Method, device and equipment for determining alarm urgency and storage medium

Abstract

The application provides a method, device and equipment for determining the urgency of an alarm and a storage medium. The method comprises the following steps: calculating the first importance of each table to be processed according to the table attribute characteristics of each table to be processed in a system to be monitored; determining the second importance of each table to be processed according to the target response time of the staff to the alarm information generated by the table to be processed in a historical period; when the first importance and the second importance of the table to be processed are not equal, determining the target importance of the table to be processed according to the second importance of the table to be processed, the upstream table information and the downstream table information; and finally determining the corresponding urgency of the alarm according to the target importance of the table to be processed. In the technical solution, the second importance is further corrected according to the upstream table information and the downstream table information, and the accuracy of the target importance obtained by correction is improved.

Description

Technical Field

[0001] This application relates to the field of financial technology, and in particular to a method, apparatus, device, and storage medium for determining the urgency of an alarm. Background Technology

[0002] As financial institutions continue to deepen their internet finance business, their information systems are becoming increasingly large and complex. To ensure the normal operation of these systems, alarm monitoring systems can be used to monitor them, enabling timely notification of maintenance personnel to address any malfunctions or problems, thereby protecting users' assets and information security.

[0003] Currently, the notification method for operations and maintenance (O&M) personnel is primarily determined by the urgency of the alarm. For example, extremely urgent alarms will be communicated to O&M personnel by phone at any time of day, moderately urgent alarms will be communicated during the day, and generally urgent or non-urgent alarms will be communicated via email. The urgency level is uniformly set by the alarm type; for instance, alarms such as "the table has 0 data points for the day" are considered extremely urgent, while alarms such as "some fields are missing from the table" are considered generally urgent or non-urgent. The aforementioned tables are used to store or process information system data.

[0004] However, the existing technology of determining alarm urgency based on the amount of data in the table has inaccuracy issues. Summary of the Invention

[0005] This application provides a method, apparatus, device, and storage medium for determining the urgency of alarms, in order to solve the problem of low accuracy in the prior art.

[0006] In a first aspect, embodiments of this application provide a method for determining the urgency of an alarm, including:

[0007] Based on the table attribute characteristics of each table to be processed in the system to be monitored, the first importance of each table to be processed is calculated. The importance is used to indicate the degree of influence of the table to be processed on the system to be monitored.

[0008] For each table to be processed, the second importance of the table is determined based on the target response time of the alarm information generated by the staff within the historical time period for the table to be processed.

[0009] When the first importance of the table to be processed is not equal to the second importance, the target importance of the table to be processed is determined based on the second importance of the table to be processed, the upstream table information, and the downstream table information. The upstream table information includes the number of upstream tables and their current importance, and the downstream table information includes the number of downstream tables and their current importance.

[0010] Determine the corresponding alarm urgency based on the target importance of the table to be processed.

[0011] In one possible design of the first aspect, determining the second importance of each form to be processed based on the target response time of alarm information generated by the staff for that form within a historical time period includes:

[0012] For each table to be processed, the target response time of the alarm information is calculated based on the time when the staff member views and processes the alarm information;

[0013] Based on the target response duration and the mapping relationship, the second importance corresponding to the target response duration is determined, where the mapping relationship is the correspondence between response duration and importance.

[0014] In another possible design of the first aspect, determining the target importance of the table to be processed based on the second importance of the table to be processed, the upstream table information, and the downstream table information includes:

[0015] Calculate the ratio of the current total importance of the upstream tables to the number of upstream tables to obtain the first ratio;

[0016] Calculate the ratio of the current total importance of the downstream tables to the number of downstream tables to obtain a second ratio;

[0017] Based on the first weight value, the second weight value, and the third weight value, the weighted sum of the first ratio, the second ratio, and the second importance is determined as the target importance of the table to be processed.

[0018] In another possible design of the first aspect, the table attribute features include scale dimension features, usage frequency dimension features, mediation dimension features, and business dimension features. The scale dimension features include field count sub-features, record count sub-features, and partition count sub-features. The usage frequency dimension features include update frequency sub-features and query frequency sub-features. The mediation dimension features include upstream table count sub-features and downstream table count sub-features. The business dimension features are determined based on pre-defined table fields.

[0019] Optionally, the step of calculating the first importance of each table to be processed based on the table attribute characteristics of each table to be processed in the system to be monitored includes:

[0020] For each dimension feature, effective features are determined from all sub-features in the dimension feature based on the sub-feature value corresponding to each sub-feature in the dimension feature. The concentration of the effective features is less than the average concentration of all sub-features in the dimension feature. The concentration is determined based on the number of sub-feature values ​​and the number of sub-features.

[0021] Calculate the first importance of the table to be processed based on its valid characteristics.

[0022] Optionally, calculating the first importance of the table to be processed based on its valid characteristics includes:

[0023] For each table to be processed, calculate the initial importance of the table based on its valid features;

[0024] Based on the initial importance of each table to be processed, all tables to be processed are clustered to obtain multiple table sets;

[0025] For each set of tables, the first importance of each table to be processed in the set is determined based on the labeling results of some labeled tables in the set. The labeled tables are the tables in the set that have been manually labeled, and the labeling results are used to represent the importance of the labeled tables determined manually.

[0026] Optionally, determining the first importance of each table to be processed in the table set based on the labeling results of some labeled tables in the table set includes:

[0027] Based on the labeling results of some of the labeled tables in the table set, calculate the importance difference of the labeled tables.

[0028] When the importance difference is less than or equal to the preset importance difference, the first importance of each table to be processed in the table set is determined according to the labeling results of the partial labeling tables.

[0029] When the importance difference is greater than the preset importance difference, all tables to be processed are re-clustered according to the initial importance of each table to be processed, to obtain multiple tables after re-clustering, and to determine the first importance of each table to be processed in each table set after re-clustering.

[0030] Optionally, determining the first importance of each table to be processed in the table set based on the labeling results of the partial labeling tables includes:

[0031] Based on the marking results of the partial marking tables, calculate the average importance of the partial marking tables;

[0032] The average importance is determined as the first importance of the remaining tables in the table set;

[0033] The marking results of the aforementioned partial marking table are determined as the first importance of the aforementioned partial marking table.

[0034] In another possible design of the first aspect, after determining the second importance of each form to be processed based on the target response time of alarm information generated by the staff for that form within a historical time period, the method further includes:

[0035] When the first importance of the table to be processed is equal to the second importance, the second importance is determined as the target importance of the table to be processed.

