An alarm event processing method, system, storage medium and terminal

Abstract

The application provides an alarm event processing method, and the specific technical scheme is as follows: based on an alarm event log, an alarm directed graph described by the alarm event log is constructed; the alarm directed graph is converted into a vectorized alarm feature; a feature similarity distance between the vectorized alarm feature and each alarm log cluster is calculated; if there is a target alarm log cluster with a feature similarity distance less than a preset threshold, the alarm event log is added to the target alarm log cluster to perform alarm aggregation on the alarm directed graph. The application can not only aggregate a large number of alarm event logs, but also effectively consider context information in the alarm directed graph in the process of calculating the feature similarity distance, so that the burden of operation and maintenance analysis is greatly reduced while ensuring that the alarm event type is not covered up, and the disposal efficiency of the alarm event log is improved. The application also provides an alarm event processing system, a computer readable storage medium and a terminal, which have the above beneficial effects.

Description

Technical Field

[0001] This application relates to the field of network security, and in particular to an alarm event handling method, system, storage medium, and terminal. Background Technology

[0002] As enterprises expand and the number of users increases, the speed at which network attack alerts are generated is also accelerating. Humans can no longer analyze the massive number of alerts, let alone identify representative alerts from the vast amount of data. This results in extremely low efficiency in handling alerts and seriously affects enterprise network security. Summary of the Invention

[0003] The purpose of this application is to provide an alarm event processing method, an alarm event processing system, a storage medium, and a terminal, which can aggregate alarm events by calculating alarm event similarity, thereby improving the processing efficiency of alarm events.

[0004] To address the aforementioned technical problems, this application provides an alarm event handling method, the specific technical solution of which is as follows:

[0005] Based on the alarm event log, construct the directed graph of the alarm event described by the alarm event log;

[0006] The alarm directed graph is converted into vectorized alarm features;

[0007] Calculate the similarity distance between the vectorized alarm features and the features of each alarm log cluster;

[0008] If there is a target alarm log cluster with a feature similarity distance less than a preset threshold, the alarm event log is added to the target alarm log cluster to perform alarm aggregation on the directed alarm graph.

[0009] Optionally, the alarm directed graph is specifically an alarm process tree;

[0010] Accordingly, converting the directed alarm graph into vectorized alarm features includes:

[0011] The alarm directed graph is converted into vectorized alarm features using a feature vectorization model;

[0012] Accordingly, before converting the directed alarm graph into vectorized alarm features, the process also includes:

[0013] Obtain the alarm log dataset;

[0014] Construct an alarm process tree corresponding to each alarm log in the alarm log dataset;

[0015] Traverse each branch of the alarm process tree to obtain alarm characteristics;

[0016] The alarm features are used as the training set, and the Graph2Vec algorithm is used to train the model to obtain the feature vectorization model.

[0017] Optionally, constructing the alarm process tree corresponding to the alarm event log includes:

[0018] Determine the process tree field information in the alarm event log;

[0019] Using the process tree field information as nodes, a directed graph-like alarm process tree is constructed based on the connection relationships between the nodes.

[0020] Optionally, traversing each branch of the alarm process tree to obtain alarm characteristics includes:

[0021] Several branches are determined with the root node of the alarm process tree as the starting point and each end of the alarm process tree as the ending point; wherein, the nodes in the alarm process tree contain string data of several characters.

[0022] For each branch, let the branch contain M nodes, the step length of the concatenated string is 1, and the number of concatenations m is determined. In each branch, the starting node of the concatenation of the Nth concatenated string is N, the string length is m, and N concatenated strings are obtained; and N = M - m + 1.

[0023] For each concatenated string, a sliding window is used to perform sliding segmentation starting from the first character of the concatenated string to obtain all the segmented strings contained in the concatenated string, and the segmented strings are used as alarm features.

[0024] Optionally, after adding the alarm event log to the target alarm log cluster to perform alarm aggregation on the directed alarm graph, the method further includes:

[0025] An alarm event is generated corresponding to each alarm log cluster; when an alarm event is processed, all alarm event logs within the alarm log cluster are processed synchronously.

