Method, device, equipment and storage medium for identifying alarm event type

Abstract

The present application proposes a method, device, equipment and storage medium for identifying alarm event types, the method comprising: obtaining text content corresponding to the alarm event to be identified according to a preset event field value; identifying the alarm type to which the alarm event belongs based on a preset keyword table and / or annotated data set according to the text content; the preset keyword table includes a mapping relationship between keywords and alarm types; the annotated data set includes sample word vectors, semantic word vectors and alarm types corresponding to the alarm samples. The present application can target real-time event streams, with an identification speed of up to seconds and high timeliness. Based on the preset keyword table or annotated data set, the overall model is easy to understand, the results are highly interpretable, the information richness of the alarm event can be improved, the noise reduction and statistical processing of the alarm event can be assisted, and the user can understand the alarm event more conveniently. At the same time, based on the alarm type, the alarm event can be compressed, aggregated, converged and other operations can be performed to achieve noise reduction and statistics of the alarm event.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, and specifically relates to a method, apparatus, device and storage medium for identifying alarm event types. Background Art

[0002] In the process of using cloud services, the observability of the system is an indispensable part. When a problem or change occurs in the system, a series of events / alarms will be generated to notify the user. However, due to the scale and complexity of the system and the repeated configuration of alarms, there are a large number of repeated and inefficient events in the alarm events. Therefore, it is necessary to classify the alarm events and filter the repeated and inefficient alarm events based on the classification.

[0003] However, there is currently no relevant technology for classifying alarm events, so there is an urgent need to invent a solution for identifying the type of alarm events. Summary of the invention

[0004] This application proposes a method, device, equipment and storage medium for identifying alarm event types, which can identify real-time event streams at a speed of seconds with high timeliness. Based on a preset keyword table or annotated data set, the overall model is easy to understand, the results are highly interpretable, and the information richness of alarm events can be improved, assisting in the noise reduction and statistical processing of alarm events, helping users to understand alarm events more conveniently. At the same time, based on the alarm type, the alarm events can be compressed, aggregated, converged and other operations can be performed to achieve noise reduction and statistics of alarm events.

[0005] The first embodiment of the present application proposes a method for identifying the type of an alarm event, including:

[0006] According to the preset event field value, obtain the text content corresponding to the alarm event to be identified;

[0007] According to the text content, based on a preset keyword table and / or annotated data set, identifying the alarm type to which the alarm event belongs;

[0008] The preset keyword table includes a mapping relationship between keywords and alarm types; the annotated data set includes a sample word vector, a semantic word vector and an alarm type corresponding to the alarm sample.

[0009] The second aspect of the present application provides a device for identifying the type of an alarm event, including:

[0010] The acquisition module is used to obtain the text content corresponding to the alarm event to be identified according to the preset event field value;

[0011] A type identification module, used to identify the alarm type to which the alarm event belongs according to the text content, based on a preset keyword table and / or annotated data set;

[0012] The preset keyword table includes a mapping relationship between keywords and alarm types; the annotated data set includes a sample word vector, a semantic word vector and an alarm type corresponding to the alarm sample.

[0013] An embodiment of the third aspect of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method described in the first aspect above.

[0014] An embodiment of the fourth aspect of the present application provides a computer-readable storage medium on which a computer program is stored, and the program is executed by a processor to implement the method described in the first aspect above.

[0015] The technical solution provided in the embodiments of the present application has at least the following technical effects or advantages:

[0016] In the embodiment of the present application, the alarm type of the alarm event is identified based on a preset keyword table and / or annotated data set, and the calculation speed of the classification result can reach the second level for the real-time event stream, and the algorithm has high timeliness. The type recognition result is determined based on the keywords in the preset keyword table or the most similar alarm sample in the annotated data set that are most similar to the text content of the alarm event. The overall model is easy to understand and the results are highly interpretable. By identifying the alarm type of the alarm event, the information richness of the alarm event can be improved, the noise reduction and statistical processing of the alarm event can be assisted, and the user can be helped to understand the alarm event more conveniently. At the same time, based on the alarm type of the alarm event, the compression aggregation, convergence and other operations of the alarm event can be performed to achieve the noise reduction and statistical effects of the alarm event.

[0017] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] By reading the detailed description of the preferred embodiment below, various other advantages and benefits will become clear to those of ordinary skill in the art. The accompanying drawings are only used for the purpose of illustrating the preferred embodiment and are not considered to be limitations of the present application. In addition, the same reference symbols are used to represent the same components throughout the accompanying drawings.