[0036] Secondly, embodiments of this application provide an alarm urgency determination device, comprising:

[0037] The calculation module is used to calculate the first importance of each table to be processed based on the table attribute characteristics of each table to be processed in the system to be monitored. The importance is used to indicate the degree of influence of the table to be processed on the system to be monitored.

[0038] The determination module is used to determine the second importance of each form to be processed based on the target response time of alarm information generated by staff for the form in the historical time period.

[0039] The determining module is further configured to determine the target importance of the table to be processed based on the second importance of the table to be processed, upstream table information, and downstream table information when the first importance of the table to be processed is not equal to the second importance of the table to be processed. The upstream table information includes the number of upstream tables and their current importance, and the downstream table information includes the number of downstream tables and their current importance.

[0040] The determining module is also used to determine the corresponding alarm urgency based on the target importance of the table to be processed.

[0041] In one possible design of the second aspect, the determining module is specifically used for:

[0042] For each table to be processed, the target response time of the alarm information is calculated based on the time when the staff member views and processes the alarm information;

[0043] Based on the target response duration and the mapping relationship, the second importance corresponding to the target response duration is determined, where the mapping relationship is the correspondence between response duration and importance.

[0044] In another possible design of the second aspect, the determining module is specifically used for:

[0045] Calculate the ratio of the current total importance of the upstream tables to the number of upstream tables to obtain the first ratio;

[0046] Calculate the ratio of the current total importance of the downstream tables to the number of downstream tables to obtain a second ratio;

[0047] Based on the first weight value, the second weight value, and the third weight value, the weighted sum of the first ratio, the second ratio, and the second importance is determined as the target importance of the table to be processed.

[0048] In another possible design of the second aspect, the table attribute features include scale dimension features, usage frequency dimension features, mediation dimension features, and business dimension features. The scale dimension features include field count sub-features, record count sub-features, and partition count sub-features. The usage frequency dimension features include update frequency sub-features and query frequency sub-features. The mediation dimension features include upstream table count sub-features and downstream table count sub-features. The business dimension features are determined based on pre-defined table fields.

[0049] Optionally, the computing module is specifically used for:

[0050] For each dimension feature, effective features are determined from all sub-features in the dimension feature based on the sub-feature value corresponding to each sub-feature in the dimension feature. The concentration of the effective features is less than the average concentration of all sub-features in the dimension feature. The concentration is determined based on the number of sub-feature values ​​and the number of sub-features.

[0051] Calculate the first importance of the table to be processed based on its valid characteristics.

[0052] Optionally, the computing module is specifically used for:

[0053] For each table to be processed, calculate the initial importance of the table based on its valid features;

[0054] Based on the initial importance of each table to be processed, all tables to be processed are clustered to obtain multiple table sets;

[0055] For each set of tables, the first importance of each table to be processed in the set is determined based on the labeling results of some labeled tables in the set. The labeled tables are the tables in the set that have been manually labeled, and the labeling results are used to represent the importance of the labeled tables determined manually.

[0056] Optionally, the computing module is specifically used for:

[0057] Based on the labeling results of some of the labeled tables in the table set, calculate the importance difference of the labeled tables.

[0058] When the importance difference is less than or equal to the preset importance difference, the first importance of each table to be processed in the table set is determined according to the labeling results of the partial labeling tables.

[0059] When the importance difference is greater than the preset importance difference, all tables to be processed are re-clustered according to the initial importance of each table to be processed, to obtain multiple tables after re-clustering, and to determine the first importance of each table to be processed in each table set after re-clustering.

[0060] Optionally, the computing module is specifically used for:

[0061] Based on the marking results of the partial marking tables, calculate the average importance of the partial marking tables;

[0062] The average importance is determined as the first importance of the remaining tables in the table set;

[0063] The marking results of the aforementioned partial marking table are determined as the first importance of the aforementioned partial marking table.

[0064] In another possible design of the second aspect, after determining the second importance of each form to be processed based on the target response time of alarm information generated by the staff for that form within a historical time period, the determining module is further configured to:

[0065] When the first importance of the table to be processed is equal to the second importance, the second importance is determined as the target importance of the table to be processed.

[0066] Thirdly, embodiments of this application provide an electronic device, including: a processor, a memory, and computer program instructions stored in the memory and executable on the processor, wherein the processor executes the computer program instructions to implement the methods provided in the first aspect and various possible designs.

[0067] Fourthly, embodiments of this application may provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods provided in the first aspect and various possible designs.

[0068] The alarm urgency determination method, apparatus, device, and storage medium provided in this application embodiment calculate the first importance of each table to be processed based on its table attribute characteristics in the monitored system. For each table, a second importance is determined based on the target response time of alarm information generated by staff within a historical time period. When the first and second importance of a table are not equal, a target importance is determined based on the second importance, upstream table information, and downstream table information. Finally, the corresponding alarm urgency is determined based on the target importance of the table. In this scheme, the second importance is determined based on the staff's response speed to alarms from tables to be processed within a historical time period. When it is determined that the importance of a table to be processed changes over time based on the second and first importance, the second importance is further corrected based on the upstream and downstream table information, thereby improving the accuracy of the corrected target importance. Attached Figure Description

[0069] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0070] Figure 1 A schematic diagram illustrating an application scenario of the alarm urgency determination method provided in this application embodiment;

[0071] Figure 2 A flowchart illustrating an embodiment of the method for determining alarm urgency provided in this application.

[0072] Figure 3 A flowchart illustrating a second embodiment of the method for determining alarm urgency provided in this application.

[0073] Figure 4 A flowchart illustrating Embodiment 3 of the method for determining alarm urgency provided in this application;

[0074] Figure 5 A schematic diagram of the alarm urgency determination device provided in the embodiments of this application;

[0075] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0076] The accompanying drawings have illustrated specific embodiments of this disclosure, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concepts of this disclosure to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0077] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0078] Before introducing the embodiments of this application, the application background of the embodiments of this application will be explained first:

[0079] In existing technologies, alarm urgency is typically determined by the type of alarm information, and then the method for notifying operations and maintenance personnel is determined based on that urgency. However, determining alarm urgency solely based on alarm type is too simplistic and prone to inaccuracies.