[0026] Optionally, if the feature similarity distance with each alarm log cluster is not less than a preset threshold, the following additional steps are also included:

[0027] Establish a new alarm log cluster corresponding to the directed alarm graph.

[0028] Optional, also includes:

[0029] The alarm event logs are processed for fields and saved to the alarm event database in string format.

[0030] This application also provides an alarm event handling system, including:

[0031] The log acquisition module is used to construct a directed graph of alarm events based on the alarm event logs.

[0032] The vectorization processing module is used to convert the directed alarm graph into vectorized alarm features;

[0033] The distance calculation module is used to calculate the feature similarity distance between the vectorized alarm features and the features of each alarm log cluster;

[0034] The alarm event processing module is used to add the alarm event log to the target alarm log cluster if there is a target alarm log cluster with a feature similarity distance of less than a preset threshold, so as to perform alarm aggregation on the directed alarm graph.

[0035] This application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described above.

[0036] This application also provides a terminal, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method described above when it invokes the computer program in the memory.

[0037] This application provides an alarm event processing method, the specific technical solution of which is as follows: Based on the alarm event log, an alarm directed graph described by the alarm event log is constructed; the alarm directed graph is converted into vectorized alarm features; the feature similarity distance between the vectorized alarm features and each alarm log cluster is calculated; if there is a target alarm log cluster with a feature similarity distance less than a preset threshold, the alarm event log is added to the target alarm log cluster to perform alarm aggregation on the alarm directed graph.

[0038] This application converts alarm event logs into corresponding vectorized alarm features, thereby calculating the feature similarity distance with existing alarm log clusters. If a target alarm log cluster with a feature similarity distance less than a preset threshold exists, it is classified into that target alarm log cluster. This not only aggregates a large number of alarm event logs, but also effectively considers the contextual information in the directed alarm graph during the feature similarity distance calculation process. This greatly reduces the burden of operation and maintenance analysis and improves the processing efficiency of alarm event logs while ensuring that the alarm event type is not masked.

[0039] This application also provides an alarm event handling system, a computer-readable storage medium, and a terminal, which have the above-mentioned beneficial effects, and will not be elaborated here. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0041] Figure 1 A flowchart illustrating an alarm event handling method provided in an embodiment of this application;

[0042] Figure 2 A flowchart illustrating another alarm event handling method provided in this application embodiment;

[0043] Figure 3 A flowchart illustrating the generation process of a feature vectorization model provided in this application embodiment;

[0044] Figure 4 A schematic diagram of an alarm event handling system provided in this application embodiment:

[0045] Figure 5 This is a schematic diagram of the structure of a terminal provided in an embodiment of this application. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0047] See Figure 1 , Figure 1 A flowchart of an alarm event handling method provided in this application embodiment, the method including:

[0048] S101: Based on the alarm event log, construct the directed graph of the alarm event described by the alarm event log;

[0049] This step aims to obtain alarm event logs and construct a corresponding directed alarm graph. The method for obtaining the alarm event logs is not limited here; one feasible approach is to directly retrieve the alarm event logs from a queue storing alarm event logs, such as a Kafka queue, or from a database storing alarm event logs, and then convert the obtained alarm event logs into the corresponding directed alarm graph.

[0050] This embodiment does not limit the format of the alarm event log. In one feasible implementation, the alarm event log can be a nested JSON format, for example:

[0051] {"mgrId":30101651007,"updateTime":1640250865,"procTree":{"edgeInfo":[{"edgeId":1,"fNodeId":"n1","cNodeId":"n2","alertId":" "},"ruleId":""],"nodeInfo":[{"nodeId":"n1","cmdLine":"","pName":"","path"},"nodeId":"n2","cmdLine":"","pName":"","path"}]}}

[0052] In the process of converting alarm event logs into a directed graph, the JSON format alarm event logs can be directly parsed and converted into the corresponding directed graph, thus directly reflecting the relationship between the contexts in the alarm event logs.

[0053] Furthermore, this embodiment does not specifically limit the content of the alarm directed graph. It can record descriptions of relevant information such as date, time, running events, and event initiators. In addition, it can also include process tree-related information, such as process tree fields. The process tree fields contain process details and information on the connections between processes.

