted from largest to smallest. A preset number of second candidate keywords with the highest weights are selected as third keywords. If multiple third keywords form adjacent word groups in the first type of historical alarm information, the multiple third keywords are combined into a fourth keyword. Based on the third keyword and the fourth keyword, a second keyword set is formed for all first-class historical alarm information.

7. An alarm information identification device based on an information system, wherein the alarm information identification device based on an information system is used to implement the alarm information identification method based on an information system according to any one of claims 1-6, characterized in that, The device includes: The acquisition module is used to acquire alarm information to be identified. A matching module is used to match the alarm information to be identified with a preset alarm feature set to obtain a corresponding matching result; the alarm feature set includes multiple alarm features, and the alarm feature set is determined based on keywords and result categories of historical alarm information; the result category is used to indicate whether the historical alarm information indicates that the information system has failed; the matching result indicates whether the alarm information to be identified has matched an alarm feature in the alarm feature set; The determination module is used to determine that the alarm information to be identified is a valid alarm information if the matching result indicates that the alarm information to be identified matches an alarm feature in the alarm feature set.

8. A computer device, characterized in that, include: A processor and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-6.

Images