[0019] In the attached picture:

[0020] Figure 1 A flow chart of a method for identifying alarm event types provided by an embodiment of the present application is shown;

[0021] Figure 2A schematic diagram of adding a process action for identifying an event type to an event processing flow provided by an embodiment of the present application is shown;

[0022] Figure 3 A schematic diagram of a labeled data set provided by an embodiment of the present application is shown;

[0023] Figure 4 A schematic diagram showing the result of identifying the alarm event type provided by an embodiment of the present application is shown;

[0024] Figure 5 A schematic diagram showing the structure of a device for identifying alarm event types provided by an embodiment of the present application is shown;

[0025] Figure 6 A schematic diagram of the structure of an electronic device provided by an embodiment of the present application is shown;

[0026] Figure 7 A schematic diagram of a storage medium provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0027] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0028] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should have the common meanings understood by technicians in the field to which this application belongs.

[0029] The following describes a method, apparatus, device and storage medium for identifying alarm event types according to an embodiment of the present application in conjunction with the accompanying drawings.

[0030] The embodiment of the present application provides a method for identifying the type of alarm event. The method proposes for the first time to identify the type of alarm event and use the identification result in an event processing flow that can be programmed. By using a preset keyword table, the project implementation of identifying the type of alarm event can be quickly implemented. The type of alarm event is identified by a method based on a combination of annotated data sets and preset keyword tables, which strikes a balance between the cost and effect of annotated data. The overall solution has strong feasibility, high interpretability, and good timeliness. By identifying the type of alarm event, the information richness of the alarm event is increased, helping users to understand the type of alarm event more conveniently. The type of alarm event can also be used to compress, aggregate, converge, and other operations on the alarm event to achieve noise reduction and statistical effects of the alarm event.

[0031] See also Figure 1 , the method specifically comprises the following steps:

[0032] Step 101: According to a preset event field value, obtain text content corresponding to the alarm event to be identified.

[0033] The execution subject of the embodiment of the present application may be a server or a terminal device for identifying an alarm event. Among them, the server may be a public cloud server, a private cloud server, or an edge server in a CDN (content distribution network), etc. The embodiment of the present application does not impose any special restrictions on the execution subject, and its execution subject may be any device that can execute the method provided in the embodiment of the present application.

[0034] In cloud application scenarios, there are monitoring services that manage cloud application performance, such as ARMS (Application Real-Time Monitoring Service). This type of monitoring service includes an alarm platform that issues alarms for system failures. The alarm platform displays the failures detected by the monitoring service to users in the form of alarm events. The alarm event includes information such as the alarm name, alarm content, and timestamp.

[0035] The alarm platform provides users with alarm event flow functions. The alarm event flow supports a variety of event processing actions, including the identification and classification of alarm content. Users can enter the alarm management-event processing flow-new event flow in the alarm platform. The event processing flow contains various pre-defined functions, including filtering events, setting event levels, extracting content, segmenting content, identifying event types, etc. In the event processing flow, the process-based autonomous arrangement of these action functions is supported, so as to realize various customized needs of users and meet various event processing requirements of users.

[0036] For the "Identify event type" function, users can add the "Identify event type" process action to the event processing flow to instruct the system to automatically identify the alarm type of each alarm event monitored by the monitoring service. Figure 2 A schematic diagram of the interface for adding the process action of "identifying event type" to the event processing flow is shown.

[0037] When the user adds the process action of "identify event type" to the event processing flow, the event field value used to identify the alarm type can be set. The event field value can be the alarm name or alarm content of the alarm event. If the user does not set the event field value, the system can determine the alarm content as the default event field value. Because the alarm content includes detailed text content describing the alarm event, setting the alarm content as the preset event field value can make the subsequent identification of the alarm event type based on the alarm content more accurate.

[0038] After the user adds the "Identify event type" process action to the event processing flow, whenever the monitoring service monitors an alarm event, it first determines the preset event field value. Then, it obtains the text content corresponding to the event field value from the monitored alarm event. For example, if the event field value is alarm content, it obtains the alarm content text of the current alarm event.

[0039] Step 102: According to the acquired text content, based on a preset keyword table and / or annotated data set, identify the alarm type to which the alarm event belongs.

[0040] In the embodiment of the present application, the alarm type includes an event type and / or an indicator type. The event type is used to indicate the system resources or system objects targeted by the alarm event, such as the event type may include network, storage, computing, system, application, database, change or undefined. The indicator type is used to indicate the performance indicator involved in the alarm event, such as the indicator type may include capacity, availability, latency, error or undefined. The embodiment of the present application does not impose any special restrictions on the specific classification of event types and indicator types.

[0041] The above preset keyword table is formulated based on the keywords of common alarm events, and the preset keyword table includes the mapping relationship between keywords and alarm types. For example, the preset keyword table may include the mapping relationship between the keyword "CPU usage" and the indicator type "capacity", the visual relationship between the keyword "slow query" and the indicator type "latency", and so on.