[0080] During their research on methods for determining alarm urgency, the inventors discovered that even for the same type of alarm information, the importance of the table that generated that alarm differs to the information system. For example, if table A has 100 downstream tables, while table B has only one, and both tables generate the alarm message "the table's daily data volume is 0," table A needs immediate processing; otherwise, it will affect the calculation of a large number of downstream tables. Table B, on the other hand, can have its processing delayed. However, in existing technologies, tables A and B have the same alarm urgency, requiring maintenance personnel to immediately process the less important table B, diverting their attention and preventing them from prioritizing more important alarm information. Furthermore, the importance of each table may change over time. The importance of a table in the information system can be determined by the response time of maintenance personnel to alarm information generated in the table within a historical period, as well as the information of the upstream and downstream tables. This allows for the accurate determination of the alarm urgency corresponding to the table, enabling the appropriate method to be selected to notify maintenance personnel to process the alarm information based on the determined alarm urgency. This achieves the goal of prioritizing alarm information with a high impact on the information system and rationally allocating the maintenance personnel's energy.

[0081] For example, the alarm urgency determination method provided in this application embodiment can be applied to... Figure 1 The diagram shows one application scenario. Figure 1 This diagram illustrates an application scenario of the alarm urgency determination method provided in this application embodiment, used to solve the aforementioned technical problems. For example... Figure 1 As shown, this application scenario can include: terminal devices, the system to be monitored, and electronic devices. The system to be monitored and the electronic devices, as well as the terminal devices and the system to be monitored, can communicate and interact wirelessly.

[0082] During the operation phase of the system to be monitored, the operating data can be stored or processed in the form of tables. Electronic devices can monitor each table in the system to be monitored, and when a problem is detected in any table, alarm information is generated and the operation and maintenance personnel are notified.

[0083] When electronic devices monitor a system, they can obtain table attribute information from the system to determine the table's primary importance. This primary importance is initially determined based on the table attribute information. Further, a secondary importance can be determined based on the target response time of alarm information generated by the staff within a historical time period for this table. This secondary importance represents the impact of the table on the system, as determined by the operation data of the maintenance personnel. When the primary and secondary importance are equal, it indicates that the predicted result is consistent with the result determined by the operation data, and the table's importance has not changed over time; therefore, the target importance can be directly determined based on the secondary importance. However, when the primary and secondary importance are unequal, it indicates that the table's importance has changed over time. In this case, since the importance determined by the operation data of the maintenance personnel is more accurate than that determined by the table's attribute characteristics, the secondary importance is further revised based on the table's upstream and downstream tables. The corresponding alarm urgency is then determined based on the revised target importance.

[0084] After determining the urgency of an alarm in a table, the electronic device can also determine the method of notifying maintenance personnel based on the urgency, and send the alarm information to the staff's terminal device according to the method. This allows the terminal device to respond to the staff's click operation on the viewing controls in the display interface, allowing them to view and handle the alarm information. The notification method can be telephone notification, email notification, push notification, etc., and this embodiment does not impose specific limitations on this.

[0085] It is understood that the electronic device can be a terminal device, such as a computer or tablet computer, or a server, such as a backend processing platform. This application does not impose specific limitations on the type of electronic device. Whether the electronic device is a terminal device or a server can be determined based on the actual situation.

[0086] The technical solution of this application will now be described in detail through specific embodiments.

[0087] It should be noted that the following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0088] Figure 2 This is a flowchart illustrating an embodiment of the method for determining alarm urgency provided in this application. Figure 2 As shown, the method for determining the urgency of this alarm may include the following steps:

[0089] S201. Calculate the first importance of each table to be processed based on the table attribute characteristics of each table to be processed in the monitoring system.

[0090] In this embodiment, the execution subject is an electronic device, which is used to monitor the information to be monitored so as to generate alarm information when a problem occurs in the system to be monitored and notify relevant personnel to handle the problem.

[0091] In one possible implementation, the electronic device can acquire the table attribute information of each table to be processed in the system under monitoring in real time or at a certain frequency, and calculate the first importance of each table to be processed. Here, table attribute features are used to characterize the attributes of the table to be processed, importance is used to indicate the degree of influence of the table to be processed on the system under monitoring, and the first importance is the importance of the table to be processed predicted by the electronic device based on the table attribute information.

[0092] In one possible implementation, in the application scenario of data quality monitoring and alarm, the table attribute features include scale dimension features, usage frequency dimension features, mediation dimension features, and business dimension features. The scale dimension features include field number sub-features, record number sub-features, and partition number sub-features. The usage frequency dimension features include update frequency sub-features and query frequency sub-features. The mediation dimension features include upstream table number sub-features and downstream table number sub-features. The business dimension features are determined based on the pre-defined table fields.

[0093] The pre-defined table fields can be fields that relevant staff are interested in. For example, when the system to be monitored is a financial system, the pre-defined table fields can be fields for outgoing amount, incoming amount, balance, etc. It should be understood that the pre-defined table fields can be limited according to the actual situation, and this application embodiment does not impose specific restrictions on them.

[0094] In the above approach, the scale dimension feature can be represented by the formula: , confirmed, among which, As a feature of the scale dimension, For field number sub-features, To record the number of sub-features, For the sub-features of the partition number, , , All are constants. Frequency dimension features can be used via the formula: , confirmed, among which, To use frequency dimension features, To update the frequency sub-features, The frequency sub-feature being queried and All are constants. The mediation dimension feature can be expressed by the formula: , confirmed, among which, As a mediating dimension feature, For upstream table quantity sub-features, The number of downstream tables. , All are constants. Business dimension features can be represented by the formula: , confirmed, among which, This is a mediating dimension feature.

[0095] The above method is illustrated with a specific example. Assume the table to be processed has 3 fields, 100,000 records, and 5 partitions. Then, the size dimension of the table is S = 3a + 100,000b + 5c. Assume the update frequency is 1 time / day and the query frequency is 100 times / day. Then, the usage frequency dimension is F = d + 100e. Assume the upstream table has 5 sub-features and the downstream table has 10 sub-features. Then, the mediation dimension is C = 5g + 10h. Assume the table to be processed involves 10 fields, of which 6 are pre-defined. Then, the mediation dimension is I = 1 + 1 + 1 + 1 + 1 + 1 + 0 + 0 + 0 = 6.

[0096] In the above method, the table attribute features contain a large number of dimensional features, and the accuracy of predicting the first importance of the table to be processed based on these table attribute features is higher.

[0097] Optionally, the table attribute features may also include other dimensional features, which can be determined according to the actual situation. This application embodiment does not impose specific restrictions on this.

[0098] S202. For each table to be processed, determine the second importance of the table to be processed based on the target response time of the alarm information generated by the staff in the historical time period of the table to be processed.

