Alarm processing method, device, apparatus and storage medium

Abstract

The application discloses an alarm processing method and device, equipment and a storage medium. In the application, an abnormality prediction model is pre-trained, so that the abnormality prediction model can output the number of abnormal logs generated in a certain time period, and the number is the number of false alarm identifiers. Thus, the abnormality prediction model is used to predict the number of abnormal logs that can be generated in a target time period. The obtained abnormality prediction number value is used as a judgment threshold for manual checking, and the number of abnormal logs monitored in the target time period is compared with the judgment threshold. Only when the number of abnormal logs monitored in the target time period is higher than the judgment threshold, an alarm information is generated. In this way, false alarms can be reduced, the workload of system maintenance personnel for checking alarms is reduced, and the work efficiency is improved.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and more specifically, to an alarm processing method, apparatus, device, and storage medium. Background Technology

[0002] With the development of modern technology, products with various functions are applied to all aspects of users' lives. During the operation of these products, logs are used to record their operational status. These logs are then analyzed by a corresponding monitoring system. When the number of abnormal logs output by the product reaches a certain threshold within a certain period of time, an alarm is triggered, and maintenance personnel perform maintenance on the product according to the alarm.

[0003] In reality, false alarms occur during product operation. For example, even if the number of exception logs reaches a certain threshold, maintenance personnel may not be required to maintain the product at this time.

[0004] Therefore, under the current alarm handling method, maintenance personnel need to spend extra time investigating false alarms, resulting in low work efficiency. Summary of the Invention

[0005] In view of the above problems, this application is made to provide an alarm processing method, apparatus, device, and storage medium to reduce false alarms and improve troubleshooting efficiency. The specific solution is as follows:

[0006] An alarm processing method, the method comprising:

[0007] Obtain the target time period;

[0008] Obtain the anomaly monitoring quantity value and the anomaly prediction quantity value corresponding to the target time period; the anomaly monitoring quantity value is the number of anomaly logs generated by the target device within the target time period; the anomaly prediction quantity value is the number of anomaly logs generated by the target device within the target time period.

[0009] The anomaly prediction quantity value is obtained by processing the target time period through an anomaly prediction model. The anomaly prediction model is trained based on training samples. The training samples include input samples and output samples. The input samples are historical time periods. The output samples are the number of anomaly logs generated by the target device within the historical time period and the output samples are the number of false alarms.

[0010] Compare the number of anomalies monitored for the target time period with the number of anomalies predicted.

[0011] If the number of detected anomalies is greater than or equal to the number of predicted anomalies, an alarm message is generated.

[0012] Optionally, the anomaly prediction model includes at least a first sub-model and a second sub-model;

[0013] The first sub-model corresponds to a time period of the first type, and the second sub-model corresponds to a time period of the second type. The first type and the second type are different.

[0014] Optionally, the first type is a time period type in which the number of abnormal logs generated by the target device matches the change period corresponding to the target device;

[0015] The second type is a time period type in which the number of abnormal logs generated by the target device matches the business volume corresponding to the target device.

[0016] Optionally, the formula for the first sub-model is:

[0017] ;

[0018] Where P is the period parameter, N is the fitting parameter, and a n Let b be the coefficient of the cosine function. n Let a be the coefficient of the sine function. n and b n The training was performed based on the training samples.

[0019] The formula for the second sub-model is:

[0020] ;

[0021] Where k is the growth rate. Let γ be the change quantity, a(t) be the number of times the mutation point changes before time t, m be the offset, and γ be represented in one form as... , among them Let j be the time corresponding to that point. For the change value of j at each time point, k, m, The training is performed based on the training samples; the sum of s(t) and g(t) is the number of abnormal logs generated by the target device at time t.

[0022] Optionally, the training samples are samples corresponding to the anomaly type, the anomaly prediction model is the model corresponding to the anomaly type, and the alarm information is the alarm information corresponding to the anomaly type.

[0023] Optionally, the training samples are obtained in the following way:

[0024] Obtain log data of the target device during operation, the log data including abnormal logs generated by components in the target device, the abnormal logs having time attributes;

[0025] The log data is statistically analyzed according to time attributes to obtain historical anomaly data; the historical anomaly data includes multiple historical time periods and the corresponding historical anomaly monitoring value for each historical time period; the historical anomaly monitoring value is the number of anomaly logs generated by the target device within the historical time period; the historical anomaly monitoring value has a true alarm indicator or a false alarm indicator.

[0026] The historical time period corresponding to the false alarm identifier is used as the input sample, and the abnormal historical monitoring value with the false alarm identifier is used as the output sample.

[0027] Optional, also includes:

[0028] Output the alarm information and the corresponding abnormal content.