[0054] S102: Convert the alarm directed graph into vectorized alarm features;

[0055] This step aims to transform the alarm data contained in the directed alarm graph into a vectorized feature representation.

[0056] This embodiment assumes that the feature vectorization model has been obtained or is applicable before performing this step, and does not limit the specific generation and acquisition methods of the feature vectorization model. Similarly, any model that can convert alarm event logs into corresponding vectorized feature representations can be used as the feature vectorization model in this step.

[0057] Furthermore, the vectorized alarm features obtained in this step can be represented by any vectorized format, serving as the vectorized features corresponding to the alarm event log. It should be noted that each alarm event log can yield at least one vectorized alarm feature. If the alarm event log is complex, multiple vectorized alarm features can be output through the feature vectorization model. The specific number of output vectorized alarm features depends on the content of the alarm event log and the model structure of the feature vectorization model.

[0058] In a preferred execution method, if the alarm directed graph is an alarm process tree, this step can use a feature vectorization model to transform the alarm directed graph into vectorized alarm features.

[0059] S103: Calculate the feature similarity distance between the vectorized alarm features and the features of each alarm log cluster;

[0060] This step requires calculating the feature similarity distance. Typically, this can be done by calculating the cosine distance between the vectorized alarm features and the alarm log cluster. Other distance calculation methods can also be used, including but not limited to Euclidean distance and Manhattan distance. Any calculation method that reflects the similarity between vectors can be applied to this step.

[0061] It should be noted that, by default, at least one alarm log cluster containing vector features exists prior to this step. Several empty alarm log clusters may also exist. During this step, the feature similarity score is calculated between the vectorized alarm features obtained in the previous steps and the features of the alarm log clusters.

[0062] If a single alarm event log generates multiple corresponding vectorized alarm features, this step can calculate the feature similarity distance for each vectorized alarm feature. Then, based on the calculated feature similarity distance, proceed to step S104 or step S105.

[0063] S104: If there is a target alarm log cluster with a feature similarity distance less than a preset threshold, add the alarm event log to the target alarm log cluster to perform alarm aggregation on the directed alarm graph;

[0064] If the alarm event log yields only one vectorized alarm feature and the calculated feature similarity distance is less than a preset threshold, the alarm event log can be added to the target alarm log cluster. If there are no alarm log clusters with feature similarity distances less than the preset threshold, a new alarm log cluster can be created for the alarm event log and the alarm event log can be placed into the new alarm log cluster. The vectorized alarm feature obtained in the aforementioned steps can be used as the feature of the new alarm log cluster.

[0065] The preset threshold is not limited here; its magnitude can be set, for example, it can be 10.-3 If the similarity level, i.e., the feature similarity distance, is less than one-thousandth, then the alarm event log is considered to have extremely high similarity to the existing alarm event logs in the target alarm log cluster and can be classified and processed. Therefore, it is added to the target alarm log cluster. Otherwise, a new alarm log cluster corresponding to the directed alarm graph is created.

[0066] If multiple vectorized alarm features can be obtained from the alarm event log, the feature similarity distance above is calculated for each vectorized alarm feature and verified. If multiple target alarm log clusters meet the condition that the feature similarity distance is less than the preset threshold, the alarm event log can be regarded as a special alarm and classified into a special alarm log cluster, or it can be marked as a composite of multiple types of alarms, and the user can perform special processing.

[0067] In addition, as a preferred method of execution for this step, see [link to relevant documentation]. Figure 2 , Figure 2 A flowchart illustrating another alarm event handling method provided in this application embodiment. It may include the following steps:

[0068] S201: Based on the alarm event log, construct the directed graph of the alarm event described by the alarm event log;

[0069] S202: Convert the alarm directed graph into vectorized alarm features;

[0070] S203: Calculate the feature similarity distance between the vectorized alarm features and the features of each alarm log cluster;

[0071] S204: If there is a target alarm log cluster with a feature similarity distance less than a preset threshold, add the alarm event log to the target alarm log cluster to perform alarm aggregation on the directed alarm graph;

[0072] S205: If the feature similarity distance with each of the alarm log clusters is not less than a preset threshold, establish a new alarm log cluster corresponding to the directed alarm graph.