[0099] In this embodiment, the importance of each table to be processed changes over time. For example, if table C originally had only 2 downstream tables, and over time the number of downstream tables increases to 100, the importance of table C also increases, thus requiring an update to the importance of table C. Since the response time to alarm information reflects the impact of the table to be processed on the monitoring system, a shorter response time indicates a higher impact. Therefore, the second importance of the table to be processed can be calculated based on the target response time of alarm information generated by the staff within a historical time period. This response time is the difference between the time the staff views the alarm information on their terminal device and the time they process the alarm information.

[0100] In one possible implementation, for each form to be processed, after an alarm message is generated, the electronic device sends the alarm message to the terminal device of the relevant staff member. Upon receiving the alarm message, the terminal device displays it on its screen so that the staff member can process it. Simultaneously, while the user is processing the alarm message, the electronic device can also obtain the staff member's response time for that alarm message. Correspondingly, after the staff member has processed the alarm message, the electronic device can obtain the staff member's response time for that form from the terminal device.

[0101] For example, in practical applications, the data generated in the historical period closer to the current time in which the table to be processed is generated is more representative of the nature of the table to be processed at the current time. Therefore, the historical period can be a time period relatively close to the current time, such as the hour before the current time. It should be understood that the historical period can also be a time period of other lengths, such as the two hours before the current time, or the previous day, etc., and the embodiments of this application do not impose specific limitations on this.

[0102] The specific implementation method and principle of this step can be found in [reference]. Figure 3 The details of the illustrated embodiment will not be repeated here.

[0103] S203. When the first importance and the second importance of the table to be processed are not equal, determine the target importance of the table to be processed based on the second importance of the table to be processed, the upstream table information, and the downstream table information.

[0104] In the embodiments of this application, the importance of the table to be processed is often closely related to its upstream and downstream tables. Specifically, the number of upstream and downstream tables determines the importance of the table to be processed, and the current importance of the upstream and downstream tables is strongly correlated with the importance of the table to be processed.

[0105] The upstream table information includes the number of upstream tables and their current importance, while the downstream table information includes the number of downstream tables and their current importance.

[0106] When the first importance and the second importance are not equal, it indicates that the importance of the table to be processed has changed over time. Therefore, the importance of the table to be processed can be adjusted based on the second importance by referring to the upstream and downstream tables to obtain an accurate target importance.

[0107] The specific implementation method and principle of this step can be found in [reference]. Figure 4 The details of the illustrated embodiment will not be repeated here.

[0108] S204. Determine the corresponding alarm urgency based on the target importance of the table to be processed.

[0109] In one possible implementation, the alarm urgency corresponding to the target importance can be determined based on a pre-stored urgency mapping relationship and the target importance.

[0110] Optionally, the urgency mapping relationship can be pre-stored in an electronic device by relevant staff. For example, the urgency mapping relationship can be stored in an electronic device by staff through a storage device that stores the urgency mapping relationship.

[0111] Since the target importance represents the degree of impact of the table to be processed on the monitoring system, the higher the target importance, the greater the impact of the alarms generated by the table to be processed on the monitoring system, and the higher the determined alarm urgency.

[0112] Following S204, the method of notifying staff can also be determined based on the urgency of the alarm. For example, when the alarm urgency is high, the relevant staff can be contacted immediately by phone (regardless of whether the staff is off duty or asleep at the moment). When the alarm urgency is low, staff can be notified during working hours, such as by calling the staff or sending text messages, emails, or push notifications to the staff's terminal devices.

[0113] The alarm urgency determination method provided in this application embodiment calculates the first importance of each table to be processed based on its table attribute characteristics in the monitored system. For each table, a second importance is determined based on the target response time of alarm information generated by staff within a historical time period. When the first and second importance of a table are not equal, a target importance is determined based on the second importance, upstream table information, and downstream table information. Finally, the corresponding alarm urgency is determined based on the target importance of the table. In this scheme, the second importance is determined based on the staff's response speed to alarms from tables to be processed within a historical time period. When it is determined that the importance of a table to be processed changes over time based on the second and first importance, the second importance is further corrected based on the upstream and downstream table information, thereby improving the accuracy of the corrected target importance.

[0114] Figure 3 This is a flowchart illustrating Embodiment 2 of the method for determining alarm urgency provided in this application. Figure 3 As shown, based on any of the above embodiments, S202 may include the following steps:

[0115] S301. For each table to be processed, calculate the target response time of the alarm information based on the time when the staff views and processes the alarm information.

[0116] In one possible implementation, the electronic device sends alarm information generated within a historical time period to the staff's terminal device according to the notification method corresponding to the pending form. Upon receiving the alarm information, the terminal device displays it on a display interface. This display interface includes a viewing control; when the staff clicks this control, the terminal device responds by displaying the full content of the alarm information and showing the processing control on the current interface, thus determining the current time as the viewing time of the alarm information. Furthermore, when the user clicks the processing control, the terminal device responds to the operator's action, executes the processing flow corresponding to the alarm information, and determines the current time as the processing time for the alarm information. For electronic devices, this involves obtaining the viewing time generated on the terminal device. and processing time .

[0117] Furthermore, it can be done according to the formula: Determine the target response time. Among them, The target response time.

[0118] S302. Determine the second importance corresponding to the target response time based on the target response time and the mapping relationship.

[0119] The mapping relationship is the correspondence between response time and importance.

[0120] Optionally, the mapping relationship can be pre-stored in electronic devices by relevant staff.

[0121] For example, the above mapping relationship can be expressed by the formula: It indicates. Among them, For response time. It should be understood that the above mapping relationship can also be expressed in other forms, such as tables, line graphs, etc. The embodiments of this application do not limit the expression of the above mapping relationship.

[0122] In the above embodiments, the target response time of the alarm information is determined based on the time when the staff views and processes the alarm information. This allows the second duration of the alarm information to be determined based on the target response time and the pre-stored mapping relationship. This combines the staff's operation data on the alarm information with the importance prediction process of the table to be processed, fully considering the impact of time factors on the importance of the table to be processed. This lays the foundation for further refining the importance of the table to be processed based on the first importance and the second importance.

[0123] Figure 4 This is a flowchart illustrating Embodiment 3 of the method for determining alarm urgency provided in this application. Figure 4 As shown, based on any of the above embodiments, S203 may include the following steps:

[0124] S401. Calculate the ratio of the current total importance of the upstream table to the number of upstream tables to obtain the first ratio.