[0042] The annotated data set is obtained by annotating and organizing historical alarm events. Specifically, the alarm events that occurred in the past are used as alarm samples. For each alarm sample, the alarm content of the alarm sample is preprocessed. The specific process of preprocessing is to detect whether the alarm content of the alarm sample contains vocabulary in a preset language, and the preset language may include English, German, French, and so on. If the vocabulary of the preset language is contained, the vocabulary of the preset language is unified into vocabulary in a preset format. For example, if English vocabulary is included, the English vocabulary is unified into uppercase English words or lowercase English words, and so on. Unifying the vocabulary of the preset language into a preset format can unify the format of foreign language vocabulary, which is convenient for the subsequent further analysis and processing of the alarm content of the alarm sample.

[0043] The embodiment of the present application also sets preset special characters, which may include @, #, / , etc. If it is detected that the alarm sample includes the preset special characters, the preset special characters are deleted from the alarm sample. Deleting the preset special characters can reduce the amount of calculation and improve the accuracy of subsequent recognition of the alarm type.

[0044] After the above-mentioned preprocessing operation is performed on the alarm content of the alarm sample, the alarm content of the alarm sample is segmented according to the preset word length to obtain multiple words corresponding to the alarm sample. The preset word length can be 2, 3 or 4, etc. The preset word length is used to limit the number of characters contained in each segmented word. And the word segmentation processing here is based on the order of arrangement of the characters in the alarm content, and the words are segmented from front to back, and there is no overlap between the two adjacent words segmented. For example, assuming that the preset word length is 2, and the alarm content of the alarm sample is "monitoring alarm sending", then the three words "monitoring", "alarm" and "sending" are segmented.

[0045] In the case of preset languages ​​such as English and French, the same word may have different word types in foreign languages, such as singular, plural, past tense, past participle, present participle and other different word types in English. Therefore, after segmenting the multiple words corresponding to the alarm sample, the segmented multiple words are also subjected to word type restoration processing, that is, words with the same meaning but different word types are unified into the same word type. For example, for English, plural words are all restored to singular form, and words in past tense, past participle and other forms are all restored to the form of general present tense.

[0046] Unifying the word forms of words helps in the subsequent counting of word occurrence frequencies, improves the accuracy of the counting of occurrence frequencies, and further improves the accuracy of the final identification of alarm types.

[0047] After the word form restoration process is performed on multiple words corresponding to the alarm sample in the above manner, the frequency of occurrence of each word is counted. Specifically, the hash value of each word can be calculated separately, and the hash values ​​of each word can be compared to see if they are the same. For the same word, the number of hash values ​​with the same value is counted, and the number is the frequency of occurrence of the word.

[0048] After determining each word and the frequency of occurrence of each word included in the alarm content of the alarm event in the above manner, a sample word vector corresponding to the alarm event is generated according to each word and the frequency of occurrence of each word. The elements in the sample word vector represent the words included in the alarm content of the alarm event and the frequency of occurrence of the words.

[0049] For the alarm sample, the embodiment of the present application also generates a semantic word vector corresponding to the alarm sample. The specific generation process is to use a polygram (N-gram) to segment the text content of the alarm sample to obtain a plurality of words with contextual semantics included in the text content. The polygram may be a bigram (bi-gram) or a tri-gram, etc. There are overlapping parts between adjacent words obtained by segmenting using a polygram, so that the segmented words have contextual semantics. For example, assuming that a bigram is used for segmentation, and the alarm content of the alarm sample is "monitoring alarm sending", the segmented words include "monitoring", "accusation", "alarm", "alarm sending" and "sending".

[0050] The frequency of occurrence of each word in the multiple words with contextual semantics that are segmented is counted. The method of counting the frequency of occurrence can be the same as the method of counting the frequency of occurrence of words in the above-mentioned process of generating sample word vectors, which will not be repeated here. According to each word with contextual semantics and the frequency of occurrence of each word, a semantic word vector corresponding to the alarm event is generated. The elements in the semantic word vector represent the words with contextual semantics included in the alarm content of the alarm event and the frequency of occurrence of the word.

[0051] After generating the sample word vector and semantic word vector corresponding to the alarm sample in the above manner, determine the actual event type and indicator type of the alarm sample. The alarm sample and its corresponding sample word vector, semantic word vector, event type and indicator type constitute a piece of data in the annotated data set. Generate the data corresponding to each other alarm sample in the above manner, and add the data corresponding to each other alarm sample to the annotated data set.