[0073] If the feature similarity distance with each alarm log cluster is not less than a preset threshold, a new alarm log cluster corresponding to the alarm directed graph is established. At this time, it can be considered that the alarm directed graph corresponds to a new type of alarm log, which should not be handled in the same way as any existing type of alarm log. A new alarm log cluster can be established for handling.

[0074] It's easy to understand that when processing a large number of alarm event logs, the number of alarm log clusters will gradually increase as the causes of alarm events in the logs increase. Furthermore, each alarm log cluster contains corresponding category tagging information, allowing users to process alarm event logs within that cluster with a single click.

[0075] In a more preferred implementation, alarm events corresponding to each alarm log cluster can be generated. When an alarm event is processed, all alarm event logs within the same alarm log cluster can be processed synchronously. Thus, by using the above process, all alarm event logs can be categorized into alarm log clusters. Except for characteristic alarm log clusters, the alarm event logs in the remaining alarm log clusters are highly similar alarms, allowing for batch processing using the same or similar processing methods, significantly reducing the number of alarms that need to be processed.

[0076] In addition, the alarm event logs can be processed by fields and saved in string format to the alarm event database for use in subsequent alarm tracing.

[0077] This application embodiment converts alarm event logs into corresponding vectorized alarm features, thereby calculating the feature similarity distance with existing alarm log clusters. If there is a target alarm log cluster with a feature similarity distance less than a preset threshold, it is classified into that target alarm log cluster. This not only aggregates a large number of alarm event logs, but also effectively considers the contextual information in the directed alarm graph during the feature similarity distance calculation process. This greatly reduces the burden of operation and maintenance analysis and improves the processing efficiency of alarm event logs while ensuring that the alarm event type is not masked.

[0078] Based on the above embodiments, as a preferred embodiment, see [link to preferred embodiment]. Figure 3 , Figure 3 The flowchart below illustrates the generation process of a feature vectorization model provided in this application embodiment. The following describes an optional method for constructing a feature vectorization model provided in this application, the process of which includes:

[0079] S301: Obtain alarm log dataset;

[0080] S302: Construct the alarm process tree corresponding to each alarm log in the alarm log dataset;

[0081] This step aims to construct an alarm process tree. Since the alarm event log may contain process tree field information, this step aims to first determine the process tree field information in the alarm event log during execution, and then use the process tree field information as nodes to construct a directed graph-like alarm process tree based on the connection relationships between the nodes.

[0082] S303: Traverse each branch of the alarm process tree to obtain alarm characteristics;

[0083] This step aims to traverse the alarm process tree to obtain alarm features for model training. The specific method for obtaining alarm features from the alarm process tree is not limited here; one feasible approach is as follows:

[0084] The first step is to determine several branches, starting from the root node of the alarm process tree and ending at each end of the alarm process tree.

[0085] Starting from the root node of the process tree, traverse each branch of the process tree sequentially. Each branch starts from the root node of the alarm process tree and ends at the end of the alarm process tree. Each node in the alarm process tree contains a string of data of a certain number of characters.

[0086] Step 2: For each branch, let the branch contain M nodes, the step length of the concatenated string is 1, and determine the number of concatenations m of the nodes. In each branch, the starting node of the concatenation of the Nth concatenated string is N, and the string length is m, resulting in N concatenated strings; and N = M - m + 1.

[0087] Each branch contains several nodes, and the number of nodes may vary between branches. Each node contains corresponding string data. For each branch, consecutive nodes with a concatenation length of m are taken sequentially to obtain concatenated strings. The step difference between each concatenated string is 1. Therefore, the starting node for the Nth concatenation string is N, and the string length is m, resulting in N concatenated strings. For example, if a branch of the alarm process tree contains 5 nodes labeled 1-5, and the preset number is set to 3, then the first concatenated string consisting of nodes 1-2-3 can be obtained. The second concatenated string has a step of 1, starting from node 2, resulting in the second concatenated string consisting of nodes 2-3-4, and so on, resulting in the third concatenated string consisting of nodes 3-4-5.

