A method and device for generating detection data for intelligent operation and maintenance system

Abstract

The embodiment of the present invention provides a method and device for generating detection data for an intelligent operation and maintenance system, which obtains multiple levels for the intelligent operation and maintenance system by dividing the intelligent operation and maintenance system into layers; the multiple levels respectively have corresponding physical devices; a device identification for the physical device is generated; an alarm probability for the physical device is obtained; the target physical device is determined by the device identification, and a simulation value and an actual value for the target physical device are obtained; when the difference between the simulation value and the actual value exceeds a preset threshold value of the difference, and the alarm probability for the target physical device exceeds a preset threshold value of the probability, detection data for the target physical device is generated, which can not only monitor hardware and applications through the alarm probability, but also simulate and test functional defects and hidden faults of each functional module through business data, thereby improving the monitoring mechanism for the intelligent operation and maintenance system, and further improving the work efficiency of the intelligent operation and maintenance system.

Description

Technical Field

[0001] The present invention relates to the technical field of intelligent operation and maintenance system detection, and in particular to a detection data generation method for an intelligent operation and maintenance system, a detection data generation device for an intelligent operation and maintenance system, an electronic device, and a computer-readable storage medium. Background Art

[0002] Operation and maintenance refers to the operation and maintenance of networks, servers, and services at all stages of their life cycle, in order to achieve a consensus and acceptable state in terms of cost, stability, and efficiency. In the early days, operation and maintenance work was done manually by operation and maintenance personnel. However, due to the low efficiency of manual operation and maintenance work, in the face of the rapid expansion of Internet business, manual operation and maintenance work can no longer meet the current Internet industry's operation and maintenance needs. With the development of science and technology, intelligent operation and maintenance systems have emerged. For example, the intelligent operation and maintenance system AIOps (Artificial Intelligence for IT Operations) can realize automated operation and maintenance work through machine learning based on existing operation and maintenance data (logs, monitoring information, application information, etc.).

[0003] However, since the relevant technology cannot detect the intelligent operation and maintenance system during its operation, the stability of the operating environment cannot be guaranteed during the operation of the intelligent operation and maintenance system, which results in the failure to further improve the work efficiency of the intelligent operation and maintenance system. Summary of the invention

[0004] The embodiments of the present invention provide a method, device, electronic device and computer-readable storage medium for generating detection data for an intelligent operation and maintenance system, so as to solve the problem of how to improve the detection mechanism for the intelligent operation and maintenance system.

[0005] The embodiment of the present invention discloses a method for generating detection data for an intelligent operation and maintenance system, comprising:

[0006] The intelligent operation and maintenance system is layered to obtain multiple layers for the intelligent operation and maintenance system; the multiple layers respectively have corresponding physical devices;

[0007] generating a device identification for the physical device;

[0008] Obtaining an alarm probability for the physical device;

[0009] Determine the target physical device through the device identifier, and obtain a simulated inspection abnormality occurrence probability value and an actual inspection abnormality occurrence probability value for the target physical device;

[0010] When the difference between the simulated inspection abnormality occurrence probability value and the actual inspection abnormality occurrence probability value exceeds a preset difference threshold, and the alarm probability for the target physical device exceeds a preset probability threshold, detection data for the target physical device is generated.

[0011] Optionally, the step of obtaining the alarm probability for the physical device may include:

[0012] Acquire historical alarm data for the physical device, and determine a probability of occurrence of a historical alarm for the physical device based on the historical alarm data;

[0013] Determine a first historical alarm probability and a second historical alarm probability from the historical alarm occurrence probability; the first historical alarm probability is a historical alarm probability including a false alarm, and the second historical alarm probability is a historical alarm probability not including a false alarm;

[0014] The alarm probability for the physical device is calculated using the historical alarm occurrence probability, the first historical alarm probability, and the second historical alarm probability.

[0015] Optionally, the step of determining a first historical alarm probability and a second historical alarm probability from the historical alarm occurrence probability may include:

[0016] Acquire alarm occurrence condition data for the physical device; the alarm occurrence condition data at least includes memory occupancy rate, central processing unit occupancy rate, disk occupancy rate, network delay parameter, and number of network packet losses;

[0017] Based on the alarm occurrence condition data, a first historical alarm probability and a second historical alarm probability are determined from the historical alarm occurrence probabilities.

[0018] Optionally, the step of obtaining a simulated inspection abnormality occurrence probability value and an actual inspection abnormality occurrence probability value for the target physical device may include:

[0019] Performing a simulated inspection on the target physical device to obtain an initial simulated inspection abnormality occurrence probability value;

[0020] The initial simulated inspection abnormality occurrence probability value is constrained by a ridge regression algorithm, and a simulated inspection abnormality occurrence probability value is generated;

[0021] Historical alarm data for the target physical device is obtained, and an actual inspection abnormality occurrence probability value is obtained based on the historical alarm data.

[0022] Optionally, it may also include:

[0023] When the difference between the simulated inspection abnormality occurrence probability value and the actual inspection abnormality occurrence probability value exceeds the difference preset threshold, and the alarm probability for the target physical device does not exceed the probability preset threshold, the difference is marked as the first difference data, and the latest simulated inspection abnormality occurrence probability value for the target physical device and the latest actual inspection abnormality occurrence probability value are re-acquired;

[0024] The difference between the latest simulated inspection abnormality occurrence probability value and the latest actual inspection abnormality occurrence probability value is used as second difference data;

[0025] The first difference data and the second difference data are used to generate detection data.

[0026] The embodiment of the present invention further discloses a detection data generating device for an intelligent operation and maintenance system, and the device may include:

[0027] A system layering module, used to layer the intelligent operation and maintenance system to obtain multiple layers for the intelligent operation and maintenance system; the multiple layers respectively have corresponding physical devices;

[0028] A device identification generation module, used to generate a device identification for the physical device;

[0029] An alarm probability acquisition module, used to obtain the alarm probability for the physical device;

[0030] A target physical device determination module is used to determine the target physical device through the device identifier, and obtain a simulated inspection abnormality occurrence probability value for the target physical device and an actual inspection abnormality occurrence probability value;

[0031] The first detection data generating module is used to generate detection data for the target physical device when the difference between the simulated inspection abnormality occurrence probability value and the actual inspection abnormality occurrence probability value exceeds a preset difference threshold, and the alarm probability for the target physical device exceeds a preset probability threshold.

[0032] Optionally, the alarm probability acquisition module may include:

[0033] A historical alarm occurrence probability determination submodule, used to obtain historical alarm data for the physical device, and determine the historical alarm occurrence probability for the physical device based on the historical alarm data;

[0034] A historical alarm probability determination submodule, used to determine a first historical alarm probability and a second historical alarm probability from the historical alarm occurrence probability; the first historical alarm probability is a historical alarm probability containing a false alarm, and the second historical alarm probability is a historical alarm probability not containing a false alarm;

[0035] The alarm probability acquisition submodule is used to calculate the alarm probability for the physical device by using the historical alarm occurrence probability, the first historical alarm probability, and the second historical alarm probability.