[0125] For example, the upstream table set of the table to be processed can be accessed through... It indicates. Among them, Let be an upstream table in the upstream table set. Assuming the number of upstream tables for the table to be processed is 5, and the current importance of each upstream table is 3, 4, 5, 4, 3 respectively, then the current total importance of the upstream tables is 19, and the first ratio is 19 / 5.

[0126] S402. Calculate the ratio of the current total importance of the downstream tables to the number of downstream tables to obtain the second ratio.

[0127] For example, the downstream table set of the table to be processed can be... It indicates. Among them, This is a downstream table in the downstream table set. Assuming the number of upstream tables for this table to be processed is 4, and the current importance of each upstream table is 4, 5, 4, 4 respectively, then the current total importance of the upstream tables is 17, and the first ratio is 17 / 4.

[0128] S403. Based on the first weight value, the second weight value, and the third weight value, the weighted sum of the first ratio, the second ratio, and the second importance is determined as the target importance of the table to be processed.

[0129] In one possible implementation, it can be achieved through... Determine the target importance of the table to be processed. For the importance of the target, The first ratio, The second ratio, , , These are the first weight value, the second weight value, and the third weight value, respectively. It should be understood that the first, second, and third weight values ​​can also be expressed in other ways, such as using w, e, and r to represent them. In this case, the above formula becomes... This application does not limit the form of the first weight value, the second weight value, and the third weight value.

[0130] For example, combining the examples of S401 and S402, assuming the first weight value, the second weight value, and the third weight value are 1 / 2, 1 / 4, and 1 / 4 respectively, then the target importance determined by the above formula is: .

[0131] In the above embodiments, a first weight value, a second weight value, and a third weight value can be preset according to the influence of upstream and downstream tables on the importance of the table to be processed. Based on the upstream table information, downstream table information, and the preset first weight value, second weight value, and third weight value, the second importance can be corrected by combining multiple factors, which effectively improves the accuracy of the corrected target importance.

[0132] Optionally, based on any of the above embodiments, in some embodiments, S201 can be implemented by the following steps: for each dimension feature, determine the effective features from all the sub-features in the dimension feature according to the sub-feature values ​​corresponding to each sub-feature in the dimension feature, and calculate the first importance of the table to be processed according to the effective features of the table to be processed.

[0133] In this embodiment, since sub-features with lower discriminative power have less impact on the first importance, effective features can be determined from the sub-features based on the concentration of each sub-feature in the table attribute features, and invalid features can be eliminated. This eliminates the need for further processing of invalid features, thereby reducing redundant calculations and improving processing efficiency.

[0134] The concentration of effective features is less than the average concentration of sub-features in that dimension. The concentration is determined based on the number of sub-feature values ​​and the number of sub-features.

[0135] In one specific implementation, the ratio of the number of sub-feature values ​​to the total number of sub-features is calculated; this ratio represents the concentration of the sub-feature. Further, after calculating the concentration of each sub-feature, the average concentration of all sub-features within that dimension can be calculated. The concentration of each sub-feature is then compared to this average concentration. If the concentration of a sub-feature is greater than the average concentration, the sub-feature is determined to be an invalid feature; if the concentration of a sub-feature is less than the average concentration, the sub-feature is determined to be a valid feature.

[0136] In one feasible approach, for each feature dimension, the concentration coefficient of each sub-feature under that feature dimension is calculated. This concentration coefficient can be calculated using the following formula:

[0137]

[0138] in, That is, sub-features i Concentration coefficient, The concentration of the sub-features. When the value is 1, it indicates that the sub-feature is a valid feature; When the value is 0, it means that the sub-feature is an invalid feature.

[0139] Accordingly, in the above implementation, the scale dimension feature can be expressed by the formula This means that the frequency dimension feature can be used through the formula: This indicates that the mediation dimension features can be represented by the formula: This indicates that business dimension features can be represented by the formula: This indicates that the effective feature set of the table to be processed can be represented by: This indicates that the first importance of the table to be processed is... .

[0140] Furthermore, this embodiment will be illustrated with a specific example. Regarding the scale dimension feature, assuming the number of fields in the table to be processed is 1, 2, 3, 3, 5, then the concentration of the number of fields sub-features is... The number 5 refers to the number of fields being 5. This refers to a field with four numerical values ​​(1, 2, 3, and 5 respectively); assuming the record count sub-feature is 100,000, 101, 10002, 101, 101, the concentration of the record count sub-feature. Assuming the sub-features of the partition numbers are 3, 4, 4, 3, and 3 respectively, and the concentration of the sub-features of the partition numbers is... Therefore, the average concentration of the sub-features in the scale dimension is 1.8, because... If the field number feature is a valid feature, then the field number feature is a valid feature. If the number of records is a valid feature, then the feature is considered to be a valid feature. If the partition number sub-feature is invalid, then the scale dimension feature is invalid. Similarly, for frequency-based features, mediation-based features, and business-based features, the method for determining the effective features in each dimension is the same as for scale-based features, and will not be repeated here.

[0141] In the above embodiments, for each dimension feature, redundant sub-features are filtered out by using the sub-feature values ​​corresponding to each sub-feature, thereby improving computational efficiency and saving computational resources.

[0142] Optionally, in some embodiments, based on the above embodiments, calculating the first importance of the table to be processed according to its effective features may include the following steps: for each table to be processed, calculate the initial importance of the table to be processed according to its effective features; based on the initial importance of each table to be processed, perform clustering processing on all tables to be processed to obtain multiple table sets. Then, for each table set, determine the first importance of each table to be processed in the table set based on the labeling results of some labeled tables in the table set.

[0143] In one possible approach, the similarity between different tables to be processed can be calculated, and the tables to be processed can be clustered based on the aforementioned similarity to obtain multiple table sets.

[0144] For example, the above clustering process can be implemented through the following steps:

[0145] Step 1: Randomly select M tables from the tables to be processed as initial cluster centers.

[0146] Step 2: For any table in the other tables, calculate the similarity between the table and the above M tables, and assign the table to the initial cluster center with the highest similarity, thereby generating multiple table sets.

[0147] Step 3: Recalculate the target cluster centers for each table set.

[0148] It should be understood that the tables in each tableset are of similar importance.

[0149] Furthermore, a certain proportion of tables can be manually labeled from each table set to generate labeled tables. The labeling results of these labeled tables represent the importance of the manually determined labeled tables. Finally, a subset of labeled tables is extracted from the labeled tables, and the average of the labeling results of this subset is calculated. This average is then used to determine the first importance of all tables in the table set, or of all other tables besides the aforementioned subset.

[0150] Optionally, the first importance of each table in the table set can be determined based on the labeling results of all labeled tables.