[0029] Optionally, the minimum time difference between the training time period composed of the historical time periods and the target time period is less than or equal to a preset duration threshold.

[0030] An alarm processing device, comprising:

[0031] The time period acquisition unit is used to obtain the target time period;

[0032] The quantity value acquisition unit is used to obtain the anomaly monitoring quantity value and the anomaly prediction quantity value corresponding to the target time period; the anomaly monitoring quantity value is the number of anomaly logs generated by the target device within the target time period; the anomaly prediction quantity value is the number of anomaly logs generated by the target device within the target time period.

[0033] The anomaly prediction quantity value is obtained by processing the target time period through an anomaly prediction model. The anomaly prediction model is trained based on training samples. The training samples include input samples and output samples. The input samples are historical time periods. The output samples are the number of anomaly logs generated by the target device within the historical time period and the output samples are the number of false alarms.

[0034] The judgment unit is used to compare the abnormal monitoring quantity value corresponding to the target time period with the abnormal prediction quantity value;

[0035] An alarm information generation unit is used to generate alarm information if the abnormality monitoring quantity value is greater than or equal to the abnormality prediction quantity value.

[0036] An alarm processing device includes: a memory and a processor;

[0037] The memory is used to store programs;

[0038] The processor is used to execute the program to implement the various steps of the alarm processing method described above.

[0039] A storage medium having a computer program stored thereon, which, when executed by a processor, implements the various steps of the alarm processing method described above.

[0040] Using the above technical solution, the alarm processing method, apparatus, device, and storage medium provided in this application first obtain a target time period, and then obtain an anomaly monitoring quantity value, which represents the number of abnormal logs generated by the target device during the target time period, and an anomaly prediction quantity value, which represents the predicted number of abnormal logs generated by the target device during the target time period. The anomaly prediction quantity value is obtained by processing the target time period using an anomaly prediction model, which is trained based on training samples containing input and output samples. The input samples are historical time periods, and the output samples are the number of abnormal logs with false alarm indicators generated by the target device during the historical time periods. Then, the anomaly monitoring quantity value corresponding to the target time period is compared with the anomaly prediction quantity value. If the anomaly monitoring quantity value is greater than or equal to the anomaly prediction quantity value, an alarm message is generated. Therefore, the anomaly prediction model pre-trained in this application can output the number of abnormal logs generated within a certain time period, and this number includes those with false alarm indicators. Thus, the anomaly prediction model predicts the number of abnormal logs that may be generated within a target time period. The obtained anomaly prediction value is used as a judgment threshold for manual investigation and compared with the number of abnormal logs monitored within the target time period. Only when the number of abnormal logs monitored within the target time period is higher than the judgment threshold is an alarm message generated. This reduces false alarms, thereby reducing the alarm investigation workload of system maintenance personnel and improving work efficiency. Attached Figure Description

[0041] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0042] Figure 1 A flowchart illustrating an alarm processing method provided in an embodiment of this application;

[0043] Figure 2A flowchart illustrating the training sample acquisition method provided in this application embodiment;

[0044] Figure 3 A flowchart illustrating another alarm processing method provided in an embodiment of this application;

[0045] Figure 4 This is a schematic diagram of an alarm processing device provided in an embodiment of this application;

[0046] Figure 5 This is a schematic diagram of another alarm processing device provided in an embodiment of this application;

[0047] Figure 6 A schematic diagram of another alarm processing device provided in the embodiments of this application;

[0048] Figure 7 This is a schematic diagram of the alarm processing device provided in the embodiments of this application. Detailed Implementation

[0049] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0050] This application provides an alarm handling solution applicable to scenarios requiring device alarm processing. Because products generate false alarms during operation, maintenance personnel need to spend excessive time troubleshooting these false alarms, resulting in low work efficiency. Therefore, this application proposes the following alarm handling solution.

[0051] The proposed solution can be implemented using electronic devices with data processing capabilities, such as computer servers, cloud servers, etc.

[0052] Next, combined Figure 1 The alarm processing method of this application may include the following steps:

[0053] Step S101: Obtain the target time period.

[0054] Specifically, the target time period is the time period for which alarm judgment needs to be performed. For example, every 10 minutes from 0:00 to 24:00 on August 17th can be used as the target time period. Or, every 10 minutes of both August 17th and August 18th can be used as the target time period.

[0055] Step S102: Obtain the number of anomalies monitored and the number of anomalies predicted for the target time period.

[0056] Specifically, the anomaly detection quantity value is the monitored number of anomaly logs generated by the target device within the target time period. The anomaly prediction quantity value is the predicted number of anomaly logs generated by the target device within the target time period.