[0052] The above describes the process of building a labeled data set based on the alarm content of the alarm sample. Similarly, a labeled data set can be built based on the alarm name or other event field values ​​of the alarm sample. The labeled data sets corresponding to different event field values ​​are configured in the system. In actual applications, the corresponding labeled data set can be selected according to the event field values ​​preset by the user, or according to the default event field values ​​when the user does not specify the event field values. Figure 3 A schematic diagram of a labeled data set constructed based on alarm content is shown.

[0053] After the preset keyword table and the annotated data set are preconfigured in the system in the above manner, the preset keyword table and / or the annotated data set can be used to online identify the alarm type to which the alarm event belongs.

[0054] In one implementation, the alarm type to which the alarm event belongs may be identified only according to a preset keyword table.

[0055] Specifically, for each keyword in the preset keyword table, the text content of the alarm event is queried to see whether it contains a keyword. If the text content is found to contain a keyword, the alarm type corresponding to the keyword in the preset keyword table is determined as the alarm type to which the alarm event belongs.

[0056] This implementation method identifies the alarm type of an alarm event through keywords, can quickly determine the alarm type to which the alarm event belongs, and improves the efficiency of identifying the alarm event type.

[0057] In another implementation, the alarm type to which the alarm event belongs may be identified only based on the labeled data set.

[0058] For the text content of the alarm event to be identified obtained in step 101, a word vector and a semantic word vector corresponding to the alarm event are generated according to the text content.

[0059] For the word vector corresponding to the alarm event, the specific generation process is the same as the process of generating the sample word vector of each alarm sample in the labeled data set mentioned above, which will not be repeated here.

[0060] For the semantic word vector corresponding to the alarm event, the specific generation process is the same as the process of generating the semantic word vector of each alarm sample in the labeled data set mentioned above, which will not be repeated here.

[0061] After obtaining the word vector and semantic word vector of the alarm event, obtain the pre-configured annotated data set corresponding to the event field value according to the preset event field value. According to the annotated data set, the word vector and semantic word vector corresponding to the alarm event, calculate the similarity between the alarm event and each alarm sample in the annotated data set.

[0062] Since the calculation process of the similarity between the alarm event and each alarm sample in the annotated data set is the same, the calculation process of the similarity is specifically described by taking the first alarm sample as an example. The first alarm sample is any alarm sample in the annotated data set. The embodiment of the present application can use KNN (k nearest neighbor classification algorithm) to determine the alarm type of the alarm event, and the value of k can be 1, 2, 3, etc. The embodiment of the present application does not impose any special restrictions on the specific value of k.

[0063] Specifically, a first similarity between the word vector corresponding to the alarm event and the sample word vector corresponding to the first alarm sample is calculated. Also, a second similarity between the semantic word vector corresponding to the alarm event and the semantic word vector corresponding to the first alarm sample is calculated. Based on the first similarity and the second similarity, the similarity between the alarm event and the first alarm sample is calculated.

[0064] In an embodiment of the present application, the calculation of the first similarity and the second similarity can adopt any algorithm that can measure text similarity, set similarity or vector similarity. As an example, the Jacard similarity algorithm is adopted to calculate the first similarity and the second similarity. Jacard similarity is generally used to measure the difference between two sets. Assuming there are two sets A and B, the Jacard similarity of the two is:

[0065]

[0066] The idea of ​​this similarity measure is that the more elements two sets have in common, the more similar they are.

[0067] The similarity between words is an important component of text similarity and the basis of sentence, paragraph and document similarity. The word vector and semantic word vector of the above-mentioned alarm event, as well as the sample word vector and semantic word vector of each alarm sample in the annotated data set, are equivalent to a set composed of words. Therefore, the first similarity s1 between the word vector of the alarm event and the sample word vector of the first alarm sample can be calculated by the above-mentioned Jacard similarity calculation formula, and the second similarity s2 between the semantic word vector of the alarm event and the semantic word vector of the first alarm sample can be calculated.

[0068] Then, the similarity between the alarm event and the first alarm sample is calculated based on the first similarity s1 and the second similarity s2. As an example, the arithmetic mean of the first similarity s1 and the second similarity s2 can be calculated, that is, (s1+s2) / 2. As another example, the first similarity s1 and the second similarity s2 can be weighted and summed, and the weight coefficients of the first similarity and the second similarity can be set equal, or the weight coefficient of the second similarity can be set greater than the weight coefficient of the first similarity to highlight the influence of contextual semantics in the similarity calculation process. Alternatively, the weight coefficient of the first similarity is set greater than the weight coefficient of the second similarity. For example, the weight coefficient of the first similarity can be set to 0.4, and the weight coefficient of the second similarity can be set to 0.6, then the similarity between the alarm event and the first alarm sample is (0.4s1+0.6s2).