[0036] Optionally, the historical alarm probability determination submodule may include:

[0037] An alarm occurrence condition data acquisition unit is used to acquire alarm occurrence condition data for the physical device; the alarm occurrence condition data at least includes memory occupancy rate, central processing unit occupancy rate, disk occupancy rate, network delay parameter, and network packet loss number;

[0038] The historical alarm probability determination unit obtains the alarm occurrence condition data and determines a first historical alarm probability and a second historical alarm probability from the historical alarm occurrence probability.

[0039] Optionally, the target physical device determination module may include:

[0040] An initial simulated inspection abnormality occurrence probability value acquisition submodule is used to perform a simulated inspection on the target physical device to obtain an initial simulated inspection abnormality occurrence probability value;

[0041] A simulated inspection anomaly occurrence probability value generation submodule is used to constrain the initial simulated inspection anomaly occurrence probability value through a ridge regression algorithm and generate a simulated inspection anomaly occurrence probability value;

[0042] The actual inspection abnormality occurrence probability value acquisition submodule is used to acquire historical alarm data for the target physical device and acquire the actual inspection abnormality occurrence probability value based on the historical alarm data.

[0043] Optionally, it may also include:

[0044] The latest probability value acquisition module is used to mark the difference as the first difference data when the difference between the simulated inspection abnormality occurrence probability value and the actual inspection abnormality occurrence probability value exceeds the preset difference threshold, and the alarm probability for the target physical device does not exceed the preset probability threshold, and re-acquire the latest simulated inspection abnormality occurrence probability value for the target physical device, and the latest actual inspection abnormality occurrence probability value;

[0045] A second difference data generating module, used for taking the difference between the latest simulated inspection abnormality occurrence probability value and the latest actual inspection abnormality occurrence probability value as second difference data;

[0046] The second detection data generating module is used to generate detection data using the first difference data and the second difference data.

[0047] The embodiment of the present invention further discloses an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0048] The memory is used to store computer programs;

[0049] The processor is used to implement the method described in the embodiment of the present invention when executing the program stored in the memory.

[0050] The embodiment of the present invention further discloses a computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, enables the processors to execute the method described in the embodiment of the present invention.

[0051] The embodiments of the present invention include the following advantages:

[0052] The embodiment of the present invention obtains multiple levels for the intelligent operation and maintenance system by layering the intelligent operation and maintenance system; the multiple levels respectively have corresponding physical devices; generate device identifications for the physical devices; obtain alarm probabilities for the physical devices; determine the target physical device through the device identification, and obtain a simulated inspection abnormality occurrence probability value for the target physical device, and an actual inspection abnormality occurrence probability value; when the difference between the simulated inspection abnormality occurrence probability value and the actual inspection abnormality occurrence probability value exceeds a preset difference threshold, and the alarm probability for the target physical device exceeds a preset probability threshold, generate detection data for the target physical device, which can not only monitor hardware and applications through alarm probability, but also simulate and test functional defects and hidden faults of each functional module through business data, thereby improving the monitoring mechanism for the intelligent operation and maintenance system, and further improving the work efficiency of the intelligent operation and maintenance system. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 is a flowchart of a method for generating detection data for an intelligent operation and maintenance system provided in an embodiment of the present invention;

[0054] Figure 2 is a schematic diagram of a user interface of an intelligent operation and maintenance system provided in an embodiment of the present invention;

[0055] Figure 3 It is a structural block diagram of a detection data generating device for an intelligent operation and maintenance system provided in an embodiment of the present invention;

[0056] Figure 4 It is a hardware structure block diagram of an electronic device provided in each embodiment of the present invention. DETAILED DESCRIPTION

[0057] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0058] Reference Figure 1 , shows a flowchart of a method for generating detection data for an intelligent operation and maintenance system provided in an embodiment of the present invention, which may specifically include the following steps:

[0059] Step 101, hierarchizing the intelligent operation and maintenance system to obtain multiple levels for the intelligent operation and maintenance system; the multiple levels respectively have corresponding physical devices;

[0060] Step 102, generating a device identification for the physical device;

[0061] Step 103, obtaining an alarm probability for the physical device;

[0062] Step 104, determining the target physical device through the device identifier, and obtaining a simulated inspection abnormality occurrence probability value for the target physical device and an actual inspection abnormality occurrence probability value;

[0063] Step 105 , when the difference between the simulated inspection abnormality occurrence probability value and the actual inspection abnormality occurrence probability value exceeds a preset difference threshold, and the alarm probability for the target physical device exceeds a preset probability threshold, generate detection data for the target physical device.

[0064] Embodiments of the present invention may be applied to intelligent operation and maintenance systems, for example, intelligent operation and maintenance systems AIOps.

[0065] In a specific implementation, the embodiment of the present invention may first layer the intelligent operation and maintenance system, and obtain multiple levels for the operation and maintenance system by layering it.

[0066] For example, AIOps is horizontally divided into five layers, including: data collection layer, data middle platform layer, algorithm layer, component layer and application layer.

[0067] Each level of the embodiment of the present invention may have corresponding physical devices respectively.

[0068] For example, the data acquisition layer may have corresponding physical devices such as environment monitoring submodule, network monitoring submodule, host monitoring submodule, system monitoring submodule, security monitoring submodule, cloud resource submodule, application monitoring submodule, etc.;

[0069] The data operation and maintenance middle platform layer can have corresponding physical devices such as data cleaning submodule, data filtering submodule, data standardization submodule, indicator operation submodule, abnormal marking submodule, data warehouse submodule, configuration item management submodule, relationship management submodule, business model topology submodule, dictionary and rule management submodule, etc.

[0070] The algorithm layer may have corresponding physical devices such as multi-objective optimization submodule, log algorithm submodule, neural network submodule, hybrid graph model submodule, metric submodule Metric, and tracking submodule Trace;

[0071] The component layer can have corresponding physical devices such as intelligent analysis sub-modules, service management sub-modules, automated operation sub-modules, knowledge base sub-modules, and three-dimensional visualization engine sub-modules. Among them, the intelligent analysis sub-module can also include association analysis sub-components, routing analysis sub-components, log analysis sub-components, and resource analysis sub-components. The service management sub-module can also include service catalog sub-components, work order management sub-components, personnel management sub-components, and workplace management sub-components. The automated operation sub-module can also include automatic inspection sub-components, batch operation sub-components, emergency handling sub-components, and customization sub-components. The knowledge base sub-module can also include fault handling knowledge base sub-components and engineer experience base sub-components. The three-dimensional visualization engine sub-module can also include graphic modeling sub-components and application interface sub-components.

[0072] The application layer SRE / Devops can have corresponding other capability sub-modules, space management sub-module, code management sub-module, automatic release sub-module, and application programming interface API / software development kit SDK sub-module.

[0073] After the intelligent operation and maintenance system is layered, the embodiment of the present invention can generate a device identification for the physical device.