[0088] Third step: For each concatenated string, use a sliding window to perform sliding segmentation starting from the first character of the concatenated string to obtain all the segmented strings contained in the concatenated string, and use the segmented strings as alarm features;

[0089] The N-gram model, also known as the N-gram model, deals with encoded data. It processes the character data within the encoded data using a sliding window to obtain various alarm features. Thus, each alarm feature can consist of a number of characters. For example, if the encoded data is 100 characters long and the sliding window length is 7 characters, processing this encoded data will yield 94 alarm features. Due to the fuzzy hashing process performed in the third step, the string length of each encoded data is the same, resulting in a consistent number of alarm features for each encoded data.

[0090] Furthermore, after performing the second step and before performing the third step, fuzzy hash encoding can be applied to the concatenated strings to obtain encoded data. Since the number of characters in each node may differ, fuzzy hash encoding can unify the character count of each concatenated string, facilitating the subsequent acquisition of alarm features with the same character count, thus simplifying model training. The string representation method used after encoding is not limited here; for example, base64 encoding can be used to transform each concatenated string into training data that is easy for model training.

[0091] It should also be noted that since different branches all start from the root node, they may contain the same concatenated strings. After processing all branches in the steps above, some duplicate alarm features can be obtained. In the subsequent training process, weights or parameters are assigned to the duplicate alarm features in the training set to indicate the repetition rate of the alarm feature, so that it can be identified and trained by the Graph2Vec algorithm, thereby improving the recognition accuracy and efficiency of the feature vectorization model.

[0092] S304: Using the alarm features as a training set, the Graph2Vec algorithm is used to train the model to obtain the feature vectorization model.

[0093] In this step, the Graph2Vec algorithm is an unsupervised algorithm used to train alarm features on string structures, resulting in a feature vectorization model that can convert alarm event logs into corresponding vectorized feature representations.

[0094] In other applications of this application, variations of the Graph2Vec algorithm or algorithms similar in principle to the Graph2Vec algorithm may also be used, and all of these should be within the scope of protection of this application.

[0095] This embodiment discloses the construction process of a feature vectorization model to convert alarm event logs into vectorized feature representations, thereby enabling the aggregation of alarm event logs and reducing the number of alarm event logs that users need to handle.

[0096] See Figure 4 , Figure 4 This application provides a schematic diagram of an alarm event processing system structure according to an embodiment of the present application. The present application also provides an alarm event processing system, including:

[0097] The log acquisition module is used to construct a directed graph of alarm events based on the alarm event logs.

[0098] The vectorization processing module is used to convert the directed alarm graph into vectorized alarm features;

[0099] The distance calculation module is used to calculate the feature similarity distance between the vectorized alarm features and the features of each alarm log cluster;

[0100] The alarm event processing module is used to add the alarm event log to the target alarm log cluster if there is a target alarm log cluster with a feature similarity distance of less than a preset threshold, so as to perform alarm aggregation on the directed alarm graph.

[0101] Based on the above embodiments, as a preferred embodiment, it further includes:

[0102] The feature vectorization model generation module is used to acquire an alarm log dataset; construct an alarm process tree corresponding to each alarm log in the alarm log dataset; traverse each branch of the alarm process tree to obtain alarm features; use the alarm features as a training set and use the Graph2Vec algorithm to train the model to obtain the feature vectorization model.

[0103] Based on the above embodiments, as a preferred embodiment, the log acquisition module includes:

[0104] A directed graph construction unit is used to determine the process tree field information in the alarm event log; and to construct an alarm process tree in the form of a directed graph based on the process tree field information as nodes and the connection relationship between the nodes.

[0105] Based on the above embodiments, as a preferred embodiment, the feature vectorization model generation module includes:

[0106] The feature output unit is used to determine several branches starting from the root node of the alarm process tree and ending at each end of the alarm process tree; wherein, the nodes in the alarm process tree contain string data of several characters; for each branch, assuming the branch contains M nodes, the step length of the concatenated string is 1, the number of concatenations m is determined, in each branch, the starting node of the Nth concatenated string is N, the string length is m, resulting in N concatenated strings; and N = M - m + 1; for each concatenated string, a sliding window is used to perform sliding segmentation starting from the first character of the concatenated string to obtain all the segmented strings contained in the concatenated string, and the segmented strings are used as alarm features.