[0069] For each other alarm sample in the annotated data set, the similarity between the alarm event and each other alarm sample is calculated in the same manner as above.

[0070] Then, the alarm type to which the alarm event belongs is determined based on the similarity between the alarm event and each alarm sample in the annotated data set. Specifically, the alarm type to which the alarm event belongs is determined based on the alarm types corresponding to the preset number of alarm samples with the largest similarity. The preset number can be the value of k in the KNN algorithm used above, which can be 1, 2, 3, etc.

[0071] Specifically, if the value of k is 1, the alarm type of the alarm sample corresponding to the maximum similarity is selected as the alarm type to which the alarm event belongs. If the value of k is not 1, it is determined whether there are repeated alarm types in the alarm types corresponding to the preset number of alarm samples with the greatest similarity; if so, the alarm type with the largest number of repetitions is determined, and the alarm type with the largest number of repetitions is determined as the alarm type to which the alarm event belongs; if there are no repeated alarm types in the alarm types corresponding to the preset number of alarm samples with the greatest similarity, the alarm type of the alarm sample corresponding to the maximum similarity is used as the alarm type to which the alarm event belongs.

[0072] In other embodiments of the present application, considering that after calculating the similarity between the alarm event and each alarm sample in the annotated data set in the above manner, there may be a situation where the maximum similarity is also relatively low, in order to avoid the problem that the alarm type finally determined in this case is not accurate enough. In the embodiment of the present application, a preset threshold value of similarity is pre-set in the system, and the preset threshold value can be 0.7, 0.75, 0.8, etc. The embodiment of the present application does not impose any special restrictions on the specific value of the preset threshold value.

[0073] After obtaining the similarity between the alarm event and each alarm sample in the above manner, determine whether there is a similarity greater than or equal to the preset threshold in the calculated similarity. If so, determine the alarm type to which the alarm event belongs based on the alarm type of the alarm sample corresponding to the similarity greater than or equal to the preset threshold. The specific determination process is similar to the above, and the alarm type corresponding to the maximum similarity can be used as the alarm type to which the alarm event belongs. Alternatively, the alarm type with the largest number of repetitions among the alarm types corresponding to the similarity greater than or equal to the preset threshold can also be used as the alarm type to which the alarm event belongs.

[0074] If the calculated similarities are all less than the preset threshold, the alarm type to which the alarm event belongs is identified based on the text content and the preset keyword table. The specific process of identifying the alarm type based on the preset keyword table has been described in detail above and will not be repeated here.

[0075] In the above-mentioned case where the similarity between the alarm event and all the alarm samples in the labeled data set is low, a preset keyword table is used to identify the alarm type of the alarm event. By performing a secondary verification based on the preset keyword table, it is possible to avoid the situation where the alarm event type cannot be accurately identified by using a similarity measurement based on the labeled data set. In particular, when the alarm event is a newly occurring alarm event, the alarm type of the alarm event can be accurately identified.

[0076] In the above process of identifying the alarm event type based on the labeled data set, the semantic word vector of the alarm event is used, the contextual semantics of the alarm event is fully utilized, and the accuracy of identifying the alarm event type is improved.

[0077] In some other embodiments of the present application, the alarm event type can also be identified by training a classification model based on a labeled data set. Specifically, the alarm classification model is iteratively trained based on the labeled data set. The alarm classification model may include xgboost, svm (support vector machine), etc. The trained alarm classification model is used to identify the alarm type to which the alarm event belongs.

[0078] The alarm type to which the alarm event to be identified belongs can be identified through any of the above implementation modes. Figure 4 A schematic diagram showing the result of identifying the alarm type of an alarm event is shown. Figure 4 The left side shows the contents of each event field value included in the alarm event. Figure 4 The right side shows the processing result after processing. Figure 4 It can be seen that after adding the "Identify Event Type" function, two contents, type-capacity and class-calculation, are added to the processed results. Type-capacity is the indicator type in the embodiment of the present application, and class-calculation is the event type in the embodiment of the present application.

[0079] In the embodiment of the present application, more new alarm events will appear over time, and the sample word vectors and semantic word vectors corresponding to the new alarm events are generated in the manner described above, and the new alarm event and its sample word vector, semantic word vector and its alarm type are added to the annotated data set as a piece of data. For the newly appeared alarm event, its keywords can also be extracted, and the mapping relationship between its keywords and its alarm type is added to the preset keyword table.

[0080] After the alarm type of the alarm event is identified by any of the above implementations in this application, a type field can be added to the alarm event, and the alarm type corresponding to the alarm event is assigned to the type field. By adding a type field to the alarm event, the information richness of the alarm event can be improved, which helps users to understand the alarm event more comprehensively.