[0074] For example, the data collection layer includes: 1-1 = environmental monitoring, 1-2 = network monitoring, 1-3 = host monitoring, 1-4 = system monitoring, 1-5 = security monitoring, 1-6 = cloud resources, 1-7 = application monitoring;

[0075] Data operation and maintenance middle platform layer: 2-1 = data cleaning, 2-2 = data filtering, 2-3 = data standardization, 2-4 = indicator calculation, 2-5 = abnormal marking, 2-6 = data warehouse, 2-7 = CI configuration item management, 2-8 = CI relationship management, 2-9 = business model topology, 2-10 = dictionary and rule management;

[0076] Algorithm layer: 3-1 = multi-objective optimization, 3-2 = NLP log algorithm, 3-3 neural network, 3-4 hybrid graph model, 3-4 = Metric, 3-5 = Trace;

[0077] Component layer: 4-1 = Intelligent analysis includes: 4-1-1 association analysis, 4-1-2 routing analysis, 4-1-3 log analysis, 4-1-4 resource analysis; 4-2 = Service management includes: 4-2-1 = Service catalog, 4-2-2 = Work order management, 4-2-3 = Personnel management, 4-2-4 Workplace management; 4-3 = Automated operation includes: 4-3-1 = Automatic inspection, 4-3-2 = Batch operation, 4-3-3 = Emergency handling, 4-3-4 = Customization; 4-4 = Knowledge base includes: 4-4-1 = Fault handling knowledge base, 4-4-2 = Engineer experience base; 4-5 = 3D visualization engine includes: 4-5-1 = Graphics modeling, 4-5-2 = Application interface;

[0078] Application layer: 5-1 = other capabilities, 5-2 = space management, 5-3 = code management, 5-4 = automatic publishing, 5-5 = API / SDK;

[0079] The application layer can have a corresponding application layer database, and the application layer database can have a unique serial number: 1=large-screen real-time monitoring, 2=distributed network, 3=precise fault location, 4=automatic fault processing, 5=fault prediction, 6=digital twin, 7=intelligent alarm analysis, 8=intelligent work order, 9=intelligent report, 10=other 11=application.

[0080] The embodiment of the present invention can obtain the alarm probability for the physical device. Specifically, the alarm probability can be the probability that the intelligent operation and maintenance system issues an alarm message to the physical device. For example, in the database of the intelligent operation and maintenance system, m inspection records for the physical device can be accessed to find the number of alarms n, then the alarm probability for the physical device can be n / m.

[0081] After determining the alarm probability of the physical device, the embodiment of the present invention can determine the target physical device through the device identifier, and obtain the simulated inspection abnormality occurrence probability value and the actual inspection abnormality occurrence probability value for the target physical device.

[0082] In a specific implementation, an embodiment of the present invention can combine multiple device identifiers for physical devices into an identification number series string, and determine the target physical device through the identification number series string. For example, "@" is used to represent the separator between levels and sub-modules, and "#" can represent the line separator. 1-1@2-1@3-1@4-3-4@1, 7#1-1@2-2@1, 11 can be expressed in one route, including: environmental monitoring submodule@data cleaning submodule@multi-objective optimization submodule@customized subcomponent@large-screen real-time monitoring submodule and alarm intelligent analysis submodule; in another route, it includes: environmental monitoring submodule@data filtering submodule@large-screen real-time monitoring submodule and application submodule.

[0083] After determining the target physical device, the embodiment of the present invention can obtain the simulated inspection abnormality occurrence probability value for the target physical device and the actual inspection abnormality occurrence probability value. For ease of reading, the simulated inspection abnormality occurrence probability value can be referred to as the simulated value, and the actual inspection abnormality occurrence probability value can be referred to as the actual value.

[0084] Specifically, the actual value of the target physical device can be obtained by accessing the historical alarm data in the historical database, for example, in the storage page for the hierarchical submodule, the actual data parameters about the actual business of the hierarchical submodule are read.

[0085] Optionally, the alarm probability for the physical device may also be directly used as the actual value.

[0086] The simulation value can be obtained in the following way: build a deep inspection model and input the target items that need to be inspected into the deep inspection model. For example, whether the data filtering, cleaning and other sub-modules of the data middle platform layer can normally perform the relevant data management and control functions, whether the sub-modules of the algorithm layer need to be optimized through the training results analysis model, and simulate the functions of each sub-component of the component layer. Determine which type of fault in the sub-module of the application layer is most likely to cause an alarm, and analyze its historical data, etc., and enter the value of the normal operating range in the page of the target physical device. Finally, use the deep inspection model to simulate the inspection of the target physical device, and finally randomly obtain the inspection results to calculate the simulation value. For example, if the number of simulated inspections is m and the number of abnormalities is determined to be n, the simulation value can be n / m.

[0087] After determining the simulation value and actual value for the target physical device, the embodiment of the present invention can determine whether the target physical device is in an overfitting state by judging whether the difference between the simulation value and the actual value exceeds a preset threshold. For example, when the difference between the simulation value and the actual value is greater than or equal to 10%, it can be determined that the current target physical device is in an overfitting state, and if the alarm probability for the target physical device exceeds the preset probability threshold at this time, for example, the alarm probability for the target physical device is greater than or equal to 50%, that is, the alarm information for the physical device is received at the same time, then it can be determined that the currently detected target physical device has an abnormality, and detection data for the target physical device can be generated.

[0088] The embodiment of the present invention obtains multiple levels for the intelligent operation and maintenance system by layering the intelligent operation and maintenance system; the multiple levels respectively have corresponding physical devices; generate device identifications for the physical devices; obtain alarm probabilities for the physical devices; determine the target physical device through the device identification, and obtain a simulated inspection abnormality occurrence probability value for the target physical device, and an actual inspection abnormality occurrence probability value; when the difference between the simulated inspection abnormality occurrence probability value and the actual inspection abnormality occurrence probability value exceeds a preset difference threshold, and the alarm probability for the target physical device exceeds a preset probability threshold, generate detection data for the target physical device, which can not only monitor hardware and applications through alarm probability, but also simulate and test functional defects and hidden faults of each functional module through business data, thereby improving the monitoring mechanism for the intelligent operation and maintenance system, and further improving the work efficiency of the intelligent operation and maintenance system.

[0089] Based on the above embodiment, a variant embodiment of the above embodiment is proposed. It should be noted that in order to make the description concise, only the differences from the above embodiment are described in the variant embodiment.

[0090] In an optional embodiment of the present invention, the step of obtaining the alarm probability for the physical device includes:

[0091] Acquire historical alarm data for the physical device, and determine a probability of occurrence of a historical alarm for the physical device based on the historical alarm data;

[0092] Determine a first historical alarm probability and a second historical alarm probability from the historical alarm occurrence probability; the first historical alarm probability is a historical alarm probability including a false alarm, and the second historical alarm probability is a historical alarm probability not including a false alarm;

[0093] The alarm probability for the physical device is calculated using the historical alarm occurrence probability, the first historical alarm probability, and the second historical alarm probability.

[0094] In actual applications, alarms for physical devices often have false alarms. If the number of false alarms is not considered and the alarm probability for physical devices is directly obtained from the historical database, the final detection data will not truly reflect the actual situation of the intelligent operation and maintenance system.