[0107] Based on the above embodiments, as a preferred embodiment, it further includes:

[0108] The alarm log cluster processing module is used to generate alarm events corresponding to each alarm log cluster; when an alarm event is processed, all alarm event logs in the alarm log cluster are processed synchronously.

[0109] Based on the above embodiments, as a preferred embodiment, it further includes:

[0110] The alarm log storage module is used to process the fields of the alarm event log and save it to the alarm event database in string format.

[0111] The aforementioned alarm event handling system can be in the form of an image file. After execution, the image file can run as a container or virtual machine to implement the method described in this application. However, it is not limited to image files; any software implementation capable of the alarm event handling method described in this application is within the scope of protection of this application. For example, it could also be a software module implemented in a hypervisor (virtual machine monitor) in a cloud computing platform.

[0112] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed, can implement the steps of the methods provided in the above embodiments. The storage medium may include various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0113] This application also provides a terminal, which may include a memory and a processor. The memory stores a computer program, and when the processor calls the computer program in the memory, it can implement the steps of the method provided in the above embodiments. Of course, the terminal may also include various network interfaces, power supplies, and other components. Please see [link to application]. Figure 5 , Figure 5 This is a schematic diagram of the structure of a terminal provided in an embodiment of this application. The terminal in this embodiment may include: a processor 2101 and a memory 2102.

[0114] Optionally, the terminal may also include a communication interface 2103, an input unit 2104, a display 2105, and a communication bus 2106.

[0115] The processor 2101, memory 2102, communication interface 2103, input unit 2104, and display 2105 all communicate with each other through the communication bus 2106.

[0116] In this embodiment of the application, the processor 2101 may be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, an off-the-shelf programmable gate array, or other programmable logic devices.

[0117] The processor can call programs stored in memory 2102. Specifically, the processor can execute the operations performed by the terminal in the above embodiments.

[0118] The memory 2102 is used to store one or more programs, which may include program code, including computer operation instructions. In this embodiment, the memory stores at least a program for implementing the following functions:

[0119] Based on the alarm event log, construct the directed graph of the alarm event described by the alarm event log;

[0120] The alarm directed graph is converted into vectorized alarm features;

[0121] Calculate the similarity distance between the vectorized alarm features and the features of each alarm log cluster;

[0122] If there is a target alarm log cluster with a feature similarity distance less than a preset threshold, the alarm event log is added to the target alarm log cluster to perform alarm aggregation on the directed alarm graph.

[0123] In one possible implementation, the memory 2102 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and applications required for at least one function; and the data storage area may store data created during the use of the computer.

[0124] In addition, memory 2102 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device or other volatile solid-state storage device.

[0125] The communication interface 2103 can be an interface for a communication module, such as the interface for a GSM module.

[0126] This application may also include a display 2105 and an input unit 2104, etc.

[0127] Figure 5 The structure of the terminal shown does not constitute a limitation on the terminal in the embodiments of this application. In practical applications, the terminal may include more than [other components]. Figure 5 More or fewer components as shown, or combinations of certain components.

[0128] The terminal described in this application can be a single hardware device or a cluster of multiple hardware devices. A cloud computing platform is a business model that uses computing virtualization, network virtualization, and storage virtualization technologies to organize multiple independent physical hardware resources into a pooled resource. It is a software-defined resource structure based on virtualization technology, capable of providing resource capabilities in the form of virtual machines, containers, etc. By eliminating the fixed relationship between hardware and operating system, relying on network connectivity for unified resource scheduling, and then providing the necessary virtual resources and services.

[0129] Current cloud computing platforms support several service models:

[0130] SaaS (Software as a Service): Cloud computing platform users do not need to purchase software, but instead rent software deployed on the cloud computing platform. Users do not need to maintain the software, as the software service provider will manage and maintain the software in its entirety.

[0131] PaaS (Platform as a Service): Cloud computing platform users (usually software developers) can build new applications or extend existing applications on the architecture provided by the cloud computing platform without having to purchase development, quality control or production servers.

[0132] IaaS (Infrastructure as a Service): Cloud computing platforms provide data centers, infrastructure hardware and software resources via the Internet. Cloud computing platforms under the IaaS model can provide servers, operating systems, disk storage, databases and / or information resources.