[0081] After adding the type field to the alarm event, noise reduction and / or statistical processing can be performed on all the alarm events received by the user according to the type field of each alarm event.

[0082] For noise reduction processing, since there may be repeated or inefficient alarm events among the alarm events received by users, after adding a type field to the alarm event, the alarm events of the same alarm type can be clustered according to the type field of each alarm event, and the alarm events corresponding to the repeated or inefficient alarm types can be deleted.

[0083] For statistical processing, the number of alarm events corresponding to each alarm type and the number distribution of alarm events of various alarm types can be counted according to the type field of each alarm event.

[0084] In the embodiment of the present application, the alarm type of the alarm event is identified based on a preset keyword table and / or annotated data set, and the calculation speed of the classification result can reach the second level for the real-time event stream, and the algorithm has high timeliness. The type recognition result is determined based on the keywords in the preset keyword table or the most similar alarm sample in the annotated data set that are most similar to the text content of the alarm event. The overall model is easy to understand and the results are highly interpretable. By identifying the alarm type of the alarm event, the information richness of the alarm event can be improved, the noise reduction and statistical processing of the alarm event can be assisted, and the user can be helped to understand the alarm event more conveniently. At the same time, based on the alarm type of the alarm event, the compression aggregation, convergence and other operations of the alarm event can be performed to achieve the noise reduction and statistical effects of the alarm event.

[0085] The present application also provides a device for identifying the type of an alarm event, which is used to perform the method for identifying the type of an alarm event provided in any of the above embodiments. Figure 5 As shown, the device comprises:

[0086] The acquisition module 501 is used to acquire the text content corresponding to the alarm event to be identified according to the preset event field value;

[0087] A type identification module 502 is used to identify the alarm type to which the alarm event belongs according to the text content, based on a preset keyword table and / or annotated data set;

[0088] The preset keyword table includes the mapping relationship between keywords and alarm types; the labeled data set includes sample word vectors, semantic word vectors and alarm types corresponding to the alarm samples.

[0089] The type identification module 502 is used to generate word vectors and semantic word vectors corresponding to the alarm event according to the text content; calculate the similarity between the alarm event and each alarm sample in the annotated data set according to the annotated data set, the word vectors and semantic word vectors corresponding to the alarm event; determine the alarm type to which the alarm event belongs according to the alarm types corresponding to a preset number of alarm samples with the largest similarity.

[0090] The type identification module 502 is used to perform word segmentation processing on the text content to obtain multiple words included in the text content; perform word type restoration processing on the multiple words; count the frequency of occurrence of each word in the multiple words after word type restoration; and generate a word vector corresponding to the alarm event based on each word after word type restoration and the frequency of occurrence of each word.

[0091] The type identification module 502 is used to perform word segmentation processing on the text content using polynomial grammar to obtain multiple words with contextual semantics included in the text content; count the frequency of occurrence of each word in the multiple words with contextual semantics; and generate a semantic word vector corresponding to the alarm event based on each word and the frequency of occurrence of each word.

[0092] The type identification module 502 is used to calculate the first similarity between the word vector corresponding to the alarm event and the sample word vector corresponding to the first alarm sample; the first alarm sample is any alarm sample in the labeled data set; calculate the second similarity between the semantic word vector corresponding to the alarm event and the semantic word vector corresponding to the first alarm sample; and calculate the similarity between the alarm event and the first alarm sample based on the first similarity and the second similarity.

[0093] The type identification module 502 is used to select the alarm type of the alarm sample corresponding to the maximum similarity as the alarm type to which the alarm event belongs; or, determine whether there are repeated alarm types among the alarm types corresponding to a preset number of alarm samples with the greatest similarity; if yes, determine the alarm type with the largest number of repetitions, and determine the alarm type with the largest number of repetitions as the alarm type to which the alarm event belongs; if not, determine the alarm type of the alarm sample corresponding to the maximum similarity as the alarm type to which the alarm event belongs.

[0094] The type identification module 502 is used to determine the alarm type to which the alarm event belongs based on the alarm type of the alarm sample corresponding to the similarity greater than or equal to the preset threshold if the calculated similarities include similarities greater than or equal to the preset threshold; or, if the calculated similarities are all less than the preset threshold, identify the alarm type to which the alarm event belongs based on the text content and based on a preset keyword table.

[0095] The type identification module 502 is used to iteratively train the alarm classification model according to the labeled data set; and use the trained alarm classification model to identify the alarm type to which the alarm event belongs.