[0095] In a specific implementation, the intelligent operation and maintenance system of an embodiment of the present invention may have a corresponding historical database, which may be used to store historical alarm data for physical equipment. Therefore, the embodiment of the present invention may directly obtain historical alarm data for physical equipment from the historical database, and determine the probability of occurrence of historical alarms for physical equipment based on the historical alarm data. For example, if m detection data for a certain physical equipment are obtained, including n historical alarm data, the probability of occurrence of historical alarms for the physical equipment may be n / m.

[0096] After determining the historical alarm occurrence probability for the physical device, a first historical alarm probability including a false alarm and a second historical alarm probability not including a false alarm can be determined from the historical alarm occurrence probability.

[0097] Optionally, the step of determining a first historical alarm probability and a second historical alarm probability from the historical alarm occurrence probability includes:

[0098] Acquire alarm occurrence condition data for the physical device; the alarm occurrence condition data at least includes memory occupancy rate, central processing unit occupancy rate, disk occupancy rate, network delay parameter, and number of network packet losses;

[0099] Based on the alarm occurrence condition data, a first historical alarm probability and a second historical alarm probability are determined from the historical alarm occurrence probabilities.

[0100] Exemplarily, alarm occurrence condition data for physical devices can be obtained from a historical database, such as memory occupancy, CPU occupancy, disk occupancy, network delay parameters, number of network packet losses, etc., and then based on the alarm occurrence condition data, the first historical alarm probability and the second historical alarm probability can be determined from the historical alarm occurrence probability.

[0101] For example, for a certain physical device, there is a corresponding historical alarm information, and the alarm data corresponding to the alarm information indicates that when the alarm of the physical device is received, its memory occupancy rate, CPU occupancy rate, disk occupancy rate, network delay parameters, and network packet loss number are all below the preset threshold, that is, the physical device is in a normal state. Therefore, the alarm is a false alarm. By counting all the false alarm information, the first historical alarm probability containing false alarms and the second historical alarm probability not containing false alarms can be determined from the historical alarm occurrence probability.

[0102] After determining the first historical alarm probability that includes false alarms and the second historical alarm probability that does not include false alarms, an embodiment of the present invention can use the historical alarm occurrence probability, the first historical alarm probability, and the second historical alarm probability to construct a Bayesian prediction model, and calculate the alarm probability for the physical device based on the Bayesian prediction model.

[0103] For example, the alarm probability for a physical device may be calculated using the following formula.

[0104] Formula 1:

[0105] ZY(D|+)=ZY(+|D)ZY(D) / (ZY(+|D)ZY(D)+ZY(+|N)ZY(N))

[0106] Among them, "D" = probability of historical alarm occurrence; " / " is the division symbol; "ZY" is the probability of alarm occurrence without considering false alarms; "ZY(D|+)" is the probability of alarm occurrence considering the false alarm rate; "ZY(+|D)" represents the accuracy when the alarm occurs, that is, the prior probability; alarm data false alarm rate = number of false alarms in the historical alarm database / total number of alarms; "ZY(D)" alarm occurrence rate = total number of historical alarms / total number of alarms in the historical alarm database; "ZY(+|N)" represents the probability of misjudgment as an alarm = number of false alarms of conditional probability classification indicator alarms / total number of alarms for the same monitoring indicator; "ZY(N)" = represents the probability of no failure of the alarm, that is, 1-ZY(D).

[0107] “Prior probability” can obtain the total number of fault data for the historical alarm database and analyze the prior probability of the model.

[0108] "Conditional probability" can be used to determine whether the alarm is a false alarm based on the memory usage, CPU usage, disk usage, network delay parameters, network packet loss number, etc.

[0109] The “adjustment factor” may be equal to the number of false alarms of each category obtained by accessing the historical alarm database to obtain conditional probability divided by the total number of alarms in the historical alarm database.

[0110] Of course, the above examples are only for illustration, and those skilled in the art may use other algorithms to calculate the alarm probability for the physical device using the historical alarm occurrence probability, the first historical alarm probability, and the second historical alarm probability. This is not limited by the embodiments of the present invention.

[0111] The embodiment of the present invention obtains historical alarm data for the physical device, and determines the historical alarm occurrence probability for the physical device based on the historical alarm data; obtains alarm occurrence condition data for the physical device; the alarm occurrence condition data at least includes memory occupancy, central processing unit occupancy, disk occupancy, network delay parameters, and the number of network packet losses; based on the alarm occurrence condition data, determines a first historical alarm probability and a second historical alarm probability from the historical alarm occurrence probability; the first historical alarm probability is a historical alarm probability that includes false alarms, and the second historical alarm probability is a historical alarm probability that does not include false alarms; the alarm probability for the physical device is calculated using the historical alarm occurrence probability, the first historical alarm probability, and the second historical alarm probability, thereby further ensuring the authenticity of the alarm probability for the physical device, and enabling the detection data to more accurately reflect the actual situation of the intelligent operation and maintenance system.

[0112] In an optional embodiment of the present invention, the step of obtaining a simulated inspection abnormality occurrence probability value and an actual inspection abnormality occurrence probability value for the target physical device includes:

[0113] Performing a simulated inspection on the target physical device to obtain an initial simulated inspection abnormality occurrence probability value;

[0114] The initial simulated inspection abnormality occurrence probability value is constrained by a ridge regression algorithm, and a simulated inspection abnormality occurrence probability value is generated;

[0115] Historical alarm data for the target physical device is obtained, and an actual inspection abnormality occurrence probability value is obtained based on the historical alarm data.

[0116] In practical applications, the deep inspection model used to obtain simulation values ​​may be overfitted. "Overfitting" is a technical term in the field of deep learning, which means that the model makes the assumptions too strict in order to obtain consistent assumptions. For example, vehicle data includes car logos, wheels, etc. If the model determines that the Mercedes-Benz logo is the identification mark of the vehicle, then the vehicle with the Volkswagen brand logo will not be determined as a vehicle. This is a case of model overfitting. In general, the reasons for overfitting may include noisy data, insufficient training of the model, excessive training of the model, etc. Therefore, in order to prevent the deep inspection model from overfitting, it is necessary to constrain the simulation values ​​obtained by the deep inspection model.

[0117] In a specific implementation, an embodiment of the present invention can directly obtain historical alarm data for a target physical device from a historical database, and obtain actual values ​​based on the historical alarm data; it can also perform simulated inspections on the target physical device, and use the obtained simulated values ​​as initial simulated values, and then constrain the initial simulated values ​​through a ridge regression algorithm, and generate simulated values ​​to ensure that the simulated values ​​are in a non-overfitting state and together with the actual values ​​serve as a determination condition for whether to generate detection data.

[0118] In practical applications, related technologies use the least squares algorithm to prevent model overfitting, but the least squares algorithm lacks stability and reliability. Therefore, an embodiment of the present invention can add a regularization term to the loss function and use the ridge regression method to constrain the initial simulation value to generate a simulation value.

[0119] For example:

[0120] Formula 2:

[0121] ||Xθ-y|| 2 +||Γθ|| 2

[0122] Formula 2 is the ridge regression algorithm formula, where X = input; y = output (prediction result); || = regularization, where r = aI can be defined, that is, the objective training result = fitting value.

