Alarm classification method and device, electronic equipment and storage medium

Abstract

The application provides an alarm classification method and device, electronic equipment and a storage medium. The method comprises: obtaining feature data of alarm information to be classified, and constructing a graph network corresponding to the alarm information to be classified based on the feature data; inputting the graph network into an alarm classification model to obtain an alarm classification result of the alarm information to be classified output by the alarm classification model. The scheme of the application can obtain an accurate alarm classification result.

Description

Technical Field

[0001] This application relates to big data technology, and in particular to an alarm classification method, device, electronic device and storage medium. Background Technology

[0002] With the advancement of technology and the advent of the big data era, a large amount of information is generated during the daily operation of the system, including log information, transaction information, and alarm information. Alarm information comes from many sources, and each alarm message is associated with different modules in the system.

[0003] In alarm handling, different severity levels of alarm information necessitate different processing methods. Obtaining accurate alarm classification results can effectively improve alarm processing efficiency. Currently, numerous alarm classification methods exist, but most focus on the alarm itself, failing to accurately represent the severity of the alarm information. Therefore, how to accurately classify alarm information has become an urgent problem to be solved. Summary of the Invention

[0004] This application provides an alarm classification method, apparatus, electronic device, and storage medium for accurately classifying alarm information.

[0005] In a first aspect, this application provides an alarm classification method, comprising: acquiring feature data of alarm information to be classified, and constructing a graph network corresponding to the alarm information to be classified based on the feature data; inputting the graph network corresponding to the alarm information to be classified into an alarm classification model, and obtaining the classification result of the alarm information to be classified output by the alarm classification model; wherein, the alarm classification model is a pre-trained graph convolutional network.

[0006] In one possible implementation, the method further includes: generating a sample library based on historical alarm information; the sample library includes historical alarm information and reference classification results of the historical alarm information, wherein the classification results of the alarm information characterize the urgency of the alarm information; dividing the sample library into multiple sub-sample libraries according to the reference classification results of the historical alarm information in the sample library, the multiple sub-sample libraries corresponding one-to-one with different urgency levels; constructing a graph network corresponding to each sub-sample library; establishing an initial alarm classification model based on the graph convolutional network; and training the initial alarm classification model based on the graph networks corresponding to the multiple sub-sample libraries respectively, until the alarm classification model is obtained.

[0007] In one possible implementation, the step of establishing a graph network corresponding to each sub-sample library includes: dividing each sub-sample library into multiple sample sets, and constructing a graph network corresponding to each sample set; the step of training the initial alarm classification model based on the graph networks corresponding to the multiple sub-sample libraries until the alarm classification model is obtained includes: for each sub-sample library, training the initial alarm classification model using a mini-batch iterative training method based on the graph networks corresponding to each sample set under the sub-sample library until the alarm classification model is obtained.

[0008] In one possible implementation, training the initial alarm classification model for each sub-sample library based on the graph network corresponding to each sample set under the sub-sample library includes: for each sub-sample library, inputting the graph network corresponding to each sample set under the sub-sample library into the current alarm classification model to obtain the first alarm classification result output by the model; calculating the similarity between the reference classification result corresponding to the sub-sample library to which the sample set belongs and the first alarm classification result, and adjusting the alarm classification model according to the current similarity until the current similarity meets the preset requirements, then determining that the training is complete.

[0009] In one possible implementation, generating a sample library based on historical alarm information includes: determining the feature values ​​of the historical alarm information under each feature type; calculating a weighted sum of the feature values ​​of the historical alarm information under each feature type according to the weights corresponding to each feature type to obtain the alarm severity value of the historical alarm information; and using the alarm severity value of the historical alarm information and the alarm severity value range corresponding to the classification result as a reference classification result for the historical alarm information.

[0010] In one possible implementation, the step of generating a sample library based on historical alarm information includes, beforehand, preprocessing the historical alarm information, wherein the preprocessing includes at least one of the following: data deduplication, data denoising, and data completion.

[0011] Secondly, this application provides an alarm classification device, comprising: an acquisition module for acquiring feature data of alarm information to be classified; a construction module for constructing a graph network corresponding to the alarm information to be classified based on the feature data; and a processing module for inputting the graph network corresponding to the alarm information to be classified into an alarm classification model to obtain the classification result of the alarm information to be classified output by the alarm classification model; wherein the alarm classification model is a pre-trained graph convolutional network.

[0012] In one possible implementation, the apparatus further includes: a sample generation module, configured to generate a sample library based on historical alarm information; the sample library includes historical alarm information and reference classification results of the historical alarm information, wherein the alarm classification results of the alarm information characterize the urgency of the alarm information; a partitioning module, configured to divide the sample library into multiple sub-sample libraries according to the reference classification results of the historical alarm information in the sample library, wherein the multiple sub-sample libraries correspond one-to-one with different urgency levels; the construction module is further configured to build a graph network corresponding to each sub-sample library; a building module, configured to build an initial alarm classification model based on a graph convolutional network; and a training module, configured to train the initial alarm classification model based on the graph networks corresponding to the multiple sub-sample libraries respectively, until the alarm classification model is obtained.

[0013] In one possible implementation, the construction module is further configured to: divide each subsample library into multiple sample sets, and construct a graph network corresponding to each sample set; the training module is specifically configured to: train the initial alarm classification model for each subsample library based on the graph network corresponding to each sample set under the subsample library using a mini-batch iterative training method until the alarm classification model is obtained.