[0096] The type identification module 502 is used to query whether the text content contains the keyword for each keyword in the preset keyword table; if the text content contains the keyword, the alarm type corresponding to the keyword in the preset keyword table is determined as the alarm type to which the alarm event belongs.

[0097] The device also includes: a type field adding module, which is used to add a type field to the alarm event and assign the alarm type corresponding to the alarm event to the type field; the alarm type includes an event type and / or an indicator type, and the indicator type is used to indicate the performance indicator involved in the alarm event.

[0098] The device also includes: a noise reduction or statistics module, which is used to perform noise reduction and / or statistics processing on all alarm events received by the user according to the type field of each alarm event.

[0099] The device for identifying the type of alarm event provided in the above-mentioned embodiment of the present application and the method for identifying the type of alarm event provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the method adopted, run or implemented by the application program stored therein.

[0100] The present application also provides an electronic device to perform the above method for identifying the type of alarm event. Figure 6 , which shows a schematic diagram of an electronic device provided by some embodiments of the present application. Figure 6 As shown, the electronic device 4 includes: a processor 400, a memory 401, a bus 402 and a communication interface 403, and the processor 400, the communication interface 403 and the memory 401 are connected via the bus 402; the memory 401 stores a computer program that can be run on the processor 400, and when the processor 400 runs the computer program, it executes the method for identifying the type of alarm event provided in any of the aforementioned embodiments of the present application.

[0101] The memory 401 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk storage. The communication connection between the device network element and at least one other network element is realized through at least one communication interface 403 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used.

[0102] The bus 402 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The memory 401 is used to store a program, and the processor 400 executes the program after receiving an execution instruction. The method for identifying the type of alarm event disclosed in any implementation of the embodiment of the present application may be applied to the processor 400, or implemented by the processor 400.

[0103] The processor 400 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 400. The above processor 400 can be a general-purpose processor, including a processor (Central Processing Unit, referred to as CPU), a network processor (Network Processor, referred to as NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a readily available programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor to be executed, or the hardware and software modules in the decoding processor can be executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 401, and the processor 400 reads the information in the memory 401 and completes the steps of the above method in combination with its hardware.

[0104] The electronic device provided in the embodiment of the present application and the method for identifying the type of alarm event provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, operated or implemented therein.

[0105] The present application also provides a computer-readable storage medium corresponding to the method for identifying the type of alarm event provided in the above embodiment. Figure 7 The computer-readable storage medium shown is a CD 30 on which a computer program (ie, a program product) is stored. When the computer program is executed by a processor, the method for identifying the type of alarm event provided by any of the aforementioned embodiments will be executed.

[0106] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.

[0107] The computer-readable storage medium provided in the above-mentioned embodiments of the present application and the method for identifying the type of alarm event provided in the embodiments of the present application are based on the same inventive concept and have the same beneficial effects as the method adopted, run or implemented by the application program stored therein.

[0108] It should be noted that:

[0109] In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. In some instances, well-known structures and technologies are not shown in detail so as not to obscure the understanding of this description.

[0110] Similarly, it should be understood that in order to streamline the present application and help understand one or more of the various inventive aspects, in the above description of the exemplary embodiments of the present application, the various features of the present application are sometimes grouped together into a single embodiment, figure, or description thereof. However, the disclosed method should not be interpreted as reflecting the following schematic diagram: the claimed application requires more features than the features clearly stated in each claim. More specifically, as reflected in the claims below, the inventive aspects are less than all the features of the single embodiment disclosed above. Therefore, the claims following the specific embodiment are hereby expressly incorporated into the specific embodiment, wherein each claim itself serves as a separate embodiment of the present application.

[0111] In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present application and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0112] The above is only a preferred specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for identifying the type of an alarm event, characterized in that: The method comprises: According to the preset event field value, obtain the text content corresponding to the alarm event to be identified; According to the text content, based on a preset keyword table and annotated data set, identifying the alarm type to which the alarm event belongs; The preset keyword table includes a mapping relationship between keywords and alarm types; the annotated data set includes a sample word vector, a semantic word vector and an alarm type corresponding to the alarm sample; The step of identifying the alarm type to which the alarm event belongs based on the text content, a preset keyword table and a labeling data set includes: The similarities between the alarm event and each alarm sample in the annotated data set are calculated respectively; if there is a similarity greater than or equal to a preset threshold among the calculated similarities, the alarm type to which the alarm event belongs is determined according to the alarm type of the alarm sample corresponding to the similarity greater than or equal to the preset threshold; if the calculated similarities are all less than the preset threshold, the preset keyword table is used to identify the alarm type of the alarm event according to the text content.