[0123] In order to prevent overfitting of the initial simulation values, the initial fitting values ​​can be constrained by the following algorithm.

[0124] Formula 3:

[0125] θ(a)=(X T X+aI) -1 X T y

[0126] Where I is the identity matrix.

[0127] The embodiment of the present invention obtains an initial simulated inspection anomaly probability value by performing a simulated inspection on the target physical device; constrains the initial simulated inspection anomaly probability value by a ridge regression algorithm and generates a simulated inspection anomaly probability value; obtains historical alarm data for the target physical device, and obtains an actual inspection anomaly probability value based on the historical alarm data, thereby ensuring that the simulation value is in a non-overfitting state, thereby enabling the detection data to more accurately reflect the actual situation of the intelligent operation and maintenance system.

[0128] In an optional embodiment of the present invention, it also includes:

[0129] When the difference between the simulated inspection abnormality occurrence probability value and the actual inspection abnormality occurrence probability value exceeds the difference preset threshold, and the alarm probability for the target physical device does not exceed the probability preset threshold, the difference is marked as the first difference data, and the latest simulated inspection abnormality occurrence probability value for the target physical device and the latest actual inspection abnormality occurrence probability value are re-acquired;

[0130] The difference between the latest simulated inspection abnormality occurrence probability value and the latest actual inspection abnormality occurrence probability value is used as second difference data;

[0131] The first difference data and the second difference data are used to generate detection data.

[0132] In actual applications, the target physical device may be in an overfitting state but no alarm information for the target physical device may be received. At this time, it is impossible to determine whether the target physical device has an abnormality. If the detection data is generated directly, not only the accuracy of the data cannot be guaranteed, but also the computing power of the system is wasted. Therefore, the embodiment of the present invention can be used when the difference between the simulated value and the actual value exceeds the preset threshold of the difference, and the alarm probability for the target physical device exceeds the preset range of probability, such as the difference between the simulated value and the actual value is greater than or equal to 10%, and the alarm probability for the target physical device is less than 50%, that is, no alarm information for the target physical device is received. When an alarm message is received, the inspection result of that time can be retained first, that is, the difference between the simulation value and the actual value of that time can be retained and marked as the first difference data, and then the deep inspection model can be used to repeatedly inspect the target physical device, that is, the simulation value and the actual value of the target physical device can be obtained again, and the difference is calculated using the simulation value and the actual value obtained again, and marked as the second difference data, and the first difference data and the second difference data are used to generate detection data, which is reported to the technical staff for evaluation, that is, the technical staff determines whether the inspection result of the target physical device this time is a normal business fluctuation or an abnormality of the target physical device.

[0133] For example, Figure 2 As shown, Figure 2A schematic diagram of a user interface of an intelligent operation and maintenance system provided by an embodiment of the present invention is shown, wherein a plurality of real-time data for various levels of the intelligent operation and maintenance system are displayed in the user interface, including data 201 for the acquisition layer and data 202 for the application layer. In the data 201, the simulation value for a target physical device of the acquisition layer is 5%, the actual value is 45%, and the difference between the two is 35%. It can be determined that the target physical device is in an overfitting state, and since the alarm probability of the target physical device is greater than or equal to 50%, the "alarm abnormality" information for the target physical device is received. Therefore, it can be determined that an abnormality occurs in the target physical device, and detection data for the target physical device can be generated; and in the data 202, the simulation value for a target physical device of the application layer is 5%, the actual value is 45%, and the difference between the two is 35%. It can be determined that It is determined that the target physical device is in an overfitting state, but since the alarm probability of the target physical device is less than 50%, that is, no "alarm exception" information is received for the target physical device, it may be due to business fluctuations that the deep inspection model fails to accurately determine whether the target physical device is in an overfitting state. Therefore, 35% can be retained as the first difference data, and then the deep inspection model can be used to inspect the target physical device again, and the simulation value and the actual value for the target physical device can be obtained again, and the difference between the simulation value and the actual value can be calculated as the second difference data, and the first difference data and the second difference data are used to generate detection data, and the detection data is uploaded to the technician. Assuming that after the simulation value and the actual value are re-obtained, the difference is still 35%, the technician can use this as a judgment that the result is not affected by normal business fluctuations, but that there is an abnormality in the target physical device.

[0134] Of course, the above examples are only examples, and those skilled in the art may use any value as the preset threshold value according to actual needs, and the embodiments of the present invention do not limit this.

[0135] In an embodiment of the present invention, when the difference between the simulated inspection abnormality occurrence probability value and the actual inspection abnormality occurrence probability value exceeds the preset difference threshold and the alarm probability for the target physical device does not exceed the preset probability threshold, the difference is marked as first difference data, and the latest simulated inspection abnormality occurrence probability value and the latest actual inspection abnormality occurrence probability value for the target physical device are re-acquired; the difference between the latest simulated inspection abnormality occurrence probability value and the latest actual inspection abnormality occurrence probability value is used as second difference data; and the first difference data and the second difference data are used to generate detection data, thereby avoiding the direct generation of detection data according to the inspection results of the deep inspection model when the detection results obtained by the Bayesian prediction model and the deep inspection model are inconsistent, thereby improving the accuracy of the detection data and further improving the efficiency of generating detection data.

[0136] In order to enable those skilled in the art to better understand the embodiments of the present invention, a complete example is used below to fully illustrate the embodiments of the present invention.

[0137] Step 1:

[0138] S1. AIOps is divided into five layers horizontally: collection layer, data middle platform layer, algorithm layer, component layer and application layer, and marked as follows:

[0139] The data collection layer includes: 1-1 = environment monitoring, 1-2 = network monitoring, 1-3 = host monitoring, 1-4 = system monitoring, 1-5 = security monitoring, 1-6 = cloud resources, 1-7 = application monitoring;

[0140] Data operation and maintenance platform: 2-1 = data cleaning, 2-2 = data filtering, 2-3 = data standardization, 2-4 = indicator calculation, 2-5 = abnormal marking, 2-6 = data warehouse, 2-7 = configuration item management, 2-8 = relationship management, 2-9 = business model topology, 2-10 = dictionary and rule management;

[0141] Algorithm layer: 3-1 = multi-objective optimization, 3-2 = NLP log algorithm, 3-3 neural network, 3-4 hybrid graph model, 3-4 = Metric, 3-5 = Trace);

[0142] Component layer: 4-1 = Intelligent analysis: subcomponents include (4-1-1 association analysis, 4-1-2 routing analysis, 4-1-3 log analysis, 4-1-4 resource analysis);

[0143] 4-2 = Service Management: Subcomponents include (4-2-1 = Service Catalog, 4-2-2 = Work Order Management, 4-2-3 = Personnel Management, 4-2-4 Workplace Management);

[0144] 4-3 = Automated operation: subcomponents include (4-3-1 = automatic inspection, 4-3-2 = batch operation, 4-3-3 = emergency response, 4-3-4 = customization);

[0145] 4-4 = Knowledge base: subcomponents include (4-4-1 = troubleshooting knowledge base, 4-4-2 = engineer experience base);

[0146] 4-5 = 3D visualization engine: subcomponents include (4-5-1 = graphics modeling, 4-5-2 = application interface);

[0147] SRE / Devops layer: 5-1 = other capabilities, 5-2 = space management, 5-3 = code management, 5-4 = automatic release, 5-5 = API / SDK);

[0148] Unique serial number of the application layer database: 1=large-screen real-time monitoring, 2=distributed network, 3=precise fault location, 4=automatic fault handling, 5=fault prediction, 6=digital twin, 7=intelligent alarm analysis, 8=intelligent work order, 9=intelligent report, 10=other 11=App.

