Event clustering method, device, electronic device and storage medium

Abstract

The present invention discloses an event clustering method, device, electronic device and storage medium, including: obtaining multiple target events generated by a monitoring system within a preset time period, dividing the preset time period into multiple continuous time buckets; counting the target number of occurrences of each target event in the continuous time buckets, and determining the target K value corresponding to the cluster center point in the Kmeans clustering algorithm according to the target number of occurrences of each target event; and clustering multiple target events according to the target K value using the Kmeans clustering algorithm. The technical solution of the embodiment of the present invention can improve the clustering efficiency of events and the effectiveness of clustering results.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of computer technology, and in particular to an event clustering method, device, electronic device and storage medium. Background Art

[0002] At present, a series of system information such as alarms, notifications, and alerts generated by the backend operation and maintenance monitoring system to inform users about the current performance indicators, faults, abnormal status, etc. of the system are collectively referred to as events. A fault is the result of receiving an event. A fault can contain one or more events, and the number of events is generally dozens of times the number of faults.

[0003] In order to determine the specific fault to which the event belongs, the K-means clustering algorithm can be used to cluster multiple events. Before using the K-means clustering algorithm to cluster events, it is necessary to first determine the K value corresponding to the K-means clustering algorithm. In the prior art, when determining the K value, the user usually determines the K value of the cluster center based on actual experience or the number of events.

[0004] However, the methods for determining the K value in the prior art have the following defects: determining the K value based on manual experience leads to low clustering efficiency, the clustering method has poor flexibility and is not suitable for automated operation and maintenance systems; the method of determining the K value based on the number of events does not fully utilize event information, resulting in unsatisfactory clustering effect. Summary of the invention

[0005] The embodiments of the present invention provide an event clustering method, device, electronic device and storage medium, which can improve the event clustering efficiency and the effectiveness of clustering results.

[0006] In a first aspect, an embodiment of the present invention provides an event clustering method, the method comprising:

[0007] Acquire multiple target events generated by the monitoring system within a preset time period, and divide the preset time period into multiple continuous time buckets;

[0008] Counting the target number of occurrences of each target event in a continuous time bucket, and determining the target K value corresponding to the cluster center in the Kmeans clustering algorithm according to the target number of occurrences of each target event;

[0009] The Kmeans clustering algorithm is used to cluster multiple target events according to the target K value.

[0010] Optionally, determining a target K value corresponding to a cluster center point in a Kmeans clustering algorithm according to a target number of times corresponding to each target event includes:

[0011] According to the target number of times corresponding to each of the target events, a target data matrix corresponding to the multiple target events is constructed;

[0012] Performing singular value decomposition on the target data matrix to obtain a plurality of singular values ​​corresponding to the target data matrix;

[0013] According to the multiple singular values, a target K value corresponding to the cluster center point in the Kmeans clustering algorithm is determined.

[0014] Optionally, determining a target K value corresponding to a cluster center point in a Kmeans clustering algorithm according to the multiple singular values ​​includes:

[0015] Arrange the plurality of singular values ​​in descending order of numerical value to obtain a singular value data set;

[0016] Sequentially obtaining a singular value from the singular value data set as a current singular value;

[0017] Accumulating the current singular values ​​one by one to obtain a current accumulated value, and judging whether the current singular value meets a preset condition according to the current accumulated value and the arrangement order of the current singular value in the singular value data set;

[0018] If yes, then determine the target K value corresponding to the cluster center point in the Kmeans clustering algorithm according to the arrangement order of the current singular value in the singular value data set;

[0019] If not, the process returns to executing the operation of sequentially acquiring a singular value in the singular value data set as the current singular value until the current singular value meets the preset condition.

[0020] Optionally, judging whether the current singular value meets a preset condition according to the current accumulated value and the arrangement order of the current singular value in the singular value data set includes:

[0021] Determine whether the arrangement order of the current singular value in the singular value data set is less than or equal to the upper limit of the K value;

[0022] If yes, then calculate the ratio between the current accumulated value and the accumulated values ​​of all singular values, and if the ratio is greater than a preset energy threshold, determine that the current singular value meets the preset condition;

[0023] If not, it is determined that the current singular value meets the preset condition.