[0057] The anomaly prediction quantity value is obtained by processing the target time period through the anomaly prediction model. The anomaly prediction model is trained based on training samples, which include input samples and output samples. The input samples are historical time periods, and the output samples are the number of anomaly logs generated by the target device within the historical time period. The output samples are the number of monitoring values ​​with false alarm indicators.

[0058] It should be noted that the historical time period refers to the time period preceding the target time period. For example, relative to the 24 hours of August 17, the historical time period can include a continuous time period before August 17; similarly, relative to the 48 hours of August 17 and August 18, the historical time period can include any continuous time period before August 17.

[0059] In other words, this application first obtains training samples containing input and output samples. The input samples are historical time periods, and the output samples are the monitored number of abnormal logs generated by the target device within the historical time period, specifically the monitored number of logs with false alarm labels. Based on the training samples, a model is trained to obtain an anomaly prediction model. When a target time period is input, the anomaly prediction model can predict the predicted number of anomalies generated by the target device within that time period. This predicted number of anomalies is the number of logs with alarm labels that are false alarms.

[0060] It should be noted that the minimum time difference between the training period (composed of historical time periods) and the target period is less than or equal to the preset duration threshold. For example, if the target period is every 10 minutes of a 24-hour period from August 17, 2022, the preset duration threshold is 2 days, and the historical period is every 10 minutes of a 1-day period. To obtain the anomaly prediction count for August 17, 2022, since the preset duration threshold is 2 days, the period from June 13 to August 15, 2022, or from May 14 to August 16, 2022, can be used as the training period. Historical time periods and corresponding anomaly count monitoring values ​​can be selected from the training period as training samples to train the anomaly prediction model. However, training periods that do not include August 15 and August 16, 2022, cannot be used to select historical time periods. This makes the historical time period closer to the target time period, which means that the training samples used to train the anomaly prediction model are recent or up-to-date, resulting in a more accurate anomaly prediction model and a more accurate number of anomaly logs predicted by the anomaly prediction model.

[0061] Step S103: Compare the abnormal monitoring quantity value with the abnormal prediction quantity value corresponding to the target time period, that is, determine whether the abnormal monitoring quantity value is greater than or equal to the abnormal prediction quantity value. If the abnormal monitoring quantity value is greater than or equal to the abnormal prediction quantity value, proceed to step S104.

[0062] Specifically, this application compares the monitored number of abnormal logs generated by the target device within a target time period with the predicted number of abnormal logs generated by the target device within the target time period to determine whether to generate an alarm message. For example, if the monitored number of abnormal logs is greater than or equal to the predicted number of abnormal logs, it means that the target device generated more abnormal logs than the number of logs with false alarm indicators within the target time period. In this case, it can be determined that there is an abnormality that needs to be manually investigated, and step S104 is executed; if the monitored number of abnormal logs is less than the predicted number of abnormal logs, it means that the number of abnormal logs generated by the target device within the target time period has not reached the number of logs with false alarm indicators, and it can be determined that although there is an abnormality, no manual investigation is required.

[0063] Step S104: Generate alarm information.

[0064] Specifically, alarm information can include the type of anomaly, the time of the anomaly, etc., and is at least used to prompt manual investigation of the anomaly occurring in the target device.

[0065] It should be noted that in this embodiment, when it is determined in step S103 that the number of abnormal monitoring values ​​is less than the number of abnormal prediction values, the current process can be terminated, or the technical solution in this embodiment can be re-executed to determine whether an alarm is needed for the new target time period.

[0066] As can be seen from the above scheme, in the alarm processing method provided in Embodiment 1 of this application, by pre-training an anomaly prediction model, the anomaly prediction model can output the number of abnormal logs generated within a certain time period, and this number is the number with false alarm identifiers. Thus, the anomaly prediction model predicts the number of abnormal logs that may be generated within the target time period. The obtained anomaly prediction value is used as a judgment threshold for manual investigation and compared with the number of abnormal logs monitored within the target time period. Only when the number of abnormal logs monitored within the target time period is higher than the judgment threshold is an alarm message generated. This can reduce false alarms, thereby reducing the alarm investigation workload of system maintenance personnel and improving work efficiency.

[0067] In one implementation, the anomaly prediction model may include a first sub-model and a second sub-model.

[0068] The first sub-model corresponds to the first type of time period, and the second sub-model corresponds to the second type of time period. The first type and the second type are different.

[0069] Because the number of abnormal logs varies greatly depending on the time period, the embodiments provided in this application refine the composition of the anomaly prediction model based on different time periods, so that the anomaly prediction model obtained after training the anomaly prediction model with training samples is more accurate, thereby enabling the anomaly prediction model to output a more accurate number of anomaly predictions.