[0149] The identification format can be 1-1@2-1@3-1@4-3-4@1, 7#1-1@2-2@1, 11.

[0150] Among them, # represents the line separator and @ represents the level and submodule separator.

[0151] S2. Construct a Bayesian prediction model for physical equipment inspection at each layer according to its function, as follows:

[0152] First, obtain the "prior probability" and "adjustment factor" required by the model through the historical alarm database

[0153] The “prior probability” historical alarm database obtains the total number of fault data and analyzes it to obtain the prior probability of the model, that is, how many faults there are.

[0154] "Conditional Probability" classifies the device's memory usage, CPU usage, disk usage, network latency, and number of network packet losses as conditional probabilities.

[0155] “Adjustment factor” = number of false alarms of each category of conditional probability obtained by accessing the historical alarm database / total number of alarms in the historical alarm database.

[0156] Model mathematical formula:

[0157] ZY(D|+)=ZY(+|D)ZY(D) / (ZY(+|D)ZY(D)+ZY(+|N)ZY(N))

[0158] Obtain the "probability of physical equipment alarming" through model calculation

[0159] Related parameter description:

[0160] “D” = probability of occurrence of historical alarms;

[0161] “ / ” = division symbol;

[0162] “ZY” = probability of alarm occurrence without considering false alarm rate;

[0163] “ZY(D|+)” = the probability of an alarm occurring, taking into account the false alarm rate;

[0164] "ZY(+|D)" represents the accuracy rate when the alarm occurs, that is, (prior probability) = 1-false alarm rate of the alarm data. For example, if the false alarm rate is 1% when the alarm occurs, then ZY(+|D)1-0.01=0.99;

[0165] Formula Description:

[0166] False alarm rate of alarm data = number of false alarms in the historical alarm database / total number of alarms;

[0167] "ZY(D)" alarm occurrence rate = total number of historical alarms / total number of alarms in the historical alarm database;

[0168] “ZY(+|N)” represents the probability of misjudgment into an alarm = number of false alarms of conditional probability classification indicator / total number of alarms of the same monitoring indicator;

[0169] “ZY(N)” = represents the probability that the alarm will not cause a failure, that is, 1-ZY(D).

[0170] S3. Classify the data in the horizontal layer and determine the inspection target content, as follows:

[0171] Collection layer: The main inspection object is whether the data of the collection layer is standard and the format is normal. The "Bayesian prediction model" is commonly used for physical equipment inspection.

[0172] Data middle platform layer: The main inspection object is whether the data filtering, cleaning and other modules of the data middle platform layer can normally perform the relevant data control functions. The "Bayesian prediction model" is commonly used for physical equipment inspection.

[0173] Algorithm layer: The main inspection object is the algorithm layer models. The training results are used to analyze whether the models need to be optimized. The "Bayesian prediction model" is commonly used for physical equipment inspection.

[0174] Component layer: The main inspection object is the functional simulation test of each component at the component layer. The "Bayesian prediction model" is commonly used for physical equipment inspection.

[0175] Application layer: The main inspection object is the display data of the application layer. Each module is classified according to the fault type from the historical database. That is, which fault type in the current module is most likely to cause an alarm, and its historical data is analyzed. The "Bayesian prediction model" is commonly used for physical equipment inspection.

[0176] Step 2: Parse the identification, and conduct simulated inspections on each horizontal layer inspection object according to the identification, and obtain the probability value of simulated inspection anomaly occurrence through program simulation data combined with the deep inspection model, and obtain the probability value of actual inspection anomaly occurrence through historical data combined with the deep inspection model, and generate the inspection report module. At the same time, according to the probability prediction, the difference between the actual value and the simulated value is analyzed to determine whether the functions of the modules in each horizontal layer are strong. If the difference between the actual value and the simulated value is greater than or equal to 10%, and the alarm probability for the physical device determined by the Bayesian prediction model is greater than or equal to 50%, it is an overfitting state and the alarm database also has an alarm for the corresponding module, then notify the relevant technical personnel to conduct functional inspections on the level and module where the inspection is located, including (background inspection of input data, analysis of historical data, whether the data of other related modules or level businesses is abnormal, etc.). If the fitting value is too large and there is no alarm, perform multiple deep inspections and if the results are the same, report to the technical personnel to confirm whether it is a normal business fluctuation or an alarm.

[0177] Before performing difference analysis, you can also use the ridge regression method to prevent the model from overfitting. The ridge regression method model formula is: ||Xθ-y|| 2 +||Γθ|| 2 , where X = input; y = output (prediction result); || = regularization; to prevent overfitting operation process: θ(a) = (X T X+aI) -1 X T y; where I is the identity matrix.

[0178] The Bayesian prediction model is a routine inspection, and the main monitoring objects are network equipment, network quality and other routine monitoring indicators. The deep health inspection model generates simulated data + actual business data through the simulated behavior of human operation pages, and compares them to inspect whether the page function input of each functional layer is abnormal. Through the steps in the above example, the intelligent operation and maintenance system can be inspected at a deeper level.

[0179] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0180] Reference Figure 3 , shows a structural block diagram of a detection data generating device for an intelligent operation and maintenance system provided in an embodiment of the present invention, which may specifically include the following modules:

[0181] The system layering module 301 is used to layer the intelligent operation and maintenance system to obtain multiple layers for the intelligent operation and maintenance system; the multiple layers respectively have corresponding physical devices;

[0182] A device identification generating module 302, configured to generate a device identification for the physical device;

[0183] An alarm probability acquisition module 303 is used to acquire the alarm probability for the physical device;

[0184] A target physical device determination module 304 is used to determine the target physical device through the device identifier, and obtain a simulated inspection abnormality occurrence probability value for the target physical device and an actual inspection abnormality occurrence probability value;

[0185] The first detection data generating module 305 is used to generate detection data for the target physical device when the difference between the simulated inspection abnormality occurrence probability value and the actual inspection abnormality occurrence probability value exceeds a preset difference threshold, and the alarm probability for the target physical device exceeds a preset probability threshold.

[0186] Optionally, the alarm probability acquisition module may include:

[0187] A historical alarm occurrence probability determination submodule, used to obtain historical alarm data for the physical device, and determine the historical alarm occurrence probability for the physical device based on the historical alarm data;

[0188] A historical alarm probability determination submodule, used to determine a first historical alarm probability and a second historical alarm probability from the historical alarm occurrence probability; the first historical alarm probability is a historical alarm probability containing a false alarm, and the second historical alarm probability is a historical alarm probability not containing a false alarm;

[0189] The alarm probability acquisition submodule is used to calculate the alarm probability for the physical device by using the historical alarm occurrence probability, the first historical alarm probability, and the second historical alarm probability.