[0024] Optionally, determining a target K value corresponding to a cluster center point in a Kmeans clustering algorithm according to an arrangement order of the current singular value in the singular value data set includes:

[0025] If the order of the current singular value in the singular value data set is less than or equal to the upper limit of the K value, the order of the current singular value in the singular value data set is used as the target K value corresponding to the cluster center in the Kmeans clustering algorithm;

[0026] If the arrangement order of the current singular value in the singular value data set is greater than the upper limit of the K value, the upper limit of the K value is used as the target K value corresponding to the cluster center point in the Kmeans clustering algorithm.

[0027] Optionally, multiple target events generated by the monitoring system within a preset time period are obtained, including:

[0028] Acquire multiple original events generated by the monitoring system within a preset time period, and filter target attributes from multiple event attributes corresponding to each original event;

[0029] The target attributes corresponding to the original events are compared, and the multiple original events are divided into multiple target events according to the comparison result.

[0030] In a second aspect, an embodiment of the present invention further provides an event clustering device, the device comprising:

[0031] An event acquisition module is used to acquire multiple target events generated by the monitoring system within a preset time period, and divide the preset time period into multiple continuous time buckets;

[0032] A frequency statistics module is used to count the target number of occurrences of each target event in a continuous time bucket, and determine the target K value corresponding to the cluster center point in the Kmeans clustering algorithm according to the target number of occurrences of each target event;

[0033] The clustering module is used to count the target number of occurrences of each target event in a continuous time bucket, and determine the target K value corresponding to the cluster center point in the Kmeans clustering algorithm according to the target number of occurrences of each target event.

[0034] In a third aspect, an embodiment of the present invention further provides an electronic device, the electronic device comprising:

[0035] one or more processors;

[0036] A storage device for storing one or more programs;

[0037] When the one or more programs are executed by the one or more processors, the event clustering method provided by any embodiment of the present invention is implemented when the one or more processors execute the programs.

[0038] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the program is executed by a processor, the event clustering method provided by any embodiment of the present invention is implemented.

[0039] In a fifth aspect, an embodiment of the present invention further provides a computer program product, wherein the computer program product includes a computer program, and when the computer program is executed by a processor, the event clustering method provided by any embodiment of the present invention is implemented.

[0040] The technical solution of the embodiment of the present invention obtains multiple target events generated by the monitoring system within a preset time period, divides the preset time period into multiple continuous time buckets, counts the target number of occurrences of each target event in the continuous time buckets, and determines the target K value corresponding to the cluster center point in the Kmeans clustering algorithm according to the target number of occurrences of each target event. The Kmeans clustering algorithm is used to cluster multiple target events according to the target K value, which can improve the clustering efficiency of events and the effectiveness of clustering results.

[0041] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0043] Figure 1 is a flow chart of an event clustering method provided according to Embodiment 1 of the present invention;

[0044] Figure 2 is a flow chart of an event clustering method provided according to Embodiment 2 of the present invention;

[0045] Figure 3 is a flow chart of an event clustering method provided according to Embodiment 3 of the present invention;

[0046] Figure 4 is a structural schematic diagram of an event clustering device provided according to Embodiment 4 of the present invention;

[0047] Figure 5 It is a structural schematic diagram of an electronic device for implementing the event clustering method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0048] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0049] Embodiment 1

[0050] Figure 1 This is a flow chart of an event clustering method provided in Embodiment 1 of the present invention. This embodiment is applicable to clustering events generated by a monitoring system. The method can be performed by an event clustering device. The event clustering device can be implemented by software and / or hardware, and can generally be integrated in an electronic device with data processing functions (such as a terminal or a server), and specifically includes the following steps:

[0051] Step 110: Acquire multiple target events generated by the monitoring system within a preset time period, and divide the preset time period into multiple continuous time buckets.

[0052] In this embodiment, the monitoring system may be a background operation and maintenance monitoring system corresponding to the computer device, and the target event may be an event waiting to be clustered. Optionally, after obtaining multiple target events generated by the monitoring system within a preset time period, the time period may be divided into multiple continuous time buckets according to a preset time bucket length.

[0053] Step 120: Count the target number of occurrences of each target event in a continuous time bucket, and determine the target K value corresponding to the cluster center in the Kmeans clustering algorithm according to the target number of occurrences of each target event.

[0054] In this embodiment, the target number of times each target event occurs in a continuous time bucket can be counted according to the timestamp corresponding to each target event, and then the degree of correlation between the target events can be determined based on the statistical results of the target number of times, and the target K value corresponding to the cluster center point in the Kmeans clustering algorithm can be determined based on the degree of correlation between the target events.