[0014] In one possible implementation, the training module includes: a processing unit, configured to input the graph network corresponding to each sample set under each sub-sample library into the current alarm classification model to obtain a first alarm classification result output by the model; a first calculation unit, configured to calculate the similarity between the reference classification result corresponding to the sub-sample library to which the sample set belongs and the first alarm classification result; and a model adjustment unit, configured to adjust the alarm classification model according to the current similarity until the current similarity meets a preset requirement, at which point the training is considered complete.

[0015] In one possible implementation, the sample generation module includes: a determining unit, configured to determine the feature values ​​of the historical alarm information under each feature type; a second calculation unit, configured to perform a weighted summation calculation of the feature values ​​of the historical alarm information under each feature type according to the weights corresponding to each type of feature, to obtain the alarm severity value of the historical alarm information; and a matching unit, configured to use the classification result corresponding to the range of alarm severity values ​​of the historical alarm information as a reference classification result of the historical alarm information, based on the alarm severity value of the historical alarm information and the alarm severity value range corresponding to the classification result.

[0016] In one possible implementation, the device further includes a preprocessing module for preprocessing the historical alarm information, wherein the preprocessing includes at least one of the following: data deduplication, data denoising, and data completion.

[0017] Thirdly, this application provides an electronic device, including: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method described above.

[0018] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method described above.

[0019] The alarm classification method, apparatus, electronic device, and storage medium provided in this application acquire feature data of alarm information to be classified, and construct a graph network corresponding to the alarm information to be classified based on the feature data; the graph network corresponding to the alarm information to be classified is input into an alarm classification model to obtain the classification result of the alarm information to be classified output by the alarm classification model. The scheme of this application constructs a graph network based on feature data and obtains the classification result based on a graph convolutional network. The graph network can realistically and deeply reflect the relationship attributes between alarm information, thus obtaining more accurate classification results. It is well-suited for scenarios with complex relationship attributes of alarm information and effectively improves the processing efficiency of alarms. Attached Figure Description

[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0021] Figure 1 A flowchart illustrating the alarm classification method provided in Embodiment 1 of this application;

[0022] Figure 2 This is a flowchart illustrating the alarm classification method provided in Embodiment 2 of this application;

[0023] Figure 3 This is a schematic diagram of the graph convolutional neural network architecture provided in Embodiment 2 of this application;

[0024] Figure 4 A flowchart illustrating the alarm classification method provided in Embodiment 3 of this application;

[0025] Figure 5 This is a schematic diagram of the alarm classification device provided in Embodiment 4 of this application;

[0026] Figure 6This is a schematic diagram of the alarm classification device provided in Embodiment 5 of this application;

[0027] Figure 7 This is a schematic diagram of the structure of an electronic device provided in Embodiment Six of this application.

[0028] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0029] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0030] It should be noted that the brief descriptions of terms in this application are only for the convenience of understanding the embodiments described below, and are not intended to limit the embodiments of this application. Unless otherwise stated, these terms should be understood in their ordinary and common meaning.

[0031] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar or related objects or entities and do not necessarily imply a specific order or sequence, unless otherwise indicated. It should be understood that such terms can be used interchangeably where appropriate, for example, to implement the application in a sequence other than those given in the embodiments illustrated or described herein.

[0032] Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover but not exclude inclusion. For example, a product or device that includes a series of components is not necessarily limited to those explicitly listed, but may include other components not explicitly listed or inherent to such product or device. As used in this application, the term "module" means any known or subsequently developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code capable of performing the functions associated with that element.

[0033] In practical applications, the system generates a large amount of information during its daily operation, including log information, transaction information, and alarm information. Alarm information comes from numerous sources, and each alarm is associated with different modules within the system. During alarm processing, the severity of alarms varies, requiring different handling methods. Obtaining accurate alarm classification results can effectively improve alarm processing efficiency.

[0034] Currently, most alarm classification methods focus on the alarm itself, neglecting to explore the relationship between alarm information and characteristic information. As a result, alarm classification results cannot accurately represent the severity of alarm information. Taking the financial sector as an example, the relationships between alarm information are complex, and traditional alarm classification methods ignore these relationships, failing to obtain accurate alarm classification results.

[0035] The alarm classification method provided in this application constructs a graph network based on feature data and obtains the classification result based on a graph convolutional network. The graph network can truly and deeply reflect the relationship attributes between alarm information, thus obtaining more accurate classification results. It is well applicable to scenarios with complex relationship attributes of alarm information and effectively improves the processing efficiency of alarms.

[0036] The technical solutions of this application will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. In the description of this application, unless otherwise expressly specified and limited, the terms should be broadly understood within the art. The embodiments of this application will now be described with reference to the accompanying drawings.

[0037] Example 1

[0038] Figure 1 This is a flowchart illustrating the alarm classification method provided in Embodiment 1 of this application. The implementing entity of this embodiment can be an alarm classification device, such as... Figure 1 As shown, the method includes:

[0039] S101. Obtain the feature data of the alarm information to be classified, and construct the graph network corresponding to the alarm information to be classified based on the feature data.

[0040] The feature data for alarm information to be classified consists of feature values ​​corresponding to the features that characterize the cause and source of the alarm information. The features of alarm information to be classified must include at least: system name, module name, instance name, port number, anomaly indicator, current threshold, set threshold, first anomaly time, last anomaly time, and anomaly detection frequency.