[0151] For example, suppose the valid features of the table A to be processed are: The effective features of table B to be processed are: Then, the similarity between table A and table B to be processed can be calculated using the following formula:

[0152]

[0153] Optionally, the above ratio can be 10%, or other ratios, such as 15%, 20%, etc. The embodiments of this application do not specifically limit the ratio value.

[0154] In the above embodiments, for a massive number of tables to be processed, clustering can efficiently and accurately obtain the first importance of each table. Firstly, based on the intra-class similarity principle, tables with similar effective features also have similar importance. Therefore, knowing only the labeling results of a few labeled tables is sufficient to obtain the importance of all tables in the set containing that labeled table, avoiding the need for manual labeling of each table sequentially and reducing workload.

[0155] Optionally, in some embodiments, based on the above embodiments, determining the first importance of each table to be processed in the table set according to the labeling results of some labeled tables can be achieved through the following steps: Calculate the importance difference of the partially labeled tables based on the labeling results of the partially labeled tables in the table set. When the importance difference is less than or equal to a preset importance difference, determine the first importance of each table to be processed in the table set based on the labeling results of the partially labeled tables. When the importance difference is greater than the preset importance difference, re-cluster all tables to be processed according to the initial importance of each table to be processed, obtain multiple tables after re-clustering, and determine the first importance of each table to be processed in each of the re-clustered tables.

[0156] Optionally, the preset importance difference can be pre-set by relevant personnel. A larger preset importance difference indicates that the importance difference between tables in the table set can be tolerated, resulting in lower clustering accuracy; conversely, a smaller preset importance difference indicates that the importance difference between tables in the table set can be tolerated, resulting in higher clustering accuracy.

[0157] Furthermore, this embodiment will be explained through a specific example. Assume that the labeling results of some labeled tables in a certain tabular set are as follows: and The preset importance difference value is k. If the result is positive, it means the current table set meets the clustering requirements and no re-clustering is needed. Otherwise, if the result is negative, it means the current table set does not meet the clustering requirements. If the current set of tables does not meet the clustering requirements, it means that the importance of each table in the set varies greatly, and all tables to be processed should be re-clustered.

[0158] For example, based on the above clustering processing example, M tables can be reselected from the tables to be processed as new initial cluster centers, and steps 2 and 3 in the above example can be executed in sequence to achieve the purpose of re-clustering and optimizing the clustering effect.

[0159] For example, suppose , The values ​​of are 1 and 5, and k is 1. Therefore, the importance difference is 4. This importance difference is greater than the preset importance difference, indicating that the labeling results within this table set have significant differences, and the clustering process did not meet expectations, requiring re-clustering. Assume... , If the values ​​are 4 and 5, the importance difference is 1. This means the importance difference equals the preset importance difference, indicating that the differences in the labeling results within the table are small, and the clustering process meets expectations. Therefore, it can be used to... , Get the first importance of each table in this tableset.

[0160] In the above embodiments, the labeling results are used in turn for clustering to backtest the accuracy of the clustering process. The clustering process is verified by using the labeling results of the labeled tables and the preset importance difference, so that the clustering can be re-clustered in a timely manner when the clustering process does not meet expectations. The unsupervised clustering algorithm is improved by introducing some "supervised learning", which makes the clustering results more accurate and ensures that the first importance of other tables in the table set can be accurately determined based on the labeling results of some labeled tables in the table set.

[0161] Optionally, in some embodiments, based on the above embodiments, determining the first importance of each table to be processed in the table set according to the marking results of the partial marking tables can be achieved by the following steps: calculating the average importance of the partial marking tables according to the marking results of the partial marking tables, determining the average importance as the first importance of the remaining tables in the table set, and determining the marking results of the partial marking tables as the first importance of the partial marking tables.

[0162] In this embodiment, the average importance of the labeling results of some labeled tables is diffused to other tables in the table set. Compared with the prior art of manually labeling each table one by one, this embodiment reduces the workload of manual labeling. At the same time, the average importance of the labeling results of some labeled tables is determined as the first importance of other tables, reducing the impact on other tables when a certain labeling result is inaccurate.

[0163] Optionally, in some embodiments, after determining the second importance of each table to be processed based on the generation time of alarm information generated by the table in the historical time period and the time when the staff processes the alarm information, the method for determining the alarm urgency may further include the following steps: when the first importance and the second importance of the table to be processed are equal, the second importance is determined as the target importance of the table to be processed.

[0164] In this embodiment, when the first importance and the second importance are equal, it indicates that the importance of the table to be processed has not changed over time. Therefore, the second importance can be directly used as the target importance, without needing to adjust the second importance again based on the upstream and downstream tables, reducing redundant processing and improving processing efficiency.

[0165] Based on the alarm urgency determination schemes in the above embodiments, the following is an example illustrating the scheme.

[0166] In daily operations, electronic devices can recalculate the table attribute features of each table to be processed in the monitored system every day, and re-cluster all tables to be processed based on the table attribute features to obtain multiple table sets. Furthermore, for each table set, the average of the target importance calculated for all tables in the table set the previous day is determined as the importance of each table in that table set for the current day.

[0167] When an alarm message is generated for a table to be processed, the second importance of the table is determined based on the target response time for the alarm message. If the current importance of the table to be processed is not equal to the second importance, the second importance is determined as the update importance of all tables in the table set containing the table to be processed. Then, all tables in the table set are traversed, and tables with upstream and downstream tables are further corrected to obtain the corrected update importance. The importance of the upstream and downstream tables of each table in the table set is then corrected.

[0168] Furthermore, considering that the importance of each pending table may change over time, a node is added where relevant staff can manually set the set importance of the current table. That is, when staff deem a pending table's current importance too low or too high, they can manually input the set importance for that table, allowing subsequent alarm urgency determination based on this set importance. The manually input alarm urgency, the target urgency determined by the second importance, and the priority of the first importance are sequentially increased.

[0169] The following are embodiments of the apparatus described in this application, which can be used to execute the embodiments of the method described in this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the method described in this application.

[0170] Figure 5 This is a schematic diagram of the alarm urgency determination device provided in an embodiment of this application. Figure 5 As shown, the device for determining the urgency of the alarm includes:

[0171] The calculation module 501 is used to calculate the first importance of each table to be processed according to the table attribute characteristics of each table to be processed in the system to be monitored. The importance is used to indicate the degree of influence of the table to be processed on the system to be monitored.

[0172] The determination module 502 is used to determine the second importance of each table to be processed based on the generation time of alarm information generated by the table in the historical time period and the time when the staff processed the alarm information.