[0055] In a specific embodiment, optionally, assuming that the target number of times event A occurs in consecutive time buckets is close to the target number of times event B occurs in consecutive time buckets, it can be considered that the correlation between event A and event B is strong. Assuming that the monitoring system generates four target events in a preset time period, namely event A, event B, event C and event D, and according to the statistical results of the target number, it is determined that the correlation between event A and event B is strong, and the correlation between event C and event D is strong, it can be considered that the above target events can be divided into two categories, that is, the target K value can be set to 2.

[0056] Step 130: Use the Kmeans clustering algorithm to cluster multiple target events according to the target K value.

[0057] In this embodiment, by utilizing the timestamp information of the target event, the K value of the cluster center point can be automatically calculated. On the one hand, it can avoid the problem of low clustering efficiency and poor flexibility of the clustering method caused by manually determining the K value in the prior art; on the other hand, by utilizing the time series information of the event, the effectiveness of the event clustering results can be improved.

[0058] The technical solution of the embodiment of the present invention obtains multiple target events generated by the monitoring system within a preset time period, divides the preset time period into multiple continuous time buckets, counts the target number of occurrences of each target event in the continuous time buckets, and determines the target K value corresponding to the cluster center point in the Kmeans clustering algorithm according to the target number of occurrences of each target event. The Kmeans clustering algorithm is used to cluster multiple target events according to the target K value, which can improve the clustering efficiency of events and the effectiveness of clustering results.

[0059] Embodiment 2

[0060] This embodiment is a further refinement of the above embodiment. The explanation of terms that are the same or corresponding to those in the above embodiment will not be repeated in this embodiment. Figure 2 This is a flow chart of an event clustering method provided in the second embodiment. In this embodiment, the technical solution of this embodiment can be combined with one or more methods in the solutions of the above embodiments, such as Figure 2 As shown, the method provided in this embodiment may also include:

[0061] Step 210: Acquire multiple original events generated by the monitoring system within a preset time period, and filter a target attribute from multiple event attributes corresponding to each original event.

[0062] In this embodiment, the original event may be an unprocessed event generated by the monitoring system within a preset time period. After acquiring multiple original events, the target attribute may be screened from multiple event attributes corresponding to the original events according to a pre-defined attribute rule.

[0063] In a specific embodiment, the original event may correspond to multiple event attributes, such as timestamp, alarm severity level, event type, and tag, etc. Optionally, other attributes of the event attributes except timestamp and alarm severity level may be used as target attributes.

[0064] Step 220: Compare the target attributes corresponding to the original events, and divide the multiple original events into multiple target events according to the comparison result.

[0065] In this embodiment, multiple original events with the same target attributes can be optionally marked as a unique target event. Specifically, if the event attributes corresponding to two original events are the same except for the timestamp and the alarm severity level, the two original events can be marked as the same target event.

[0066] The advantage of this setting is that by dividing a large number of original events according to target attributes, the workload of the subsequent event clustering process can be reduced, thereby improving the event clustering efficiency.

[0067] Step 230: Divide the preset time period into a plurality of continuous time buckets.

[0068] Step 240: Count the target number of times each target event occurs in consecutive time buckets.

[0069] Step 250: construct a target data matrix corresponding to the multiple target events according to the target times corresponding to each of the target events.

[0070] In a specific embodiment, it is assumed that four target events are acquired within one hour in the monitoring system, namely event 1, event 2, event 3 and event 4. The preset time bucket length is 12 minutes, and one hour can be divided into five consecutive time buckets. Among them, if the time points of event 1 are the 3rd, 8th, 14th, 18th, 21st, 27th, 37th, 41st, 49th, and 53rd minutes; the time points of event 2 are the 2nd, 5th, 9th, 13th, 15th, 19th, 39th, 41st, and 52nd minutes; the time points of event 3 are the 14th, 25th, 27th, 28th, 33rd, 39th, 44th, and 54th minutes; the time points of event 4 are the 7th, 17th, 21st, 51st, and 56th minutes, then the target number of occurrences of the above four target events in five consecutive time buckets can be shown in Table 1:

[0071] Table 1

[0072] Time Bucket 1 Time Bucket 2 Time Bucket 3 Time Bucket 4 Time Bucket 5 Event 1 2 3 1 2 2 Event 2 3 3 0 2 1 Event 3 0 1 4 2 1 Event 4 1 2 0 0 2

[0073] According to Table 1, the target data matrix M corresponding to the above four target events can be constructed, where:

[0074]

[0075] Step 260: Perform singular value decomposition on the target data matrix to obtain multiple singular values ​​corresponding to the target data matrix.