[0041] In this embodiment, a Graph Network (GN) refers to a set of functions organized in a graph structure within a topological space for relational reasoning. A Graph Network consists of interconnected Graph Network Blocks, which are also called nodes in neural network implementations. Connections between nodes are called edges, representing dependencies between nodes. The internal state and system state of each node in a Graph Network are called attributes.

[0042] Specifically, a graph network corresponding to the alarm information to be classified is constructed based on feature data. For example, the system is used as a node in the graph network, each alarm information is used as an edge, and the direction represents the causal relationship of the alarm impact. Combining the features of the alarm information to be classified, the graph network corresponding to the alarm information to be classified is constructed.

[0043] S102. Input the graph network corresponding to the alarm information to be classified into the alarm classification model to obtain the classification result of the alarm information to be classified output by the alarm classification model.

[0044] The alarm classification model is a pre-trained graph convolutional neural network. A graph convolutional network (GCN) is a convolutional neural network that can directly operate on graphs and utilize their structural information.

[0045] In this embodiment, the classification results of the alarm information to be classified can be divided into: critical alarm, general alarm, and normal alarm. For example, a critical alarm refers to an alarm that will cause service interruption and requires immediate fault repair; a general alarm refers to an alarm that affects service and requires immediate fault repair; and a normal alarm refers to an alarm that does not affect existing service but may affect service and requires repair to avoid affecting service.

[0046] In practical applications, the graph network corresponding to the alarm information to be classified represents the feature data of the alarm information. The alarm classification model can obtain the classification result of the alarm information based on the graph network corresponding to the input alarm information. It can be understood that the feature data of alarm information corresponding to the same classification result are similar. Based on the alarm result to be classified, the cause and source of the alarm can be determined in a timely manner, which facilitates the timely and effective handling of alarms by operation and maintenance personnel.

[0047] In the alarm classification method provided in this embodiment, feature data of alarm information to be classified is obtained, and a graph network corresponding to the alarm information to be classified is constructed based on the feature data. The graph network corresponding to the alarm information to be classified is input into the alarm classification model to obtain the classification result of the alarm information to be classified output by the alarm classification model. In this embodiment, a graph network is constructed based on feature data and a classification result is obtained based on a graph convolutional network. The graph network can truly and deeply reflect the relationship attributes between alarm information, thus obtaining more accurate classification results. It is well applicable to scenarios with complex relationship attributes of alarm information and effectively improves the processing efficiency of alarms.

[0048] Example 2

[0049] Figure 2 This is a flowchart illustrating the alarm classification method provided in Embodiment 2 of this application, as shown below. Figure 2 As shown, the method also includes:

[0050] S201. Generate a sample library based on historical alarm information.

[0051] In this embodiment, the sample library includes historical alarm information and reference classification results of historical alarm information, wherein the classification results of alarm information characterize the urgency of the alarm information.

[0052] In practical applications, the reference classification results of historical alarm information are used to determine the accuracy of the classification results. When the classification result of historical alarm information matches the reference classification result, the classification of historical alarm information is accurate; when the classification result of historical alarm information does not match the reference classification result, the classification of historical alarm information is inaccurate. For example, the reference classification result of historical alarm information 1 is a general alarm, and the classification result of historical alarm information 1 is a general alarm, which matches the reference classification result, indicating that the classification result of historical alarm information 1 is accurate. The reference classification result of historical alarm information 2 is a general alarm, but the classification result of historical alarm information 2 is a critical alarm, which does not match the reference classification result, indicating that the classification result of historical alarm information 1 is inaccurate.

[0053] Regarding the generation of the sample library, in one possible implementation, S201 includes:

[0054] Determine the feature values ​​of historical alarm information under each feature type;

[0055] Based on the weights corresponding to each type of feature, the feature values ​​of the historical alarm information under each feature type are weighted and summed to obtain the alarm severity value of the historical alarm information.

[0056] Based on the alarm severity values ​​of historical alarm information and the alarm severity value range corresponding to the classification results, the classification results corresponding to the value range of the alarm severity values ​​of historical alarm information are used as the reference classification results for the historical alarm information.

[0057] For example, weights are assigned to each type of feature based on its impact on alarm information. For instance, the weights for system importance, alarm impact range, traffic volume, threshold anomaly magnitude, and alarm frequency are assigned as follows: 0.35, 0.20, 0.20, 0.15, and 0.10. Specifically, based on the weights corresponding to each feature type, the feature values ​​of the historical alarm information under each feature type are weighted and summed to obtain the alarm severity value of the historical alarm information. For example, the feature values ​​for system importance, alarm cause, alarm impact range, traffic volume, threshold anomaly magnitude, and alarm frequency are 6, 7, 10, 4, and 40%, respectively, with weights assigned as follows: 0.35, 0.20, 0.20, 0.15, and 0.10. Therefore, the alarm severity value of this historical alarm information is 6.14.

[0058] In practical applications, different classification results correspond to different alarm severity ranges. For example, the alarm severity range for a normal alarm is [0,3], for a general alarm it is (3,6], and for a severe alarm it is (6,10). Specifically, based on the alarm severity values ​​of historical alarm information and the alarm severity ranges corresponding to the classification results, the classification result corresponding to the range of alarm severity values ​​of the historical alarm information is used as the reference classification result for that historical alarm information. For example, if the alarm severity value of historical alarm information 1 is 6.14, and the classification result corresponding to the range of alarm severity values ​​of historical alarm information 1 is severe alarm, then the reference classification result for the historical alarm information is severe alarm.