[0133] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. As the system provided in the embodiments corresponds to the method provided in the embodiments, the description is relatively simple; relevant parts can be found in the method section.

[0134] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only for the purpose of helping to understand the method and core ideas of this application. It should be noted that those skilled in the art can make several improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of the claims of this application.

[0135] It should also be noted that, in this specification, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method for handling alarm events, characterized in that, include: Based on the alarm event log, construct the directed graph of the alarm event described by the alarm event log; The alarm directed graph is used to reflect the relationships between contexts in the alarm event log, and includes date, time, running event, event initiator, and process tree fields; The process tree field contains process details and the connection relationships between processes; The alarm directed graph is converted into vectorized alarm features; Calculate the similarity distance between the vectorized alarm features and the features of each alarm log cluster; If there is a target alarm log cluster with a feature similarity distance less than a preset threshold, the alarm event log is added to the target alarm log cluster to perform alarm aggregation on the directed alarm graph.

2. The alarm event handling method according to claim 1, characterized in that, The alarm directed graph is specifically an alarm process tree; Accordingly, converting the directed alarm graph into vectorized alarm features includes: The alarm directed graph is converted into vectorized alarm features using a feature vectorization model; Accordingly, before converting the directed alarm graph into vectorized alarm features, the process also includes: Obtain the alarm log dataset; Construct an alarm process tree corresponding to each alarm log in the alarm log dataset; Traverse each branch of the alarm process tree to obtain alarm characteristics; The alarm features are used as the training set, and the Graph2Vec algorithm is used to train the model to obtain the feature vectorization model. The alarm process tree corresponding to the alarm event log includes: Determine the process tree field information in the alarm event log; Using the process tree field information as nodes, a directed graph-like alarm process tree is constructed based on the connection relationships between the nodes. The alarm characteristics obtained by traversing each branch of the alarm process tree include: Several branches are determined with the root node of the alarm process tree as the starting point and each end of the alarm process tree as the ending point; wherein, the nodes in the alarm process tree contain string data of several characters. For each branch, let the branch contain M nodes, the step length of the concatenated string is 1, and the number of concatenations m is determined. In each branch, the starting node of the concatenation of the Nth concatenated string is N, the string length is m, and N concatenated strings are obtained; and N = M - m + 1. For each concatenated string, a sliding window is used to perform sliding segmentation starting from the first character of the concatenated string to obtain all the segmented strings contained in the concatenated string, and the segmented strings are used as alarm features.

3. The alarm event handling method according to claim 1, characterized in that, After adding the alarm event log to the target alarm log cluster to perform alarm aggregation on the directed alarm graph, the method further includes: An alarm event is generated corresponding to each alarm log cluster; when an alarm event is processed, all alarm event logs within the alarm log cluster are processed synchronously.

4. The alarm event handling method according to claim 1, characterized in that, If the feature similarity distance with each alarm log cluster is not less than a preset threshold, it also includes: Establish a new alarm log cluster corresponding to the directed alarm graph.

5. The alarm event handling method according to claim 1 or 4, characterized in that, Also includes: The alarm event logs are processed for fields and saved to the alarm event database in string format.

6. An alarm event handling system, characterized in that, include: The log acquisition module is used to construct a directed graph of alarm events based on the alarm event logs. The alarm directed graph is used to reflect the relationships between contexts in the alarm event log, and includes date, time, running event, event initiator, and process tree fields; The process tree field contains process details and the connection relationships between processes; The vectorization processing module is used to convert the directed alarm graph into vectorized alarm features; The distance calculation module is used to calculate the feature similarity distance between the vectorized alarm features and the features of each alarm log cluster; The alarm event processing module is used to add the alarm event log to the target alarm log cluster if there is a target alarm log cluster with a feature similarity distance of less than a preset threshold, so as to perform alarm aggregation on the directed alarm graph.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the alarm event handling method as described in any one of claims 1-5.

8. A terminal, characterized in that, The method includes a memory and a processor, wherein the memory stores a computer program, and the processor, when calling the computer program in the memory, implements the steps of the alarm event handling method as described in any one of claims 1-5.

Images