[0076] In this embodiment, specifically, the target data matrix M may be subjected to singular value decomposition according to the following formula:

[0077] M=U∑V

[0078] Assume that the target data matrix M has m rows and n columns, U is an m×m unitary matrix, ∑ is a semi-positive m×n diagonal matrix, and V is an n×n unitary matrix. i These are the singular values ​​of the target data matrix.

[0079] Step 270: Determine a target K value corresponding to the cluster center point in the Kmeans clustering algorithm according to the multiple singular values.

[0080] In this embodiment, optionally, linear processing may be performed on multiple singular values ​​corresponding to the target data matrix, and then the target K value corresponding to the cluster center point in the Kmeans clustering algorithm is determined according to the processing result.

[0081] The advantage of this setting is that by performing singular value decomposition on the target data matrix, the data features closest to the target data matrix can be found in the low-dimensional space, thereby ensuring the reliability of the K value calculation results and improving the effect of event clustering.

[0082] Step 280: Use the Kmeans clustering algorithm to cluster multiple target events according to the target K value.

[0083] The technical solution of the embodiment of the present invention obtains multiple original events generated by the monitoring system within a preset time period, screens the target attribute from the multiple event attributes corresponding to each original event, compares the target attributes corresponding to each original event, divides the multiple original events into multiple target events according to the comparison results, divides the preset time period into multiple continuous time buckets, counts the target number of occurrences of each target event in the continuous time buckets, constructs a target data matrix according to the target number of occurrences corresponding to each target event, performs singular value decomposition on the target data matrix to obtain multiple singular values, determines the target K value according to the multiple singular values, adopts the Kmeans clustering algorithm, and clusters the multiple target events according to the target K value. The technical means can improve the clustering efficiency of events and the effectiveness of clustering results.

[0084] Embodiment 3

[0085] This embodiment is a further refinement of the above embodiment. The explanation of terms that are the same or corresponding to those in the above embodiment will not be repeated in this embodiment. Figure 3 This is a flow chart of an event clustering method provided in the third embodiment. In this embodiment, the technical solution of this embodiment can be combined with one or more methods in the solutions of the above embodiments, such as Figure 3 As shown, the method provided in this embodiment may also include:

[0086] Step 310: Acquire multiple target events generated by the monitoring system within a preset time period, and divide the preset time period into multiple continuous time buckets.

[0087] Step 320: Count the target number of times each target event occurs in consecutive time buckets.

[0088] Step 330: construct a target data matrix corresponding to the multiple target events according to the target times corresponding to each of the target events.

[0089] Step 340: Perform singular value decomposition on the target data matrix to obtain multiple singular values ​​corresponding to the target data matrix.

[0090] Step 350: Arrange the plurality of singular values ​​in descending order of numerical value to obtain a singular value data set.

[0091] In this step, the multiple singular values ​​may be arranged in descending order of numerical value, and the arranged multiple singular values ​​may be used as a singular value data set.

[0092] Step 360: sequentially obtain a singular value from the singular value data set as a current singular value.

[0093] Step 370, accumulate the current singular values ​​one by one to obtain the current accumulated value, and determine whether the current singular value meets the preset condition based on the current accumulated value and the arrangement order of the current singular value in the singular value data set. If so, execute step 380; if not, return to execute step 360 to obtain one singular value in the singular value data set in turn as the current singular value, until the current singular value meets the preset condition.

[0094] In this embodiment, optionally, the current accumulated value and the arrangement order of the current singular value in the singular value data set can be compared with preset thresholds respectively, and whether the current singular value meets the preset conditions can be determined according to the comparison result.

[0095] In one implementation of this embodiment, judging whether the current singular value meets the preset condition according to the current accumulated value and the arrangement order of the current singular value in the singular value data set includes: judging whether the arrangement order of the current singular value in the singular value data set is less than or equal to the upper limit of the K value; if so, calculating the ratio between the current accumulated value and the accumulated value of all singular values, and if the ratio is greater than the preset energy threshold, determining that the current singular value meets the preset condition; if not, determining that the current singular value meets the preset condition. Wherein, the accumulated value of all singular values ​​may be the sum of all singular values.