[0059] In this embodiment, the alarm severity value of the historical alarm information is obtained by weighted summation of the feature values ​​of each feature type. Based on the alarm severity value and the corresponding alarm severity range of the classification result, the classification result corresponding to the range of alarm severity values ​​of the historical alarm information is used as the reference classification result for that historical alarm information. This embodiment determines the reference classification result based on the range of alarm severity values, providing a reference for the alarm classification results output during the alarm classification model training process.

[0060] In practical applications, to ensure a more accurate alarm classification model, the historical alarm information used to train the model can be preprocessed. For example, in one possible implementation, step S201 may include:

[0061] Historical alarm information is preprocessed, including at least one of the following: data deduplication, data noise reduction, and data completion.

[0062] Among them, data deduplication refers to removing duplicate but meaningless alarm information generated at the same time by the same device in the same system due to the same reason; data denoising refers to removing alarm information that lacks feature values; data completion refers to completing the feature values ​​of alarm information generated frequently by important systems with large business transaction volumes and a wide business impact, to ensure that no information is missing when analyzing important alarms and to guarantee the optimization of alarm information in the later stage.

[0063] In this embodiment, after obtaining historical alarm information, the alarm information is preprocessed to obtain standardized, unified, and highly usable historical alarm information. The preprocessed historical alarm information is then used to train the initial alarm classification model, which can yield a more accurate alarm classification model and thus obtain accurate alarm classification results.

[0064] S202. Based on the reference classification results of historical alarm information in the sample database, the sample database is divided into multiple sub-sample databases;

[0065] S203. Construct a graph network for each subsample library;

[0066] S204. Based on graph convolutional neural networks, establish an initial alarm classification model;

[0067] S205. Train the initial alarm classification model based on the graph networks corresponding to multiple sub-sample libraries until the alarm classification model is obtained.

[0068] Within this framework, multiple sub-sample libraries correspond one-to-one with different levels of urgency. For example, the sample libraries are divided into normal, general, and severe sub-sample libraries based on the reference classification results of historical alarm information.

[0069] It is understandable that the subsample library includes multiple historical alarm information, and a graph network corresponding to the alarm information to be classified is constructed based on the feature data of all historical alarm information in the subsample library.

[0070] Specifically, in S203, a graph network is constructed for each subsample library. For example, the sample libraries are divided into normal subsample libraries, general subsample libraries, and severe subsample libraries, and graph networks are constructed for the normal subsample library, the general subsample library, and the severe subsample library, respectively.

[0071] In practical applications, the reference classification results corresponding to each subsample library are consistent, and the alarm classification information in each subsample library is correlated. Therefore, training the initial alarm classification model based on graph networks corresponding to multiple subsample libraries can effectively improve the accuracy of the alarm classification model.

[0072] Specifically, in step S205, the initial alarm classification model is trained using graph networks corresponding to multiple sub-sample libraries until an alarm classification model is obtained. For example, the initial alarm classification model is trained using the graph network corresponding to the normal sub-sample library until the accuracy of the alarm classification results output by the current alarm classification model meets the requirements, thus obtaining the first alarm classification model. The first alarm classification model is trained using the graph network corresponding to the general sub-sample library until the accuracy of the alarm classification results output by the current alarm classification model meets the requirements, thus obtaining the second alarm classification model. The second alarm classification model is trained using the graph network corresponding to the severe sub-sample library until the accuracy of the alarm classification results output by the current alarm classification model meets the requirements, thus obtaining the alarm classification model.

[0073] Optionally, the initial alarm classification model can be trained iteratively based on the graph network corresponding to each subsample library until the alarm classification model is obtained.

[0074] To better understand graph convolutional neural networks, we need to combine... Figure 3 The graph convolutional neural network in this embodiment will be described. Figure 3 This is a schematic diagram of the graph convolutional neural network architecture provided in Embodiment 2 of this application.

[0075] like Figure 3 As shown, the graph convolutional neural network in this embodiment includes an input layer 300, a hidden layer 310, and an output layer 320. The input layer is a feature matrix composed of distinguishing features between different nodes in the graph network. The hidden layer 310 includes a graph convolutional function 311, a rectified linear unit (ReLU) function 312, and a dropout layer 313. The hidden layer 310 uses the rectified linear unit 312 to linearly separate the alarm information from the sample database information. Due to the large amount of alarm information data, a dropout layer 313 is introduced after the hidden layer 310 to prevent overfitting. The output layer 320 is responsible for transforming the abstract features learned by the model into predicted values.

[0076] In addition, in one possible implementation, S203 specifically includes: dividing each subsample library into multiple sample sets, and constructing a graph network corresponding to each sample set; S205 specifically includes: for each subsample library, training the initial alarm classification model using a small-batch iterative training method based on the graph network corresponding to each sample set under the subsample library, until the alarm classification model is obtained.

[0077] Mini-batch iterative training refers to further dividing the subsample library into multiple sample sets with smaller individual data volumes, and performing multiple iterations of training based on these sample sets. In practical applications, the historical alarm information in the subsample library is large in quantity and has many feature attributes, resulting in more complex graph network relationships. Training graph networks with complex relationships is more complex and requires more training time. Therefore, to save training time, mini-batch iterative training is adopted. For example, for each subsample library, it is further divided into N sample sets, and a corresponding graph network is generated based on each sample set, resulting in N graph networks. The alarm classification model is then trained based on each of the N graph networks. It should be noted that the model trained in each iteration is the current alarm classification model, i.e., the model obtained after the previous iteration.