[0070] In practical implementation, the first type can be a time period type where the number of abnormal logs generated by the target device matches the corresponding change cycle of the target device. The first sub-model can then be understood as a model representing seasonality. For example, the first type can be a time period type with a cycle of one day, one week, one month, or one year. That is, the number of abnormal logs generated by the target device varies with a cycle of days, weeks, months, or years. Taking a weekly cycle as an example, from Monday to Friday, the number of abnormal logs generated by office equipment in the office area remains high, while from Saturday to Sunday, the number of abnormal logs generated by the target device remains low.

[0071] The second type can be a time period where the number of abnormal logs generated by the target device matches the corresponding business volume of the target device. This second sub-model can be understood as a model representing a trend. In other words, the second type can be a time period where the number of abnormal logs changes according to the growth of business volume. For example, from 9:00 AM to 6:00 PM, the number of abnormal logs generated by the social application's server is related to the data transmission volume of the social application; as the data transmission volume increases, the number of abnormal logs will increase.

[0072] Due to the different time periods, there will be significant differences in model training. Based on this, the embodiments provided in this application clarify the types corresponding to the first sub-model and the second sub-model, which can yield a more accurate anomaly prediction model, and thus the anomaly prediction quantity value will also be more accurate.

[0073] In specific implementation, the first sub-model is represented by the following formula (1):

[0074] (1)

[0075] Where P is the periodicity parameter, P=7 when the period is one week, and P=1 when the period is one day; N is the fitting parameter, N can be 3, the larger N is, the better the fitting of complex seasonality; a n b represents the coefficient of the cosine function. n a is the coefficient of the sine function; n and b n It is trained based on training samples.

[0076] It's important to note that the first sub-model can be understood as a seasonal term, representing the periodic trend of the time series, which can be divided into weekly and daily cycles. For example, there's a clear cyclical curve within a week, with higher traffic on weekdays and lower traffic on weekends. Similarly, there's a clear curve within a day, with peak traffic from 9 AM to 6 PM and troughs from 12 AM to 9 AM and 6 PM to 12 AM. The above formula approximates the periodic function represented by the sum of sine and cosine functions using a Fourier expansion. The seasonal term indicates the periodic changes in the time series; for example, when the period parameter P=7, we can see higher traffic on weekdays and lower traffic on weekends; when the period parameter P=1, we can see higher traffic from 9 AM to 6 PM and lower traffic at other times of the day.

[0077] The second sub-model is represented by the following formula (2):

[0078] (2)

[0079] Where k is the growth rate. When k>0, it indicates an upward growth trend. When k≤0, it indicates a downward growth trend. The larger the absolute value of k, the more obvious the trend change. γ is the change; a(t) is the number of times the mutation point changes before time t; m is the offset; one form of γ is... , among them Let j be the time corresponding to that point. For each time point j, the change value is k, m, The training is based on the training samples; the sum of s(t) and g(t) is the number of abnormal logs generated by the target device at time t.

[0080] It should be noted that the second sub-model can be understood as a trend term, which represents the non-periodic trend of the time series. For example, as business volume increases, the number of abnormal logs increases. The above formula is a piecewise linear function. The trend term represents the non-periodic trend of the time series; for example, as business volume increases, the number of anomalies increases.

[0081] In addition to the first sub-model representing the seasonal term and the second sub-model representing the trend term, the anomaly prediction model may also include a third sub-model representing the holiday effect and a fourth sub-model representing the residual term.

[0082] The third sub-model is represented by the following formula (3):

[0083] (3)

[0084] Where Z(t) is the indicator function; k is the scope of influence of holidays, and the list of holidays and the scope of influence of holidays can be customized.

[0085] It should be noted that the third sub-model represents the impact of holidays and important events on the number of anomaly predictions.

[0086] The fourth sub-model can be understood as the residue term, representing unpredictable random fluctuations, which can be used... express.

[0087] In the embodiments provided in this application, the anomaly prediction model is refined into four sub-models, with each time period type having a corresponding sub-model. When training with training samples, a more accurate anomaly prediction model can be obtained, thereby obtaining a more accurate anomaly prediction quantity value.

[0088] It should be noted that the anomaly training model contains at least the above-mentioned sub-models. After the anomaly prediction model is built and trained, it can be serialized into a format that can be called by other programs. For example, a pkl file can be generated using the pickle serialization tool.