[0096] In a specific embodiment, the user can pre-set the upper limit value Kmax and energy threshold threshold of the K value in the Kmeans clustering algorithm. If the order of the current singular value is less than or equal to Kmax, and the ratio between the current cumulative value and the cumulative value of all singular values ​​is greater than threshold, it is determined that the current singular value meets the preset condition; if the order of the current singular value is less than or equal to Kmax, but the ratio between the current cumulative value and the cumulative value of all singular values ​​is less than or equal to threshold, it is determined that the current singular value does not meet the preset condition.

[0097] In another specific embodiment, if the ranking order of the current singular value is greater than Kmax, it is determined that the current singular value meets the preset condition.

[0098] Step 380: Determine the target K value corresponding to the cluster center point in the Kmeans clustering algorithm according to the arrangement order of the current singular value in the singular value data set.

[0099] In one implementation of this embodiment, determining the target K value corresponding to the cluster center point in the Kmeans clustering algorithm according to the arrangement order of the current singular value in the singular value data set includes:

[0100] If the order of the current singular value in the singular value data set is less than or equal to the upper limit of the K value, the order of the current singular value in the singular value data set is used as the target K value corresponding to the cluster center in the Kmeans clustering algorithm;

[0101] If the arrangement order of the current singular value in the singular value data set is greater than the upper limit of the K value, the upper limit of the K value is used as the target K value corresponding to the cluster center point in the Kmeans clustering algorithm.

[0102] The advantage of this setting is that by presetting the energy threshold threshold and Kmax, the problem of unsatisfactory clustering effect caused by too many cluster center points can be effectively avoided, thereby improving the effectiveness of the clustering results.

[0103] In a specific embodiment, assuming that the energy threshold is 0.95, Kmax is 200, the singular values ​​of the target data matrix M after singular value decomposition are 7.5314, 4.0209, 1.7345 and 0.3162. Among them, the cumulative value S of all singular values ​​is 13.603, because:

[0104] (7.5314+4.0209+1.7345) / 13.603>0.95

[0105] Therefore, the target K value determined by the above method can be 3.

[0106] Step 390: Use the Kmeans clustering algorithm to cluster multiple target events according to the target K value.

[0107] The technical solution of the embodiment of the present invention obtains multiple target events generated by the monitoring system within a preset time period, counts the target number of times each target event occurs in a continuous time bucket, constructs a target data matrix according to the target number of times corresponding to each target event, performs singular value decomposition on the target data matrix to obtain multiple singular values, arranges the multiple singular values ​​in order from large to small numerical values ​​to obtain a singular value data set, obtains a singular value in the singular value data set in turn as the current singular value, accumulates the current singular values ​​one by one to obtain the current accumulated value, judges whether the current singular value meets the preset condition according to the current accumulated value and the arrangement order of the current singular value, and if so, determines the target K value according to the arrangement order of the current singular value, and uses the Kmeans clustering algorithm to cluster multiple target events according to the target K value. The technical means can improve the clustering efficiency of the events and the effectiveness of the clustering results.

[0108] Embodiment 4

[0109] Figure 4A schematic diagram of the structure of an event clustering device provided in Embodiment 4 of the present invention is shown in FIG. Figure 4 As shown, the device includes: an event acquisition module 410, a frequency statistics module 420 and a clustering module 430.

[0110] The event acquisition module 410 is used to acquire multiple target events generated by the monitoring system within a preset time period, and divide the preset time period into multiple continuous time buckets;

[0111] The frequency statistics module 420 is used to count the target frequency of each target event occurring in a continuous time bucket, and determine the target K value corresponding to the cluster center point in the Kmeans clustering algorithm according to the target frequency corresponding to each target event;

[0112] The clustering module 430 is used to count the target number of occurrences of each target event in a continuous time bucket, and determine the target K value corresponding to the cluster center in the Kmeans clustering algorithm according to the target number of occurrences of each target event.