[0078] In practical applications, using a small-batch iterative training method, which increases the number of training iterations, can effectively improve the accuracy of alarm classification models.

[0079] In this embodiment, when the number of historical alarm messages in the subsample library is large and the number of feature attributes is large, the training time is saved by using small-batch iteration, which improves the accuracy of the alarm classification model.

[0080] In one possible implementation, each sub-sample library is divided into multiple sample sets, and a graph network corresponding to each sample set is constructed, including:

[0081] Each subsample library is divided into a training set and a test set. The training set and the test set are further divided into multiple sample sets. For each sample set, a graph network is constructed.

[0082] For each sub-sample library, based on the graph network corresponding to each sample set within that sub-sample library, a mini-batch iterative training method is used to train the initial alarm classification model until the alarm classification model is obtained, including:

[0083] For each subsample library, the initial alarm classification model is trained using a mini-batch iterative training method based on the graph network corresponding to each sample set in the training set of the subsample library; the current alarm classification model is tested using a mini-batch iterative testing method based on the graph network corresponding to each sample set in the test set of the subsample library, until the alarm classification model is obtained.

[0084] Regarding the sample set training process, in one possible implementation, for each sub-sample library, the initial alarm classification model is trained based on the graph network corresponding to each sample set under the sub-sample library, including:

[0085] For each subsample library, the graph network corresponding to each sample set under that subsample library is input into the current alarm classification model to obtain the first alarm classification result output by the model;

[0086] Calculate the similarity between the reference classification result and the first alarm classification result corresponding to the subsample library to which the sample set belongs, and adjust the alarm classification model according to the current similarity until the current similarity meets the preset requirements, then the training is considered complete.

[0087] The similarity score represents the degree of correlation between the reference classification result of the subsample library to which the sample set belongs and the first alarm classification result. The greater the similarity score, the closer the correlation. For example, the similarity score can be the function value of the similarity function, and the value range of the similarity score is [0,1]. The similarity between objects a and b can be represented as sim(a,b). When sim(a,b) = 0, it means that a and b have no correlation. When sim(a,b) = 1, it means that a and b are equivalent.

[0088] Specifically, the similarity between the reference classification result of the sub-sample library to which the sample set belongs and the first alarm classification result is calculated. The alarm classification model is then adjusted based on the current similarity until the current similarity meets the preset requirement, at which point training is considered complete. For example, the preset requirement is a similarity greater than 0.75, and the current similarity is 0.8. The current similarity meets the preset requirement, and training is considered complete.

[0089] In this embodiment, the similarity between the reference classification result corresponding to the subsample library to which the sample set belongs and the first alarm classification result is calculated, and the training is dynamically determined based on whether the similarity meets the preset requirements.

[0090] In the alarm classification method provided in this embodiment, a sample library is generated based on historical alarm information; according to the reference classification results of historical alarm information in the sample library, the sample library is divided into multiple sub-sample libraries; a graph network corresponding to each sub-sample library is constructed; an initial alarm classification model is established based on a graph convolutional neural network; and the initial alarm classification model is trained based on the graph networks corresponding to the multiple sub-sample libraries until an alarm classification model is obtained. In this embodiment, an initial alarm classification model is established based on a graph convolutional neural network, and the initial alarm classification model is trained based on the graph networks corresponding to the multiple sub-sample libraries to obtain an alarm classification model. Applying the trained alarm classification model can yield accurate alarm classification results.

[0091] Example 3

[0092] Figure 4 This is a flowchart illustrating the alarm classification method provided in Embodiment 3 of this application, as shown below. Figure 4 As shown, the method includes:

[0093] S401. Generate a sample library based on historical alarm information;

[0094] S402. Based on the reference classification results of historical alarm information in the sample database, the sample database is divided into multiple sub-sample databases.

[0095] S403. Construct a graph network for each subsample library;

[0096] S404. Based on graph convolutional neural networks, establish an initial alarm classification model;

[0097] S405. Train the initial alarm classification model based on the graph networks corresponding to multiple sub-sample libraries until the alarm classification model is obtained.

[0098] S406. Obtain the feature data of the alarm information to be classified, and construct the graph network corresponding to the alarm information to be classified based on the feature data;

[0099] S407. Input the graph network corresponding to the alarm information to be classified into the alarm classification model to obtain the classification result of the alarm information to be classified output by the alarm classification model.

[0100] In the alarm classification method provided in this embodiment, a sample library is generated based on historical alarm information; according to the reference classification results of historical alarm information in the sample library, the sample library is divided into multiple sub-sample libraries; a graph network corresponding to each sub-sample library is constructed; an initial alarm classification model is established based on a graph convolutional neural network; the initial alarm classification model is trained based on the graph networks corresponding to the multiple sub-sample libraries until an alarm classification model is obtained. Feature data of the alarm information to be classified is obtained, and a graph network corresponding to the alarm information to be classified is constructed based on the feature data; the graph network corresponding to the alarm information to be classified is input into the alarm classification model to obtain the classification result of the alarm information to be classified output by the alarm classification model. In this embodiment, an initial alarm classification model is established based on a graph convolutional neural network, and the initial alarm classification model is trained based on the graph networks corresponding to the multiple sub-sample libraries to obtain an alarm classification model. Applying the trained alarm classification model can yield accurate alarm classification results.