[0089] In the specific implementation, the training samples are the samples corresponding to the anomaly type, and the anomaly prediction model is the model corresponding to the anomaly type. Accordingly, the alarm information obtained in this embodiment is the alarm information corresponding to the anomaly type. For example, when the target device is a mobile phone, the anomaly type may include overheating or overload during the phone's operation. The anomaly type can also be understood as an abnormal module, such as the phone's CPU overheating, the phone's camera overheating, or a certain software running overloaded.

[0090] In other words, multiple anomaly prediction models can be trained in this embodiment, and each anomaly prediction model can correspond to an anomaly type. Therefore, in this embodiment, the anomaly prediction model of the corresponding anomaly type can be called to perform alarm judgment of the corresponding anomaly type as needed.

[0091] For example, data from a MySQL table is read every morning, including historical and yesterday's data. This data is then categorized by anomaly type, and an anomaly prediction model is trained for each type, ultimately generating multiple files containing anomaly prediction models for various anomaly types. For instance, the sample data corresponding to the anomaly type "channel-wechat-server" is: 2022-02-14 11:00:00,102. The input to each anomaly prediction model is all sample data from the historical and yesterday's data; the more sample data, the better the model's training performance.

[0092] Therefore, in this embodiment of the application, by specifically defining the training samples, anomaly prediction model, and alarm information as corresponding to the anomaly type, the anomaly prediction model is more accurate during training, and the anomaly prediction quantity value obtained by the anomaly prediction model is also more accurate.

[0093] Some embodiments of this application provide an optional method for obtaining training samples, which will be discussed in conjunction with the following. Figure 2 The specific steps are as follows:

[0094] Step S201: Obtain log data of the target device during operation.

[0095] It should be noted that the log data includes exception logs generated by components in the target device, and these exception logs have a time attribute.

[0096] Specifically, the system logs of the target device are typically written to a local directory in text format. In this embodiment, a log collector can parse the log file according to a pre-configured parsing format to obtain log data in the corresponding log output format. For example, in the obtained log data, the field types are time format / text / number, and there are separators between columns. After obtaining the log data, the collected log data is then stored.

[0097] In practical use, Filebeat can be used to collect log files, which are then sent to the unified message queue middleware Kafka. When log data is needed, it can be read from Kafka and written to Elasticsearch for later use.

[0098] Step S202: Perform statistics on the log data according to the time attribute to obtain historical abnormal data.

[0099] It should be noted that historical anomaly data includes multiple historical time periods and corresponding historical anomaly monitoring values ​​for each historical time period; the historical anomaly monitoring values ​​are the number of anomaly logs generated by the target device within the historical time period; the historical anomaly monitoring values ​​have true alarm indicators or false alarm indicators.

[0100] Specifically, after obtaining the log data, feature extraction is performed on the log data. Features may include the anomaly type, historical time period, and the number of anomaly logs generated by the target device within that historical time period. For example, in this embodiment, after obtaining the log data, the log data can first be formatted, and then the number of anomaly logs in the log data can be counted according to the time attribute, generating a structured small dataset which is written to the first data table. For example, the number of anomaly logs can be counted in 10-minute sub-time periods. The first data table can be a MySQL data table. Historical anomaly data in the first data table is manually labeled. For true alarms, the historical data status bit is marked as 1; for false alarms, the historical data status bit is marked as 0. This allows the generation of historical anomaly monitoring values ​​with true alarm or false alarm labels.

[0101] In one alternative approach, abnormal historical monitoring values ​​with genuine alarm flags and their corresponding historical time periods can be deleted. In other words, the historical abnormal data of abnormal historical monitoring values ​​with genuine alarm flags can be cleaned up, and the remaining historical abnormal data only contains abnormal historical monitoring values ​​with false alarm flags and their corresponding historical time periods.

[0102] Step S203: Determine the input sample and the output sample.

[0103] Specifically, the historical time period corresponding to the false alarm identifier is used as the input sample, and the abnormal historical monitoring value with the false alarm identifier is used as the output sample.

[0104] It should be noted that the anomaly prediction model trained from these input and output samples is used to predict the number of anomaly logs generated by the target device within the target time period.

[0105] The embodiments provided in this application introduce the method of obtaining training samples, and clarify the method of obtaining input samples and output samples of training samples.

[0106] Some embodiments of this application, in conjunction with Figure 3 After generating the alarm information in step S104, the following steps are also included:

[0107] Step S105: Output alarm information and the corresponding abnormal content.

[0108] Specifically, alarm messages are used to prompt maintenance personnel to perform system maintenance. For example, alarm messages can be sent to maintenance personnel via SMS, email, WeChat, telephone, etc.

[0109] The alarm message can correspond to an anomaly generated by the target device. For example, the anomaly could be CPU overheating.