[0113] The technical solution provided by the embodiment of the present invention obtains multiple target events generated by the monitoring system within a preset time period, divides the preset time period into multiple continuous time buckets, counts the target number of times each target event occurs in the continuous time buckets, and determines the target K value corresponding to the cluster center point in the Kmeans clustering algorithm according to the target number of times corresponding to each target event. The Kmeans clustering algorithm is used to cluster multiple target events according to the target K value, thereby improving the clustering efficiency of events and the effectiveness of clustering results.

[0114] Based on the above embodiment, the event acquisition module 410 includes:

[0115] An attribute screening unit, used to obtain a plurality of original events generated by the monitoring system within a preset time period, and screen a target attribute from a plurality of event attributes corresponding to each original event;

[0116] The attribute comparison unit is used to compare the target attributes corresponding to each of the original events, and divide the multiple original events into multiple target events according to the comparison result.

[0117] The number statistics module 420 includes:

[0118] A matrix construction unit, used to construct a target data matrix corresponding to the plurality of target events according to the target number of times corresponding to each of the target events;

[0119] A matrix processing unit, used for performing singular value decomposition on the target data matrix to obtain a plurality of singular values ​​corresponding to the target data matrix;

[0120] A singular value processing unit, used to determine a target K value corresponding to a cluster center point in a Kmeans clustering algorithm according to the multiple singular values;

[0121] A singular value arrangement unit, used to arrange the plurality of singular values ​​in descending order of numerical value to obtain a singular value data set;

[0122] A singular value acquisition unit, used for sequentially acquiring a singular value from the singular value data set as a current singular value;

[0123] A singular value accumulation unit, used to accumulate the current singular values ​​one by one to obtain a current accumulated value, and judge whether the current singular value meets a preset condition according to the current accumulated value and the arrangement order of the current singular value in the singular value data set;

[0124] A K value determination unit, used for determining a target K value corresponding to a cluster center point in a Kmeans clustering algorithm according to an arrangement order of the current singular value in the singular value data set when the current singular value meets a preset condition;

[0125] A return execution unit, used for returning to execute the operation of sequentially obtaining a singular value from the singular value data set as the current singular value when the current singular value does not meet the preset condition, until the current singular value meets the preset condition;

[0126] An order determination unit is used to determine whether the arrangement order of the current singular value in the singular value data set is less than or equal to the upper limit of the K value;

[0127] a ratio calculation unit, configured to calculate the ratio between the current accumulated value and the accumulated values ​​of all singular values ​​when the arrangement order of the current singular value in the singular value data set is less than or equal to the upper limit of the K value, and if the ratio is greater than a preset energy threshold, determine that the current singular value meets the preset condition;

[0128] A condition determination unit, configured to determine that the current singular value satisfies a preset condition when the arrangement order of the current singular value in the singular value data set is greater than an upper limit value of the K value;

[0129] An order processing unit is used for using the order of the current singular value in the singular value data set as the target K value corresponding to the cluster center point in the Kmeans clustering algorithm if the order of the current singular value in the singular value data set is less than or equal to the upper limit of the K value;

[0130] The upper limit value processing unit is used to use the upper limit value of K value as the target K value corresponding to the cluster center point in the Kmeans clustering algorithm if the arrangement order of the current singular value in the singular value data set is greater than the upper limit value of K value.

[0131] The above device can execute the methods provided by all the above embodiments of the present invention, and has the corresponding functional modules and beneficial effects of executing the above methods. For technical details not fully described in the embodiments of the present invention, please refer to the methods provided by all the above embodiments of the present invention.

[0132] Embodiment 5

[0133] Figure 5 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0134] like Figure 5 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0135] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0136] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the event clustering method.

[0137] In some embodiments, the event clustering method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the event clustering method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the event clustering method in any other appropriate manner (e.g., by means of firmware).

[0138] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0139] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0140] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0141] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0142] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0143] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0144] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0145] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An event clustering method, characterized in that: The method comprises: Acquire multiple target events generated by the monitoring system within a preset time period, and divide the preset time period into multiple continuous time buckets; wherein the target event is system information generated by the monitoring system for informing the user about the current performance indicators, faults, and abnormal states of the system; Counting the target number of occurrences of each target event in a continuous time bucket, and determining the target K value corresponding to the cluster center in the Kmeans clustering algorithm according to the target number of occurrences of each target event; The counting of the target number of occurrences of each target event in a continuous time bucket, and determining the target K value corresponding to the cluster center point in the Kmeans clustering algorithm according to the target number of occurrences of each target event, comprises: According to the timestamps corresponding to the target events, the target number of occurrences of the target events in the continuous time buckets is counted, and then the correlation between the target events is determined according to the statistical results of the target number, and the target K value corresponding to the cluster center in the Kmeans clustering algorithm is determined according to the correlation between the target events; The Kmeans clustering algorithm is used to cluster multiple target events according to the target K value.