[0101] Example 4

[0102] Figure 5 This is a schematic diagram of the alarm classification device provided in Embodiment 4 of this application, as shown below. Figure 5 As shown, the device includes:

[0103] The acquisition module 51 is used to acquire feature data of alarm information to be classified;

[0104] Module 52 is used to construct a graph network corresponding to the alarm information to be classified based on feature data.

[0105] The feature data for alarm information to be classified consists of feature values ​​corresponding to the features that characterize the cause and source of the alarm information. The features of alarm information to be classified must include at least: system name, module name, instance name, port number, anomaly indicator, current threshold, set threshold, first anomaly time, last anomaly time, and anomaly detection frequency.

[0106] In this embodiment, a Graph Network (GN) refers to a set of functions organized in a graph structure within a topological space for relational reasoning. A Graph Network consists of interconnected Graph Network Blocks, which are also called nodes in neural network implementations. Connections between nodes are called edges, representing dependencies between nodes. The internal state and system state of each node in a Graph Network are called attributes.

[0107] Specifically, a graph network corresponding to the alarm information to be classified is constructed based on feature data. For example, the system is used as a node in the graph network, each alarm information is used as an edge, and the direction represents the causal relationship of the alarm impact. Combining the features of the alarm information to be classified, the graph network corresponding to the alarm information to be classified is constructed.

[0108] The processing module 53 is used to input the graph network corresponding to the alarm information to be classified into the alarm classification model, and obtain the classification result of the alarm information to be classified output by the alarm classification model.

[0109] The alarm classification model is a pre-trained graph convolutional neural network. A graph convolutional network is a convolutional neural network that can directly operate on a graph and utilize its structural information.

[0110] In this embodiment, the classification results of the alarm information to be classified can be divided into: critical alarm, general alarm, and normal alarm. For example, a critical alarm refers to an alarm that will cause service interruption and requires immediate fault repair; a general alarm refers to an alarm that affects service and requires immediate fault repair; and a normal alarm refers to an alarm that does not affect existing service but may affect service and requires repair to avoid affecting service.

[0111] In practical applications, the graph network corresponding to the alarm information to be classified represents the feature data of the alarm information. The alarm classification model can obtain the classification result of the alarm information based on the graph network corresponding to the input alarm information. It can be understood that the feature data of alarm information corresponding to the same classification result are similar. Based on the alarm result to be classified, the cause and source of the alarm can be determined in a timely manner, which facilitates the timely and effective handling of alarms by operation and maintenance personnel.

[0112] In the alarm classification device provided in this embodiment, the acquisition module acquires feature data of the alarm information to be classified, and the construction module constructs a graph network corresponding to the alarm information to be classified based on the feature data. The processing module inputs the graph network corresponding to the alarm information to be classified into the alarm classification model to obtain the classification result of the alarm information to be classified output by the alarm classification model. In this embodiment, a graph network is constructed based on feature data and a classification result is obtained based on a graph convolutional network. The graph network can truly and deeply reflect the relationship attributes between alarm information, thus obtaining more accurate classification results. It is well-suited for scenarios with complex relationship attributes of alarm information and effectively improves the processing efficiency of alarms.

[0113] Example 5

[0114] Figure 6 This is a schematic diagram of the alarm classification device provided in Embodiment 5 of this application, as shown below. Figure 6 As shown, the device also includes:

[0115] The sample generation module 61 is used to generate a sample library based on historical alarm information.

[0116] In this embodiment, the sample library includes historical alarm information and reference classification results of historical alarm information, wherein the classification results of alarm information characterize the urgency of the alarm information.

[0117] In practical applications, the reference classification results of historical alarm information are used to determine whether the classification results of historical alarm information are accurate. When the classification results of historical alarm information are consistent with the reference classification results of historical alarm information, it indicates that the classification of historical alarms is accurate; when the classification results of historical alarm information are inconsistent with the reference classification results of historical alarm information, it indicates that the classification of historical alarms is inaccurate.

[0118] In one possible implementation, the sample generation module 61 includes:

[0119] The determination unit is used to determine the feature values ​​of historical alarm information under each feature type;

[0120] The second calculation unit is used to perform weighted summation calculation of the feature values ​​of the historical alarm information under each feature type according to the weights corresponding to each type of feature, so as to obtain the alarm severity value of the historical alarm information.

[0121] The matching unit is used to take the classification result corresponding to the range of alarm severity values ​​of historical alarm information as the reference classification result of the historical alarm information, based on the alarm severity values ​​of historical alarm information and the alarm severity value range corresponding to the classification result.

[0122] For example, weights are set for each type of feature based on its impact on alarm information. In practical applications, different classification results correspond to different ranges of alarm severity values.

[0123] In this embodiment, the alarm severity value of the historical alarm information is obtained by weighted summation of the feature values ​​of each feature type. Based on the alarm severity value and the corresponding alarm severity range of the classification result, the classification result corresponding to the range of alarm severity values ​​of the historical alarm information is used as the reference classification result for that historical alarm information. This embodiment determines the reference classification result based on the range of alarm severity values, providing a reference for the alarm classification results output during the alarm classification model training process.

[0124] In practical applications, to ensure a more accurate alarm classification model, historical alarm information can be preprocessed. For example, in one possible implementation, the device further includes:

[0125] The preprocessing module is used to preprocess historical alarm information. Preprocessing includes at least one of the following: data deduplication, data noise reduction, and data completion.