[0110] Considering that after generating alarm information, it is necessary to notify maintenance personnel for processing, based on this, in the embodiments provided in this application, after generating alarm information, the alarm information and the corresponding content of the alarm information are output to notify maintenance personnel for processing. At the same time, maintenance personnel can also clearly know the abnormal content generated by the target device and can process it more quickly.

[0111] As can be seen, the anomaly prediction model trained in this embodiment can predict the number of anomaly logs of the target device in each sub-time period within the target time period. For example, the anomaly prediction model can predict the anomaly type and number for a future period, and write the prediction results into the first data table (MySQL prediction table) for later use. For example, predicting the anomaly type and number every 10 minutes over the next two days as the value of false anomalies. The input to the anomaly prediction model is the nodes every 10 minutes over the two days, for example: 2022-02-14 11:10:00, 2022-02-14 11:20:00. Correspondingly, the output of the anomaly prediction model is the number of anomalies corresponding to each 10-minute node over the two days. For example: 2022-02-14 11:10:00, 200; 2022-02-14 11:20:00, 300. The number of anomalies here is the value of the predicted false anomalies. Based on this, after implementing the statistics of the current anomaly type and the number of anomalies monitored, the monitoring system implemented in this embodiment compares it with the corresponding predicted anomaly number recorded in the first data table above. When the real-time anomaly monitoring number is higher than the predicted anomaly number, it indicates that a real anomaly has occurred, and an alarm notification is immediately triggered, and the contents of the anomaly are explained in detail.

[0112] The alarm processing apparatus provided in the embodiments of this application is described below. The alarm processing apparatus described below can be referred to in correspondence with the alarm processing method described above.

[0113] See Figure 4 , Figure 4 This is a schematic diagram of an alarm processing device disclosed in an embodiment of this application. The device can be configured on a device with data processing capabilities.

[0114] like Figure 4 As shown, the device may include:

[0115] Time period acquisition unit 401 is used to obtain the target time period;

[0116] The quantity value acquisition unit 402 is used to obtain the abnormal monitoring quantity value and the abnormal prediction quantity value corresponding to the target time period; the abnormal monitoring quantity value is the number of abnormal logs generated by the target device within the target time period; the abnormal prediction quantity value is the number of abnormal logs generated by the target device within the target time period.

[0117] Among them, the anomaly prediction quantity value is obtained by processing the target time period through the anomaly prediction model. The anomaly prediction model is trained based on training samples. The training samples include input samples and output samples. The input samples are historical time periods, and the output samples are the number of anomaly logs generated by the target device within the historical time period. The output samples are the number of monitoring values ​​with false alarm indicators.

[0118] The judgment unit 403 is used to compare the abnormal monitoring quantity value corresponding to the target time period with the abnormal prediction quantity value. If the abnormal monitoring quantity value is greater than or equal to the abnormal prediction quantity value, the alarm information generation unit 404 is triggered.

[0119] Alarm information generation unit 404 is used to generate alarm information.

[0120] As can be seen from the above scheme, in the alarm processing device provided in Embodiment 2 of this application, by pre-training an anomaly prediction model, the anomaly prediction model can output the number of abnormal logs generated within a certain time period, and this number is the number with false alarm identifiers. Thus, the anomaly prediction model predicts the number of abnormal logs that may be generated within the target time period, and the obtained anomaly prediction value is used as a judgment threshold for manual investigation and compared with the number of abnormal logs monitored within the target time period. Only when the number of abnormal logs monitored within the target time period is higher than the judgment threshold is an alarm message generated. This can reduce false alarms, thereby reducing the alarm investigation workload of system maintenance personnel and improving work efficiency.

[0121] In one implementation, the anomaly prediction model includes at least a first sub-model and a second sub-model; wherein the first sub-model corresponds to a time period of a first type, and the second sub-model corresponds to a time period of a second type, and the first type and the second type are different.

[0122] In one implementation, the minimum time difference between the training time period (composed of historical time periods) and the target time period is less than or equal to a preset duration threshold.

[0123] In one implementation, the first type is a time period type where the number of abnormal logs generated by the target device matches the change cycle corresponding to the target device; the second type is a time period type where the number of abnormal logs generated by the target device matches the business volume corresponding to the target device.

[0124] In the preferred embodiment, the formula for the first sub-model is shown in formula (1). The formula for the second sub-model is shown in formula (2).

[0125] In one implementation, the training samples are samples corresponding to the anomaly type, the anomaly prediction model is the model corresponding to the anomaly type, and the alarm information is the alarm information corresponding to the anomaly type.

