An alarm analysis processing method, device, equipment and medium

Abstract

This disclosure relates to an alarm parsing and processing method, apparatus, device, and medium. The method includes: acquiring an original rule dataset in a target scenario; using each original rule dataset as a benchmark, calculating the similarity coefficient and Euclidean distance between the attribute values ​​of the benchmark original rule dataset and other original rule datasets for each attribute, determining multiple rule datasets to be merged for the same attribute with the same attribute value, and obtaining an attribute set consisting of the attribute to be merged and its corresponding attribute value; concatenating the attributes to be merged into a target attribute, concatenating the attribute values ​​in the attribute set into its attribute value, merging the attribute values ​​corresponding to attributes not in the attribute set in each rule dataset to be merged, obtaining a rule dataset; matching the acquired alarm data with each rule dataset in the rule dataset, and issuing corresponding alarm actions. This disclosure can reduce the amount of rule data and the system's memory usage, and improve parsing speed.

Description

Technical Field

[0001] This disclosure relates to the field of communication technology, and in particular to an alarm parsing and processing method, apparatus, device and medium. Background Technology

[0002] Existing network management systems contain a massive number and diverse range of devices. During device monitoring, a large number of alarms are generated when devices malfunction. These alarms can be broadly categorized into two types: low-level warning alarms that have no impact on the device, and high-level alarms that have a significant impact, even leading to device downtime. Therefore, timely acquisition, processing, and analysis of device alarms are crucial. To prevent high-level alarms from being overwritten by continuously reported lower-level alarms, timely detection and processing of alarms arising from device malfunctions has become an urgent problem to be solved in network management systems.

[0003] Currently, most alarm parsing methods adopt the following approach: divide the system into scenarios, set different types of rules for different scenarios, set corresponding rules in a certain scenario, configure the rules in the system, and use the configured rules to perform alarm parsing.

[0004] However, the above methods have the following problems: The existing network management system connects to a huge number of devices, and there are many types of network elements and manufacturers. When configuring rules, different rules need to be set for different manufacturers, different device types, and different scenarios, resulting in a massive number of rules. Traditional rule engines load all of these rules into memory upon startup and then analyze each reported alarm data one by one. Such a large amount of rules leads to huge system memory overhead, reduced analysis performance, and may even cause system memory overflow, resulting in system crashes and other failures. Summary of the Invention

[0005] This disclosure provides an alarm parsing method, apparatus, device, and medium that reduces the amount of rule data and system memory usage, and improves parsing speed.

[0006] According to a first aspect of the present disclosure, an alarm parsing and processing method is provided, the method comprising:

[0007] Obtain the original rule dataset for the target scenario. The original rule dataset includes multiple original rule data, and the original rule data consists of attribute values ​​corresponding to different attributes.

[0008] Each original rule data is used as a baseline in the traversal order, and the similarity coefficient and Euclidean distance between the attribute values ​​of the baseline original rule data and other original rule data are calculated for each attribute.

[0009] Based on the similarity coefficient and Euclidean distance, multiple rule data to be merged are identified in the original rule dataset that have the same attribute value for the same attribute. The attribute with the same attribute value is taken as the attribute to be merged, and an attribute set consisting of the attribute to be merged and the corresponding attribute value is obtained.

[0010] Each attribute to be merged in the attribute set is concatenated into a target attribute, and each attribute value in the attribute set is concatenated into the attribute value corresponding to the target attribute. The attribute values ​​corresponding to attributes that are not in the attribute set in each rule data to be merged are merged using an OR relationship to obtain the first rule data.

[0011] Based on the first rule data and the non-merging rule data in the original rule dataset, an updated rule dataset is obtained. The acquired alarm data is matched with each rule data in the rule dataset to determine the matched rule data and issue the corresponding alarm action.

[0012] According to a third aspect of the present disclosure, an alarm parsing and processing apparatus is provided, the apparatus comprising:

[0013] The acquisition module is used to acquire the original rule dataset under the target scenario. The original rule dataset includes multiple original rule data, and the original rule data consists of attribute values ​​corresponding to different attributes.

[0014] The calculation module is used to take each original rule data as a baseline according to the traversal order, and calculate the similarity coefficient and Euclidean distance between the attribute values ​​of the baseline original rule data and other original rule data for each attribute.

[0015] The acquisition module is used to determine, based on the similarity coefficient and Euclidean distance, multiple rule data to be merged in the original rule dataset that have the same attribute value for the same attribute, take the attribute with the same attribute value as the attribute to be merged, and obtain the attribute set consisting of the attribute to be merged and the corresponding attribute value;

[0016] The merging module is used to concatenate the attributes to be merged in the attribute set into a target attribute, concatenate the attribute values ​​in the attribute set into the attribute value corresponding to the target attribute, and merge the attribute values ​​corresponding to the attributes that are not in the attribute set in the rule data to be merged using an OR relationship to obtain the first rule data.