2. The method according to claim 1, characterized in that According to the text content and based on the annotated data set, identifying the alarm type to which the alarm event belongs includes: According to the text content, respectively generate a word vector and a semantic word vector corresponding to the alarm event; According to the annotated data set, the word vector corresponding to the alarm event and the semantic word vector, respectively calculating the similarity between the alarm event and each alarm sample in the annotated data set; The alarm type to which the alarm event belongs is determined according to the alarm types corresponding to a preset number of alarm samples with the greatest similarity.

3. The method according to claim 2, characterized in that Generating a word vector corresponding to the alarm event according to the text content includes: Performing word segmentation processing on the text content to obtain a plurality of words included in the text content; Performing word form restoration processing on the multiple words; Counting the occurrence frequency of each word in the plurality of words after word type restoration; According to each word after word form restoration and the frequency of occurrence of each word, a word vector corresponding to the alarm event is generated.

4. The method according to claim 2, characterized in that: Generating a semantic word vector corresponding to the alarm event according to the text content includes: Performing word segmentation processing on the text content by using polysyntax to obtain a plurality of words with contextual semantics included in the text content; Count the frequency of occurrence of each word in multiple words with contextual semantics; According to each word and the frequency of occurrence of each word, a semantic word vector corresponding to the alarm event is generated.

5. The method according to claim 2, characterized in that: The calculating the similarity between the alarm event and each alarm sample in the annotated data set respectively according to the word vector and the semantic word vector corresponding to the annotated data set and the alarm event includes: Calculating a first similarity between a word vector corresponding to the alarm event and a sample word vector corresponding to a first alarm sample; the first alarm sample is any alarm sample in the labeled data set; Calculating a second similarity between the semantic word vector corresponding to the alarm event and the semantic word vector corresponding to the first alarm sample; The similarity between the alarm event and the first alarm sample is calculated according to the first similarity and the second similarity.

6. The method according to claim 2, characterized in that Determining the alarm type to which the alarm event belongs according to the alarm types corresponding to the preset number of alarm samples with the greatest similarity includes: Selecting the alarm type of the alarm sample corresponding to the maximum similarity as the alarm type to which the alarm event belongs; or, Determine whether there are repeated alarm types among the alarm types corresponding to a preset number of alarm samples with the greatest similarity; if so, determine the alarm type with the largest number of repetitions, and determine the alarm type with the largest number of repetitions as the alarm type to which the alarm event belongs; if not, use the alarm type of the alarm sample corresponding to the maximum similarity as the alarm type to which the alarm event belongs.

7. The method according to claim 1, characterized in that According to the text content and based on the annotated data set, identifying the alarm type to which the alarm event belongs includes: Iteratively train the alarm classification model based on the labeled data set; The trained alarm classification model is used to identify the alarm type to which the alarm event belongs.

8. The method according to any one of claims 1 to 7, characterized in that: According to the text content, based on a preset keyword table, identifying the alarm type to which the alarm event belongs, including: For each keyword in the preset keyword table, query whether the text content contains the keyword; If it is found that the text content contains the keyword, the alarm type corresponding to the keyword in the preset keyword table is determined as the alarm type to which the alarm event belongs.

9. The method according to any one of claims 1 to 7, characterized in that: After identifying the alarm type to which the alarm event belongs, the method further includes: Adding a type field to the alarm event, and assigning the alarm type corresponding to the alarm event to the type field; The alarm type includes an event type and / or an indicator type, and the indicator type is used to indicate a performance indicator involved in the alarm event.

10. The method according to claim 9, characterized in that After adding a type field to the alarm event and assigning the alarm type corresponding to the alarm event to the type field, the method further includes: According to the type field of each alarm event, noise reduction and / or statistical processing are performed on all alarm events received by the user.

11. A device for identifying the type of an alarm event, characterized in that: The device comprises: The acquisition module is used to obtain the text content corresponding to the alarm event to be identified according to the preset event field value; A type identification module, used to identify the alarm type to which the alarm event belongs according to the text content, based on a preset keyword table and annotated data set; The preset keyword table includes a mapping relationship between keywords and alarm types; the annotated data set includes a sample word vector, a semantic word vector and an alarm type corresponding to the alarm sample; The type identification module is specifically used to calculate the similarities between the alarm event and each alarm sample in the annotated data set respectively; if there is a similarity greater than or equal to a preset threshold among the calculated similarities, the alarm type to which the alarm event belongs is determined according to the alarm type of the alarm sample corresponding to the similarity greater than or equal to the preset threshold; if the calculated similarities are all less than the preset threshold, the preset keyword table is used to identify the alarm type of the alarm event according to the text content.

12. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: The processor runs the computer program to implement the method described in any one of 1-10.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement any one of the methods described in 1-10.

Images