[0126] In one implementation, the apparatus in this embodiment may further include the following units, such as... Figure 5 As shown:

[0127] The sample acquisition unit 405 is used to: acquire log data of the target device during operation, the log data including abnormal logs generated by components in the target device, the abnormal logs having time attributes; perform statistics on the log data according to the time attributes to obtain historical abnormal data; the historical abnormal data includes multiple historical time periods and the corresponding historical abnormal monitoring values ​​for each historical time period; the historical abnormal monitoring values ​​are the number of abnormal logs generated by the target device within the historical time period; the historical abnormal monitoring values ​​have true alarm indicators or false alarm indicators; use the historical time periods in the historical abnormal data with false alarm indicators as input samples, and use the historical abnormal monitoring values ​​in the historical abnormal data with false alarm indicators as output samples.

[0128] In one implementation, such as Figure 6 The schematic diagram of the device shown includes:

[0129] The alarm information prompting unit 406 is used to output alarm information and the corresponding abnormal content.

[0130] In the embodiments provided in this application, after generating alarm information, the output alarm information and corresponding content allow maintenance personnel to clearly understand the abnormal content and process it more quickly.

[0131] The alarm processing device provided in this application embodiment can be applied to alarm processing equipment, such as electronic devices: mobile phones, computers, etc. Optionally, Figure 7 The hardware structure block diagram of the alarm processing device is shown below. Figure 7 The hardware structure of the alarm processing device may include: at least one processor 701, at least one communication interface 702, at least one memory 703 and at least one communication bus 704.

[0132] In this embodiment of the application, the number of processor 701, communication interface 702, memory 703 and communication bus 704 is at least one, and processor 701, communication interface 702 and memory 703 communicate with each other through communication bus 704.

[0133] The processor 701 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention.

[0134] The memory 703 may include high-speed RAM, and may also include non-volatile memory, such as at least one disk storage device;

[0135] The memory stores a program, which the processor can call. The program is used for:

[0136] Obtain the target time period;

[0137] Obtain the number of anomalies monitored and the number of anomalies predicted for the target time period; the number of anomalies monitored is the number of anomaly logs generated by the target device within the target time period; the number of anomalies predicted is the number of anomaly logs generated by the target device within the target time period.

[0138] Among them, the anomaly prediction quantity value is obtained by processing the target time period through the anomaly prediction model. The anomaly prediction model is trained based on training samples. The training samples include input samples and output samples. The input samples are historical time periods, and the output samples are the number of anomaly logs generated by the target device within the historical time period. The output samples are the number of monitoring values ​​with false alarm indicators.

[0139] Compare the number of anomalies monitored for the target time period with the number of anomalies predicted.

[0140] If the number of detected anomalies is greater than or equal to the number of predicted anomalies, an alarm message is generated.

[0141] Optionally, the refined and extended functions of the program can be found in the description above.

[0142] This application embodiment also provides a storage medium that can store a program suitable for execution by a processor, the program being used for:

[0143] Obtain the target time period;

[0144] Obtain the number of anomalies monitored and the number of anomalies predicted for the target time period; the number of anomalies monitored is the number of anomaly logs generated by the target device within the target time period; the number of anomalies predicted is the number of anomaly logs generated by the target device within the target time period.

[0145] Among them, the anomaly prediction quantity value is obtained by processing the target time period through the anomaly prediction model. The anomaly prediction model is trained based on training samples. The training samples include input samples and output samples. The input samples are historical time periods, and the output samples are the number of anomaly logs generated by the target device within the historical time period. The output samples are the number of monitoring values ​​with false alarm indicators.

[0146] Compare the number of anomalies monitored for the target time period with the number of anomalies predicted.

[0147] If the number of detected anomalies is greater than or equal to the number of predicted anomalies, an alarm message is generated.

[0148] Optionally, the refined and extended functions of the program can be found in the description above.

[0149] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0150] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. The various embodiments can be combined as needed, and the same or similar parts can be referred to each other.