[0173] The determination module 502 is further configured to determine the target importance of the table to be processed based on the second importance of the table to be processed, upstream table information, and downstream table information when the first importance and second importance of the table to be processed are not equal. The upstream table information includes the number of upstream tables and their current importance, and the downstream table information includes the number of downstream tables and their current importance.

[0174] The determination module 502 is also used to determine the corresponding alarm urgency based on the target importance of the table to be processed.

[0175] In one possible design of this application embodiment, the determining module 502 is specifically used for:

[0176] For each table to be processed, calculate the target response time between the processing time and the generation time of the alarm information;

[0177] Based on the target response time and the mapping relationship, the second importance corresponding to the target response time is determined. The mapping relationship is the correspondence between response time and importance.

[0178] In another possible design of this application embodiment, the determining module 502 is specifically used for:

[0179] Calculate the ratio of the current total importance of the upstream tables to the number of upstream tables to obtain the first ratio;

[0180] Calculate the ratio of the current total importance of the downstream tables to the number of downstream tables to obtain the second ratio;

[0181] Based on the first weight value, the second weight value, and the third weight value, the weighted sum of the first ratio, the second ratio, and the second importance is determined as the target importance of the table to be processed.

[0182] In another possible design of this application embodiment, the table attribute features include scale dimension features, usage frequency dimension features, mediation dimension features, and business dimension features. The scale dimension features include field number sub-features, record number sub-features, and partition number sub-features. The usage frequency dimension features include update frequency sub-features and query frequency sub-features. The mediation dimension features include upstream table number sub-features and downstream table number sub-features. The business dimension features are determined based on pre-defined table fields.

[0183] Optional, the calculation module 501 is specifically used for:

[0184] For each dimension feature, based on the sub-feature value corresponding to each sub-feature in that dimension feature, effective features are determined from all sub-features in that dimension feature. The concentration of effective features is less than the average concentration of all sub-features in that dimension feature. The concentration is determined based on the number of sub-feature values ​​and the number of sub-features.

[0185] Calculate the first importance of the table to be processed based on its valid characteristics.

[0186] Optional, the calculation module 501 is specifically used for:

[0187] For each table to be processed, calculate the initial importance of the table based on its valid features;

[0188] Based on the initial importance of each table to be processed, all tables to be processed are clustered to obtain multiple table sets;

[0189] For each set of tables, the first importance of each table to be processed in the set is determined based on the labeling results of some labeled tables in the set. The labeled tables are the tables in the set that have been manually labeled, and the labeling results are used to represent the importance of the labeled tables as determined by humans.

[0190] Optional, the calculation module 501 is specifically used for:

[0191] Based on the labeling results of some of the labeled tables in this set, calculate the importance difference of some of the labeled tables;

[0192] When the importance difference is less than or equal to the preset importance difference, the first importance of each table to be processed in the table set is determined based on the labeling results of some labeled tables.

[0193] When the importance difference is greater than the preset importance difference, all tables to be processed are re-clustered according to the initial importance of each table to be processed, to obtain multiple tables after re-clustering, and to determine the first importance of each table to be processed in each table set after re-clustering.

[0194] Optional, the calculation module 501 is specifically used for:

[0195] Calculate the average importance of some of the marking tables based on the marking results of some of the marking tables;

[0196] The average importance is determined as the first importance of the remaining tables in this table set;

[0197] The marking results of a portion of the marking tables are determined as the highest importance of that portion of the marking tables.

[0198] In another possible design of this application embodiment, after determining the second importance of each form to be processed based on the generation time of alarm information generated by the form in a historical time period and the processing time of the alarm information by the staff, the determining module 502 is further configured to:

[0199] When the first importance and the second importance of the table to be processed are equal, the second importance is determined as the target importance of the table to be processed.

[0200] The alarm urgency determination device provided in this application embodiment can be used to execute the alarm urgency determination method in any of the above embodiments. Its implementation principle and technical effect are similar, and will not be described again here.

[0201] It should be noted that the division of the various modules in the above device is merely a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, these modules can be implemented entirely in software via processing element calls; they can be fully implemented in hardware; or some modules can be implemented in software via processing element calls, while others are implemented in hardware. Additionally, these modules can be fully or partially integrated together, or implemented independently. The processing element here can be an integrated circuit with signal processing capabilities. During implementation, each step of the above method or each of the above modules can be completed through the integrated logic circuits in the hardware of the processor element or through software instructions.

[0202] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 6 As shown, the electronic device may include: a processor 601, a memory 602, and computer program instructions stored in the memory 602 and executable on the processor 601. When the processor 601 executes the computer program instructions, it implements the alarm urgency determination method provided in any of the foregoing embodiments.

[0203] Optionally, the various components of the electronic device can be connected via a system bus.

[0204] The memory 602 can be a separate memory unit or a memory unit integrated into the processor. The number of processors can be one or more.

[0205] Optionally, the electronic device may also include an interface for interacting with other devices.

[0206] It should be understood that the processor 601 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0207] The system bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The system bus can be divided into address bus, data bus, control bus, etc. For ease of tabular representation, only one thick line is used in the diagram, but this does not necessarily mean there is only one bus or one type of bus. Memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk drive.

[0208] All or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a readable memory. When the program is executed, it performs the steps of the above method embodiments; and the aforementioned memory (storage medium) includes: read-only memory (ROM), RAM, flash memory, hard disk, solid-state drive, magnetic tape, floppy disk, optical disk, and any combination thereof.

[0209] The electronic device provided in this application embodiment can be used to execute the alarm urgency determination method provided in any of the above method embodiments. Its implementation principle and technical effect are similar, and will not be described again here.

[0210] This application provides a computer-readable storage medium storing computer instructions that, when executed on a computer, cause the computer to perform the aforementioned alarm urgency determination method.

[0211] The aforementioned computer-readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory, electrically erasable programmable read-only memory, erasable programmable read-only memory, programmable read-only memory, read-only memory, magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0212] Optionally, a readable storage medium can be coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Alternatively, the readable storage medium can be an integral part of the processor. Both the processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components within the device.

[0213] This application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. At least one processor can read the computer program from the computer-readable storage medium, and when the at least one processor executes the computer program, it can implement the above-mentioned method for determining the urgency of alarms.