2. The method according to claim 1, characterized in that: According to the target number of times corresponding to each of the target events, a target K value corresponding to the cluster center point in the Kmeans clustering algorithm is determined, including: According to the target number of times corresponding to each of the target events, a target data matrix corresponding to the multiple target events is constructed; Performing singular value decomposition on the target data matrix to obtain a plurality of singular values ​​corresponding to the target data matrix; According to the multiple singular values, a target K value corresponding to the cluster center point in the Kmeans clustering algorithm is determined.

3. The method according to claim 2, characterized in that Determining a target K value corresponding to a cluster center point in a Kmeans clustering algorithm according to the multiple singular values ​​includes: Arrange the plurality of singular values ​​in descending order of numerical value to obtain a singular value data set; Sequentially obtaining a singular value from the singular value data set as a current singular value; Accumulating the current singular values ​​one by one to obtain a current accumulated value, and judging whether the current singular value meets a preset condition according to the current accumulated value and the arrangement order of the current singular value in the singular value data set; If yes, then determine the target K value corresponding to the cluster center point in the Kmeans clustering algorithm according to the arrangement order of the current singular value in the singular value data set; If not, the process returns to executing the operation of sequentially acquiring a singular value in the singular value data set as the current singular value until the current singular value meets the preset condition.

4. The method according to claim 3, characterized in that Judging whether the current singular value meets a preset condition according to the current accumulated value and the arrangement order of the current singular value in the singular value data set includes: Determine whether the arrangement order of the current singular value in the singular value data set is less than or equal to the upper limit of the K value; If yes, then calculate the ratio between the current accumulated value and the accumulated values ​​of all singular values, and if the ratio is greater than a preset energy threshold, determine that the current singular value meets the preset condition; If not, it is determined that the current singular value meets the preset condition.

5. The method according to claim 3, characterized in that: According to the arrangement order of the current singular value in the singular value data set, a target K value corresponding to the cluster center point in the Kmeans clustering algorithm is determined, including: If the order of the current singular value in the singular value data set is less than or equal to the upper limit of the K value, the order of the current singular value in the singular value data set is used as the target K value corresponding to the cluster center in the Kmeans clustering algorithm; If the arrangement order of the current singular value in the singular value data set is greater than the upper limit of the K value, the upper limit of the K value is used as the target K value corresponding to the cluster center point in the Kmeans clustering algorithm.

6. The method according to claim 1, characterized in that Get multiple target events generated by the monitoring system within a preset time period, including: Acquire multiple original events generated by the monitoring system within a preset time period, and filter target attributes from multiple event attributes corresponding to each original event; The target attributes corresponding to the original events are compared, and the multiple original events are divided into multiple target events according to the comparison result.

7. An event clustering device, characterized in that: The device comprises: An event acquisition module is used to acquire multiple target events generated by the monitoring system within a preset time period, and divide the preset time period into multiple continuous time buckets; wherein the target event is system information generated by the monitoring system for informing the user about the current performance indicators, faults, and abnormal states of the system; A frequency statistics module is used to count the target times of each target event occurring in a continuous time bucket, and determine the target K value corresponding to the cluster center in the Kmeans clustering algorithm according to the target times corresponding to each target event; the counting of the target times of each target event occurring in a continuous time bucket, and determining the target K value corresponding to the cluster center in the Kmeans clustering algorithm according to the target times corresponding to each target event includes: counting the target times of each target event occurring in a continuous time bucket according to the timestamp corresponding to each target event, and then determining the correlation between each target event according to the statistical result of the target times, and determining the target K value corresponding to the cluster center in the Kmeans clustering algorithm according to the correlation between each target event; The clustering module is used to cluster multiple target events according to the target K value using the Kmeans clustering algorithm.

8. An electronic device, comprising: one or more processors; A storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the event clustering method as described in any one of claims 1 to 6 when executing the programs.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the event clustering method as described in any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, which, when executed by a processor, implements the event clustering method according to any one of claims 1 to 6.

Images