[0151] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An alarm processing method characterized by, The method comprises: obtaining a target time period; obtaining an abnormal monitoring quantity value corresponding to the target time period and an abnormal prediction quantity value corresponding to the target time period; the abnormal monitoring quantity value is a quantity monitoring value of abnormal logs generated by a target device in the target time period; the abnormal prediction quantity value is a quantity prediction value of abnormal logs generated by the target device in the target time period; wherein the abnormal prediction quantity value is obtained by processing the target time period through an abnormal prediction model, the abnormal prediction model is obtained by training based on training samples, the training samples contain input samples and output samples, the input samples are historical time periods, and the output samples are quantity monitoring values of abnormal logs generated by the target device in the historical time periods, and the output samples are quantity monitoring values with false alarm identifiers; comparing the abnormal monitoring quantity value corresponding to the target time period with the abnormal prediction quantity value; if the abnormal monitoring quantity value is greater than or equal to the abnormal prediction quantity value, generating an alarm information; wherein the abnormal prediction model at least contains a first sub-model and a second sub-model; the first sub-model corresponds to a first type of time period, the second sub-model corresponds to a second type of time period, and the first type is different from the second type; the formula of the first sub-model is: wherein P is a period parameter, N is a fitting parameter, a n is a coefficient of a cosine function, b n is a coefficient of a sine function, a n and b n is obtained based on the training samples. the formula of the second sub-model is: g(t) = (k + a(t) T δ) t + (m + a(t) T γ); wherein k is a growth rate, δ is a change amount, a(t) is a number of changes of a mutation point at a time t, m is an offset, and γ is a parameter j = -s j δ j wherein s j is a time corresponding to the jth mutation point, δ j is a change value at the jth mutation point, and k, m, and δ are obtained by training based on the training sample; and a sum of s(t) and g(t) is a number of abnormal logs generated by the target device at the time t.

2. The method of claim 1, wherein, the first type is a time period type in which the quantity of abnormal logs generated by the target device matches a change period corresponding to the target device; the second type is a time period type in which the quantity of abnormal logs generated by the target device matches a traffic volume corresponding to the target device.

3. The method of claim 1, wherein, The training samples are samples corresponding to an abnormal type, the abnormal prediction model is a model corresponding to the abnormal type, and the alarm information is alarm information corresponding to the abnormal type.

4. The method of claim 1, wherein, The training samples are obtained by: obtaining log data of the target device in a running process, the log data containing abnormal logs generated by components in the target device, the abnormal logs having a time attribute; statistically processing the log data according to the time attribute to obtain historical abnormal data; the historical abnormal data contains a plurality of historical time periods and an abnormal historical monitoring value corresponding to each historical time period; the abnormal historical monitoring value is a quantity monitoring value of abnormal logs generated by the target device in the historical time period; the abnormal historical monitoring value has a true alarm identifier or a false alarm identifier; the historical time period corresponding to the false alarm identifier is taken as an input sample, and the abnormal historical monitoring value with the false alarm identifier is taken as an output sample.

5. The method of claim 1, wherein, Further comprising: outputting the alarm information and abnormal content corresponding to the alarm information.

6. The method of claim 1, wherein, The minimum time difference between the training time period composed of the historical time periods and the target time period is less than or equal to a preset time threshold.

7. An alarm processing apparatus characterized by comprising: comprising: a time period acquisition unit, configured to obtain a target time period; obtain an abnormal monitoring quantity value corresponding to the target time period and an abnormal prediction quantity value corresponding to the target time period; the abnormal monitoring quantity value is a quantity monitoring value of abnormal logs generated by the target device in the target time period; the abnormal prediction quantity value is a quantity prediction value of abnormal logs generated by the target device in the target time period; The abnormal prediction quantity value is obtained by processing the target time period by an abnormal prediction model, the abnormal prediction model is trained based on training samples, the training samples include input samples and output samples, the input samples are historical time periods, and the output samples are quantity monitoring values of abnormal logs generated by the target device in the historical time periods, and the output samples are quantity monitoring values with false alarm identifiers; The judging unit is configured to compare the abnormal monitoring quantity value corresponding to the target time period with the abnormal prediction quantity value; The alarm information generation unit is configured to generate alarm information if the abnormal monitoring quantity value is greater than or equal to the abnormal prediction quantity value. The abnormal prediction model includes at least a first sub-model and a second sub-model; the first sub-model corresponds to a first type of time period, the second sub-model corresponds to a second type of time period, and the first type is different from the second type; The formula of the first sub-model is: wherein P is a period parameter, N is a fitting parameter, a n is a coefficient of a cosine function, b n is a coefficient of a sine function, a n and b n is obtained based on the training samples. The formula of the second sub-model is: g(t) = (k + a(t) T δ) t + (m + a(t) T γ); Wherein, k is the growth rate, δ is the change, a(t) is the number of changes before the mutation point at t time, m is the offset, γ j = -s j δ j , wherein s j is the time corresponding to the jth mutation point, δ j is the change value at the jth mutation point, k, m, δ are obtained by training based on the training sample; the sum of s(t) and g(t) is the number of abnormal logs generated by the target device at t time.

8. An alarm processing device characterized by comprising: comprising: a memory and a processor; The memory is configured to store a program; The processor is configured to execute the program to implement each step of the alarm processing method according to any one of claims 1-6.

9. A storage medium having stored thereon a computer program, characterized in that The computer program is executed by the processor to implement each step of the alarm processing method according to any one of claims 1-6.

Images