[0126] Among them, data deduplication refers to removing duplicate but meaningless alarm information generated at the same time by the same device in the same system due to the same reason; data denoising refers to removing alarm information that lacks feature values; data completion refers to completing the feature values ​​of alarm information generated frequently by important systems with large business transaction volumes and a wide business impact, to ensure that no information is missing when analyzing important alarms and to guarantee the optimization of alarm information in the later stage.

[0127] In this embodiment, after obtaining historical alarm information, the alarm information is preprocessed to obtain standardized, unified, and highly usable historical alarm information. The preprocessed historical alarm information is then used to train the initial alarm classification model, which can yield a more accurate alarm classification model and thus obtain accurate alarm classification results.

[0128] The partitioning module 62 is used to divide the sample library into multiple sub-sample libraries based on the reference classification results of historical alarm information in the sample library.

[0129] Within this framework, multiple sub-sample libraries correspond one-to-one with different levels of urgency. For example, the sample libraries are divided into normal, general, and severe sub-sample libraries based on the reference classification results of historical alarm information.

[0130] Module 52 is also used to build a graph network corresponding to each subsample library.

[0131] It is understandable that the subsample library includes multiple historical alarm information, and a graph network corresponding to the alarm information to be classified is constructed based on the feature data of all historical alarm information in the subsample library.

[0132] Module 63 is established to build an initial alarm classification model based on a graph convolutional neural network.

[0133] Training module 64 is used to train the initial alarm classification model based on the graph networks corresponding to multiple subsample libraries until the alarm classification model is obtained.

[0134] In practical applications, the reference classification results corresponding to each subsample library are consistent, and the alarm classification information in each subsample library is correlated. Therefore, training the initial alarm classification model based on graph networks corresponding to multiple subsample libraries can effectively improve the accuracy of the alarm classification model.

[0135] Optionally, the initial alarm classification model can be trained iteratively based on the graph network corresponding to each subsample library until the alarm classification model is obtained.

[0136] In one possible implementation, the construction module 52 is further configured to: divide each subsample library into multiple sample sets, and construct a graph network corresponding to each sample set; the training module 64 is specifically configured to: for each subsample library, based on the graph network corresponding to each sample set under the subsample library, train the initial alarm classification model using a small-batch iterative training method until the alarm classification model is obtained.

[0137] Mini-batch iterative training refers to further dividing the subsample library into multiple sample sets with smaller individual data volumes, and performing multiple iterations of training based on these sample sets. In practical applications, the historical alarm information in the subsample library is large in quantity and has many feature attributes, resulting in more complex graph network relationships. Training graph networks with complex relationships is more complex and requires more training time. Therefore, to save training time, mini-batch iterative training is adopted. For example, for each subsample library, it is further divided into N sample sets, and a corresponding graph network is generated based on each sample set, resulting in N graph networks. The alarm classification model is then trained based on each of the N graph networks. It should be noted that the model trained in each iteration is the current alarm classification model, i.e., the model obtained after the previous iteration.

[0138] In practical applications, using a small-batch iterative training method, which increases the number of training iterations, can effectively improve the accuracy of alarm classification models.

[0139] In this embodiment, when the number of historical alarm messages in the subsample library is large and the number of feature attributes is large, the training time is saved by using small-batch iteration, which improves the accuracy of the alarm classification model.

[0140] In one possible implementation, the construction module 52 is further configured to:

[0141] Each subsample library is divided into a training set and a test set. The training set and the test set are further divided into multiple sample sets. For each sample set, a graph network is constructed.

[0142] Training module 64 is specifically used for:

[0143] For each subsample library, the initial alarm classification model is trained using a mini-batch iterative training method based on the graph network corresponding to each sample set in the training set of the subsample library; the current alarm classification model is tested using a mini-batch iterative testing method based on the graph network corresponding to each sample set in the test set of the subsample library, until the alarm classification model is obtained.

[0144] In one possible implementation, the training module 64 includes:

[0145] The processing unit is used to input the graph network corresponding to each sample set under each sub-sample library into the current alarm classification model to obtain the first alarm classification result output by the model;

[0146] The first calculation unit is used to calculate the similarity between the reference classification result and the first alarm classification result corresponding to the subsample library to which the sample set belongs;

[0147] The model adjustment unit is used to adjust the alarm classification model according to the current similarity until the current similarity meets the preset requirements, at which point the training is considered complete.

[0148] The similarity score represents the degree of correlation between the reference classification result of the subsample library to which the sample set belongs and the first alarm classification result. The greater the similarity score, the closer the correlation.

[0149] In this embodiment, the similarity between the reference classification result corresponding to the sub-sample library to which the sample set belongs and the first alarm classification result is calculated, and the training is dynamically determined based on whether the similarity meets the preset requirements.

[0150] In the alarm classification device provided in this embodiment, the sample generation module generates a sample library based on historical alarm information; the partitioning module divides the sample library into multiple sub-sample libraries according to the reference classification results of historical alarm information in the sample library; the construction module constructs a graph network corresponding to each sub-sample library; the establishment module establishes an initial alarm classification model based on a graph convolutional neural network; and the training module trains the initial alarm classification model based on the graph networks corresponding to the multiple sub-sample libraries until an alarm classification model is obtained. In this embodiment, an initial alarm classification model is established based on a graph convolutional neural network, and the initial alarm classification model is trained based on the graph networks corresponding to the multiple sub-sample libraries to obtain an alarm classification model. Applying the trained alarm classification model yields accurate alarm classification results.