[0214] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. A method for determining the urgency of an alarm, characterized in that, include: Based on the table attribute characteristics of each table to be processed in the system to be monitored, the first importance of each table to be processed is calculated. The importance is used to indicate the degree of influence of the table to be processed on the system to be monitored. The table attribute characteristics include scale dimension characteristics, usage frequency dimension characteristics, mediation dimension characteristics, and business dimension characteristics. The scale dimension characteristics include field number sub-characteristics, record number sub-characteristics, and partition number sub-characteristics. The usage frequency dimension characteristics include update frequency sub-characteristics and query frequency sub-characteristics. The mediation dimension characteristics include upstream table number sub-characteristics and downstream table number sub-characteristics. The business dimension characteristics are determined based on pre-defined table fields. For each table to be processed, the second importance of the table is determined based on the target response time of the alarm information generated by the staff within the historical time period for the table to be processed. When the first importance of the table to be processed is not equal to the second importance, the target importance of the table to be processed is determined based on the second importance of the table to be processed, the upstream table information, and the downstream table information. The upstream table information includes the number of upstream tables and their current importance, and the downstream table information includes the number of downstream tables and their current importance. Determine the corresponding alarm urgency based on the target importance of the table to be processed; Specifically, based on the table attribute characteristics of each table to be processed in the monitoring system, the first importance of each table to be processed is calculated, including: For each dimension feature, effective features are determined from all sub-features in the dimension feature based on the sub-feature value corresponding to each sub-feature in the dimension feature. The concentration of the effective features is less than the average concentration of all sub-features in the dimension feature. The concentration is determined based on the number of sub-feature values ​​and the number of sub-features. M tables are randomly selected from the tables to be processed as initial cluster centers, where M is a positive integer; For each table to be processed, based on the similarity between each table to be processed and the M tables, each table to be processed is assigned to the initial cluster center with the highest similarity, generating multiple table sets; For each set of tables, the first importance of each table to be processed in the set is determined based on the labeling results of some labeled tables in the set. The labeled tables are the tables in the set that have been manually labeled, and the labeling results are used to represent the importance of the labeled tables determined manually.

2. The method according to claim 1, characterized in that, For each table to be processed, the second importance of the table is determined based on the target response time of alarm information generated by staff for that table within a historical time period, including: For each table to be processed, the target response time of the alarm information is calculated based on the time when the staff member views and processes the alarm information; Based on the target response duration and the mapping relationship, the second importance corresponding to the target response duration is determined, where the mapping relationship is the correspondence between response duration and importance.

3. The method according to claim 1, characterized in that, The step of determining the target importance of the table to be processed based on the second importance of the table to be processed, the upstream table information, and the downstream table information includes: Calculate the ratio of the current total importance of the upstream tables to the number of upstream tables to obtain the first ratio; Calculate the ratio of the current total importance of the downstream tables to the number of downstream tables to obtain a second ratio; Based on the first weight value, the second weight value, and the third weight value, the weighted sum of the first ratio, the second ratio, and the second importance is determined as the target importance of the table to be processed.

4. The method according to claim 1, characterized in that, The step of determining the first importance of each table to be processed in the table set based on the labeling results of some labeled tables in the table set includes: Based on the labeling results of some of the labeled tables in the table set, calculate the importance difference of the labeled tables. When the importance difference is less than or equal to the preset importance difference, the first importance of each table to be processed in the table set is determined according to the labeling results of the partial labeling tables. When the importance difference is greater than the preset importance difference, all tables to be processed are re-clustered according to the initial importance of each table to be processed, to obtain multiple tables after re-clustering, and to determine the first importance of each table to be processed in each table set after re-clustering.

5. The method according to claim 4, characterized in that, The step of determining the first importance of each table to be processed in the table set based on the labeling results of the partial labeling tables includes: Based on the marking results of the partial marking tables, calculate the average importance of the partial marking tables; The average importance is determined as the first importance of the remaining tables in the table set; The marking results of the aforementioned partial marking table are determined as the first importance of the aforementioned partial marking table.

6. The method according to any one of claims 1 to 3, characterized in that, After determining the second importance of each form to be processed based on the target response time of alarm information generated by staff for that form within a historical time period, the method further includes: When the first importance of the table to be processed is equal to the second importance, the second importance is determined as the target importance of the table to be processed.

7. A device for determining the urgency of an alarm, characterized in that, include: The calculation module is used to calculate the first importance of each table to be processed in the system to be monitored based on the table attribute characteristics of each table to be processed. The importance is used to represent the degree of influence of the table to be processed on the system to be monitored. The table attribute characteristics include scale dimension characteristics, usage frequency dimension characteristics, mediation dimension characteristics, and business dimension characteristics. The scale dimension characteristics include field number sub-characteristics, record number sub-characteristics, and partition number sub-characteristics. The usage frequency dimension characteristics include update frequency sub-characteristics and query frequency sub-characteristics. The mediation dimension characteristics include upstream table number sub-characteristics and downstream table number sub-characteristics. The business dimension characteristics are determined based on pre-defined table fields. The determination module is used to determine the second importance of each form to be processed based on the target response time of alarm information generated by staff for the form in the historical time period. The determining module is further configured to determine the target importance of the table to be processed based on the second importance of the table to be processed, upstream table information, and downstream table information when the first importance of the table to be processed is not equal to the second importance of the table to be processed. The upstream table information includes the number of upstream tables and their current importance, and the downstream table information includes the number of downstream tables and their current importance. The determining module is also used to determine the corresponding alarm urgency based on the target importance of the table to be processed; The calculation module is further configured to, for each dimension feature, determine effective features from all sub-features in the dimension feature based on the sub-feature value corresponding to each sub-feature in the dimension feature, wherein the concentration of the effective features is less than the average concentration of all sub-features in the dimension feature, and the concentration is determined based on the number of sub-feature values ​​and the number of sub-features. M tables are randomly selected from the tables to be processed as initial cluster centers, where M is a positive integer; For each table to be processed, based on the similarity between each table to be processed and the M tables, each table to be processed is assigned to the initial cluster center with the highest similarity, generating multiple table sets; for each table set, based on the labeling results of some labeled tables in the table set, the first importance of each table to be processed in the table set is determined, wherein the labeled tables are the tables in the table set that have been manually labeled, and the labeling results are used to represent the importance of the manually determined labeled tables, where M is a positive integer.

8. An electronic device, comprising: A processor, a memory, and computer program instructions stored in the memory and executable on the processor, characterized in that the processor executes the computer program instructions to implement the alarm urgency determination method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the alarm urgency determination method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product stores instructions that, when read and executed by a computer, cause the computer to perform the alarm urgency determination method as described in any one of claims 1 to 6.

Images