[0190] Optionally, the historical alarm probability determination submodule may include:

[0191] An alarm occurrence condition data acquisition unit is used to acquire alarm occurrence condition data for the physical device; the alarm occurrence condition data at least includes memory occupancy rate, central processing unit occupancy rate, disk occupancy rate, network delay parameter, and network packet loss number;

[0192] The historical alarm probability determination unit obtains the alarm occurrence condition data and determines a first historical alarm probability and a second historical alarm probability from the historical alarm occurrence probability.

[0193] Optionally, the target physical device determination module may include:

[0194] An initial simulated inspection abnormality occurrence probability value acquisition submodule is used to perform a simulated inspection on the target physical device to obtain an initial simulated inspection abnormality occurrence probability value;

[0195] A simulated inspection anomaly occurrence probability value generation submodule is used to constrain the initial simulated inspection anomaly occurrence probability value through a ridge regression algorithm and generate a simulated inspection anomaly occurrence probability value;

[0196] The actual inspection abnormality occurrence probability value acquisition submodule is used to acquire historical alarm data for the target physical device and acquire the actual inspection abnormality occurrence probability value based on the historical alarm data.

[0197] Optionally, it may also include:

[0198] The latest probability value acquisition module is used to mark the difference as the first difference data when the difference between the simulated inspection abnormality occurrence probability value and the actual inspection abnormality occurrence probability value exceeds the preset difference threshold, and the alarm probability for the target physical device does not exceed the preset probability threshold, and re-acquire the latest simulated inspection abnormality occurrence probability value for the target physical device, and the latest actual inspection abnormality occurrence probability value;

[0199] A second difference data generating module, used for taking the difference between the latest simulated inspection abnormality occurrence probability value and the latest actual inspection abnormality occurrence probability value as second difference data;

[0200] The second detection data generating module is used to generate detection data using the first difference data and the second difference data.

[0201] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0202] In addition, an embodiment of the present invention further provides an electronic device, including: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned embodiment of the detection data generation method for the intelligent operation and maintenance system are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0203] The embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, each process of the above-mentioned detection data generation method embodiment for the intelligent operation and maintenance system is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0204] Figure 4 A schematic diagram of the hardware structure of an electronic device for implementing various embodiments of the present invention.

[0205] The electronic device 400 includes but is not limited to: a radio frequency unit 401, a network module 402, an audio output unit 403, an input unit 404, a sensor 405, a display unit 406, a user input unit 407, an interface unit 408, a memory 409, a processor 410, and a power supply 411. Those skilled in the art will appreciate that Figure 4 The electronic device structure shown in the figure does not constitute a limitation on the electronic device, and the electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. In the embodiments of the present invention, the electronic device includes but is not limited to a mobile phone, a tablet computer, a laptop computer, a PDA, a vehicle-mounted terminal, a wearable device, and a pedometer.

[0206] It should be understood that in the embodiment of the present invention, the radio frequency unit 401 can be used for receiving and sending signals during information transmission or communication. Specifically, after receiving downlink data from the base station, it is sent to the processor 410 for processing; in addition, uplink data is sent to the base station. Generally, the radio frequency unit 401 includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, etc. In addition, the radio frequency unit 401 can also communicate with the network and other devices through a wireless communication system.

[0207] The electronic device provides users with wireless broadband Internet access through the network module 402, such as helping users to send and receive emails, browse web pages, and access streaming media.

[0208] The audio output unit 403 can convert the audio data received by the RF unit 401 or the network module 402 or stored in the memory 409 into an audio signal and output it as sound. Moreover, the audio output unit 403 can also provide audio output related to a specific function performed by the electronic device 400 (for example, a call signal reception sound, a message reception sound, etc.). The audio output unit 403 includes a speaker, a buzzer, a receiver, etc.

[0209] The input unit 404 is used to receive audio or video signals. The input unit 404 may include a graphics processor (GPU) 4041 and a microphone 4042, and the graphics processor 4041 processes the image data of a static picture or video obtained by an image capture device (such as a camera) in a video capture mode or an image capture mode. The processed image frame can be displayed on the display unit 406. The image frame processed by the graphics processor 4041 can be stored in the memory 409 (or other storage medium) or sent via the radio frequency unit 401 or the network module 402. The microphone 4042 can receive sound and can process such sound into audio data. The processed audio data can be converted into a format output that can be sent to a mobile communication base station via the radio frequency unit 401 in the case of a telephone call mode.

[0210] The electronic device 400 also includes at least one sensor 405, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor and a proximity sensor, wherein the ambient light sensor can adjust the brightness of the display panel 4061 according to the brightness of the ambient light, and the proximity sensor can turn off the display panel 4061 and / or the backlight when the electronic device 400 is moved to the ear. As a type of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in each direction (generally three axes), and can detect the magnitude and direction of gravity when stationary, which can be used to identify the posture of the electronic device (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; the sensor 405 can also include a fingerprint sensor, a pressure sensor, an iris sensor, a molecular sensor, a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, etc., which will not be repeated here.

[0211] The display unit 406 is used to display information input by the user or information provided to the user. The display unit 406 may include a display panel 4061, which may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.

[0212] The user input unit 407 can be used to receive input digital or character information, and to generate key signal input related to user settings and function control of the electronic device. Specifically, the user input unit 407 includes a touch panel 4071 and other input devices 4072. The touch panel 4071, also known as a touch screen, can collect the user's touch operation on or near it (such as the user's operation on the touch panel 4071 or near the touch panel 4071 using any suitable object or accessory such as a finger, stylus, etc.). The touch panel 4071 may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch orientation, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into the contact point coordinates, and then sends it to the processor 410, receives the command sent by the processor 410 and executes it. In addition, the touch panel 4071 can be implemented using various types such as resistive, capacitive, infrared and surface acoustic waves. In addition to the touch panel 4071, the user input unit 407 may also include other input devices 4072. Specifically, other input devices 4072 may include but are not limited to a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which are not described in detail here.

[0213] Furthermore, the touch panel 4071 may be overlaid on the display panel 4061. When the touch panel 4071 detects a touch operation on or near it, it is transmitted to the processor 410 to determine the type of the touch event. Then, the processor 410 provides a corresponding visual output on the display panel 4061 according to the type of the touch event. Figure 4 In the figure, the touch panel 4071 and the display panel 4061 are two independent components to realize the input and output functions of the electronic device. However, in some embodiments, the touch panel 4071 and the display panel 4061 can be integrated to realize the input and output functions of the electronic device, which is not limited here.

[0214] The interface unit 408 is an interface for connecting an external device to the electronic device 400. For example, the external device may include a wired or wireless headset port, an external power supply (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device with an identification module, an audio input / output (I / O) port, a video I / O port, a headphone port, etc. The interface unit 408 may be used to receive input (e.g., data information, power, etc.) from an external device and transmit the received input to one or more elements within the electronic device 400 or may be used to transmit data between the electronic device 400 and an external device.