[0151] Example 6

[0152] Figure 7 This is a schematic diagram of the structure of an electronic device provided in Embodiment Six of this application, as shown below. Figure 7 As shown, the electronic device includes:

[0153] The electronic device includes a processor 71 and a memory 72; it may also include a communication interface 73 and a bus 74. The processor 71, memory 72, and communication interface 73 can communicate with each other via the bus 74. The communication interface 73 can be used for information transmission. The processor 71 can invoke logical instructions stored in the memory 72 to execute the methods described in the above embodiments.

[0154] Furthermore, the logic instructions in the aforementioned memory 72 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium.

[0155] The memory 72, as a computer-readable storage medium, can be used to store software programs and computer-executable programs, such as program instructions / modules corresponding to the methods in the embodiments of this application. The processor 71 executes functional applications and data processing by running the software programs, instructions, and modules stored in the memory 72, thereby implementing the methods in the above-described method embodiments.

[0156] The memory 72 may include a program storage area and a data storage area. The program storage area may store the operating system and application programs required for at least one function; the data storage area may store data created based on the use of the terminal device. Furthermore, the memory 72 may include high-speed random access memory and may also include non-volatile memory.

[0157] This application provides a non-transitory computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods described in the foregoing embodiments.

[0158] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0159] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. An alarm classification method, characterized in that, include: Obtain feature data of alarm information to be classified, wherein the feature data are feature values ​​corresponding to features that characterize the cause and source of alarm information to be classified; Based on the feature data, a graph network corresponding to the alarm information to be classified is constructed. In the graph network, nodes represent the system, edges represent alarm information, and directions represent the causal relationship of alarm impact. The graph network corresponding to the alarm information to be classified is input into the alarm classification model to obtain the classification result of the alarm information to be classified output by the alarm classification model; The pre-acquisition of the alarm classification model includes: A sample library is generated based on historical alarm information; the sample library includes historical alarm information and reference classification results of the historical alarm information, wherein the classification results of the alarm information characterize the urgency of the alarm information; Based on the reference classification results of the historical alarm information in the sample library, the sample library is divided into multiple sub-sample libraries, and the multiple sub-sample libraries correspond one-to-one with different levels of urgency; Each sub-sample library is divided into multiple sample sets, and a graph network corresponding to each sample set is constructed; based on the graph convolutional network, an initial alarm classification model is established. For each subsample library, the initial alarm classification model is trained using a mini-batch iterative training method based on the graph network corresponding to each sample set under the subsample library, until the alarm classification model is obtained.

2. The method according to claim 1, characterized in that, For each sub-sample library, the initial alarm classification model is trained based on the graph network corresponding to each sample set under the sub-sample library, including: For each subsample library, the graph network corresponding to each sample set under that subsample library is input into the current alarm classification model to obtain the first alarm classification result output by the model; Calculate the similarity between the reference classification result corresponding to the subsample library to which the sample set belongs and the first alarm classification result, and adjust the alarm classification model according to the current similarity until the current similarity meets the preset requirements, then determine that the training is complete.

3. The method according to claim 1, characterized in that, The process of generating a sample library based on historical alarm information includes: Determine the feature values ​​of the historical alarm information under each feature type; Based on the weights corresponding to each type of feature, the feature values ​​of the historical alarm information under each feature type are weighted and summed to obtain the alarm severity value of the historical alarm information. Based on the alarm severity value and the alarm severity value range corresponding to the classification result of the historical alarm information, the classification result corresponding to the value range of the alarm severity value of the historical alarm information is used as the reference classification result of the historical alarm information.

4. The method according to any one of claims 1-3, characterized in that, The process of generating a sample library based on historical alarm information includes, prior to: The historical alarm information is preprocessed, and the preprocessing includes at least one of the following: data deduplication, data noise reduction, and data completion.

5. An alarm classification device, characterized in that, include: The acquisition module is used to acquire feature data of alarm information to be classified, wherein the feature data is the feature value corresponding to the feature that characterizes the cause and source of the alarm information to be classified; The construction module is used to construct a graph network corresponding to the alarm information to be classified based on the feature data. In the graph network, nodes represent the system, edges represent alarm information, and directions represent the causal relationship of alarm impact. The processing module is used to input the graph network corresponding to the alarm information to be classified into the alarm classification model, and obtain the classification result of the alarm information to be classified output by the alarm classification model; wherein, the alarm classification model is a pre-trained graph convolutional network; The sample generation module is used to generate a sample library based on historical alarm information. The sample library includes historical alarm information and reference classification results of the historical alarm information, wherein the alarm classification result of the alarm information represents the urgency of the alarm information. The partitioning module is used to divide the sample library into multiple sub-sample libraries according to the reference classification results of the historical alarm information in the sample library. The multiple sub-sample libraries correspond one-to-one with different levels of urgency. The construction module is also used to divide each sub-sample library into multiple sample sets, and to construct a graph network corresponding to each sample set. A module is established to build an initial alarm classification model based on graph convolutional networks; The training module is used to train the initial alarm classification model for each sub-sample library, based on the graph network corresponding to each sample set under the sub-sample library, using a mini-batch iterative training method, until the alarm classification model is obtained.

6. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-4.

Images