[0215] The memory 409 can be used to store software programs and various data. The memory 409 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory 409 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0216] The processor 410 is the control center of the electronic device. It uses various interfaces and lines to connect various parts of the entire electronic device. It executes various functions of the electronic device and processes data by running or executing software programs and / or modules stored in the memory 409, and calling data stored in the memory 409, so as to monitor the electronic device as a whole. The processor 410 may include one or more processing units; preferably, the processor 410 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, etc., and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 410.

[0217] The electronic device 400 may also include a power supply 411 (such as a battery) for supplying power to each component. Preferably, the power supply 411 may be logically connected to the processor 410 through a power management system, thereby implementing functions such as charging, discharging, and power consumption management through the power management system.

[0218] In addition, the electronic device 400 includes some functional modules not shown, which will not be described in detail here.

[0219] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0220] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0221] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

[0222] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the embodiments of the present invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0223] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0224] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0225] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0226] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0227] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, ROM, RAM, magnetic disks, or optical disks.

[0228] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A method for generating detection data for an intelligent operation and maintenance system, characterized in that: include: Layering the intelligent operation and maintenance system to obtain multiple levels for the intelligent operation and maintenance system; The multiple levels respectively have corresponding physical devices; generating a device identification for the physical device; Obtaining an alarm probability for the physical device; Determine the target physical device through the device identifier, and obtain a simulated inspection abnormality occurrence probability value and an actual inspection abnormality occurrence probability value for the target physical device; The step of obtaining a simulated inspection abnormality occurrence probability value for the target physical device and an actual inspection abnormality occurrence probability value comprises: Performing a simulated inspection on the target physical device to obtain an initial simulated inspection abnormality occurrence probability value; The initial simulated inspection abnormality occurrence probability value is constrained by a ridge regression algorithm, and a simulated inspection abnormality occurrence probability value is generated; Acquire historical alarm data for the target physical device, and acquire an actual inspection abnormality occurrence probability value based on the historical alarm data; When the difference between the simulated inspection abnormality occurrence probability value and the actual inspection abnormality occurrence probability value exceeds a preset difference threshold, and the alarm probability for the target physical device exceeds a preset probability threshold, detection data for the target physical device is generated.

2. The method according to claim 1, characterized in that The step of obtaining the alarm probability for the physical device comprises: Acquire historical alarm data for the physical device, and determine a probability of occurrence of a historical alarm for the physical device based on the historical alarm data; Determine a first historical alarm probability and a second historical alarm probability from the historical alarm occurrence probability; the first historical alarm probability is a historical alarm probability including a false alarm, and the second historical alarm probability is a historical alarm probability not including a false alarm; The alarm probability for the physical device is calculated using the historical alarm occurrence probability, the first historical alarm probability, and the second historical alarm probability.

3. The method according to claim 2, characterized in that The step of determining the first historical alarm probability and the second historical alarm probability from the historical alarm occurrence probability comprises: Acquire alarm occurrence condition data for the physical device; the alarm occurrence condition data at least includes memory occupancy rate, central processing unit occupancy rate, disk occupancy rate, network delay parameter, and number of network packet losses; Based on the alarm occurrence condition data, a first historical alarm probability and a second historical alarm probability are determined from the historical alarm occurrence probabilities.

4. The method according to claim 1, characterized in that Also includes: When the difference between the simulated inspection abnormality occurrence probability value and the actual inspection abnormality occurrence probability value exceeds the difference preset threshold, and the alarm probability for the target physical device does not exceed the probability preset threshold, the difference is marked as the first difference data, and the latest simulated inspection abnormality occurrence probability value for the target physical device and the latest actual inspection abnormality occurrence probability value are re-acquired; The difference between the latest simulated inspection abnormality occurrence probability value and the latest actual inspection abnormality occurrence probability value is used as second difference data; The first difference data and the second difference data are used to generate detection data.

5. A detection data generating device for an intelligent operation and maintenance system, characterized in that: include: A system layering module, used to layer the intelligent operation and maintenance system to obtain multiple layers for the intelligent operation and maintenance system; The multiple levels respectively have corresponding physical devices; A device identification generation module, used to generate a device identification for the physical device; An alarm probability acquisition module, used to obtain the alarm probability for the physical device; A target physical device determination module is used to determine the target physical device through the device identifier, and obtain a simulated inspection abnormality occurrence probability value for the target physical device and an actual inspection abnormality occurrence probability value; A first detection data generating module, configured to generate detection data for the target physical device when the difference between the simulated inspection abnormality occurrence probability value and the actual inspection abnormality occurrence probability value exceeds a preset difference threshold, and the alarm probability for the target physical device exceeds a preset probability threshold; The target physical device determination module includes: An initial simulated inspection abnormality occurrence probability value acquisition submodule is used to perform a simulated inspection on the target physical device to obtain an initial simulated inspection abnormality occurrence probability value; A simulated inspection anomaly occurrence probability value generation submodule is used to constrain the initial simulated inspection anomaly occurrence probability value through a ridge regression algorithm and generate a simulated inspection anomaly occurrence probability value; The actual inspection abnormality occurrence probability value acquisition submodule is used to acquire historical alarm data for the target physical device and acquire the actual inspection abnormality occurrence probability value based on the historical alarm data.

6. The device according to claim 5, characterized in that The alarm probability acquisition module includes: A historical alarm occurrence probability determination submodule, used to obtain historical alarm data for the physical device, and determine the historical alarm occurrence probability for the physical device based on the historical alarm data; A historical alarm probability determination submodule, used to determine a first historical alarm probability and a second historical alarm probability from the historical alarm occurrence probability; the first historical alarm probability is a historical alarm probability containing a false alarm, and the second historical alarm probability is a historical alarm probability not containing a false alarm; The alarm probability acquisition submodule is used to calculate the alarm probability for the physical device by using the historical alarm occurrence probability, the first historical alarm probability, and the second historical alarm probability.

7. The device according to claim 6, characterized in that The historical alarm probability determination submodule includes: An alarm occurrence condition data acquisition unit is used to acquire alarm occurrence condition data for the physical device; the alarm occurrence condition data at least includes memory occupancy rate, central processing unit occupancy rate, disk occupancy rate, network delay parameter, and network packet loss number; The historical alarm probability determination unit obtains the alarm occurrence condition data and determines a first historical alarm probability and a second historical alarm probability from the historical alarm occurrence probability.

8. The device according to claim 5, characterized in that Also includes: The latest probability value acquisition module is used to mark the difference as the first difference data when the difference between the simulated inspection abnormality occurrence probability value and the actual inspection abnormality occurrence probability value exceeds the preset difference threshold, and the alarm probability for the target physical device does not exceed the preset probability threshold, and re-acquire the latest simulated inspection abnormality occurrence probability value for the target physical device, and the latest actual inspection abnormality occurrence probability value; A second difference data generating module, used for taking the difference between the latest simulated inspection abnormality occurrence probability value and the latest actual inspection abnormality occurrence probability value as second difference data; The second detection data generating module is used to generate detection data using the first difference data and the second difference data.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the method according to any one of claims 1 to 4 when executing the program stored in the memory.

10. A computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, cause the processors to perform the method according to any one of claims 1 to 4.

Images