[0017] The matching module is used to obtain an updated rule dataset based on the first rule data and the non-to-be-merged rule data in the original rule dataset, match the acquired alarm data with each rule data in the rule dataset, determine the matched rule data, and issue the corresponding alarm action.

[0018] According to a third aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor executes the executable instructions to implement the steps of the alarm parsing and processing method described above.

[0019] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which computer instructions are stored, which, when executed by a processor, implement the steps of the alarm parsing and processing method described above.

[0020] The technical solutions provided by the embodiments of this disclosure have at least the following beneficial effects:

[0021] This disclosure obtains the original rule dataset for the target scenario; based on the similarity coefficient and Euclidean distance calculated for each attribute in any two original rule datasets, it obtains the attributes to be merged and their corresponding attribute values ​​in multiple original rule datasets, forming an attribute set; it merges the attribute set and multiple data sets to be merged to obtain the first rule data; based on the first rule data and the non-merging rule data, it obtains the rule dataset, and performs alarm parsing processing on the obtained alarm data and each rule data in the rule dataset. This disclosure reduces the amount of rule data and the system's memory usage, thereby improving the parsing speed. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this disclosure, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a schematic diagram illustrating an application scenario according to an exemplary embodiment;

[0024] Figure 2 This is a flowchart illustrating an alarm parsing and processing method according to an exemplary embodiment;

[0025] Figure 3 This is a schematic diagram illustrating an alarm parsing and processing system according to an exemplary embodiment;

[0026] Figure 4 This is a schematic diagram illustrating a raw rule dataset according to an exemplary embodiment;

[0027] Figure 5 This is a schematic diagram illustrating a method for obtaining a rule dataset according to an exemplary embodiment;

[0028] Figure 6This is a schematic diagram illustrating a raw rule dataset according to an exemplary embodiment;

[0029] Figure 7 This is a schematic diagram illustrating a rule dataset according to an exemplary embodiment;

[0030] Figure 8 This is a schematic diagram illustrating a rule dataset according to an exemplary embodiment;

[0031] Figure 9 This is a schematic diagram illustrating a raw rule dataset according to an exemplary embodiment;

[0032] Figure 10 This is a schematic diagram illustrating a rule dataset according to an exemplary embodiment;

[0033] Figure 11 This is a flowchart illustrating a rule data update method according to an exemplary embodiment;

[0034] Figure 12 This is a schematic diagram illustrating a first raw rule dataset according to an exemplary embodiment;

[0035] Figure 13 This is a schematic diagram of a module for an alarm data caching method according to an exemplary embodiment;

[0036] Figure 14 This is a schematic diagram illustrating a first rule dataset according to an exemplary embodiment;

[0037] Figure 15 This is a schematic diagram illustrating a first raw rule dataset according to an exemplary embodiment;

[0038] Figure 16 This is a schematic diagram illustrating a first rule dataset according to an exemplary embodiment;

[0039] Figure 17 This is a schematic diagram illustrating a first raw rule dataset according to an exemplary embodiment;

[0040] Figure 18 This is a schematic diagram illustrating a first rule dataset according to an exemplary embodiment;

[0041] Figure 19 This is a schematic diagram illustrating a first raw rule dataset according to an exemplary embodiment;

[0042] Figure 20 This is a schematic diagram illustrating a first rule dataset according to an exemplary embodiment;

[0043] Figure 21This is a schematic diagram illustrating a first raw rule dataset according to an exemplary embodiment;

[0044] Figure 22 This is a schematic diagram illustrating a first rule dataset according to an exemplary embodiment;

[0045] Figure 23 This is a schematic diagram of an alarm parsing processing apparatus according to an exemplary embodiment;

[0046] Figure 24 This is a schematic diagram of an electronic device illustrating an alarm parsing and processing method according to an exemplary embodiment;

[0047] Figure 25 This is a schematic diagram of a program product illustrating an alarm parsing and processing method according to an exemplary embodiment. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of this disclosure clearer, the disclosure will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of this disclosure.

[0049] The following are explanations of some of the words that appear in the text:

[0050] 1. In the embodiments of this disclosure, the term "and / or" describes the relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. The character " / " generally indicates that the preceding and following associated objects have an "or" relationship.

[0051] 2. The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein.

[0052] The application scenarios described in this disclosure are for the purpose of more clearly illustrating the technical solutions of this disclosure and do not constitute a limitation on the technical solutions provided in this disclosure. Those skilled in the art will understand that with the emergence of new application scenarios, the technical solutions provided in this disclosure are also applicable to similar technical problems. In the description of this disclosure, unless otherwise stated, "multiple" means two or more.

[0053] Currently, most alarm parsing solutions involve dividing the system into scenarios, setting different types of rules for different scenarios, configuring the rules within a specific scenario, and then using these rules for alarm parsing. However, with the large-scale development of 5G networks (5th Generation Mobile Networks), the number of devices connected to existing network management systems is enormous, and the types of network elements and manufacturers are diverse. When configuring rules, different rules need to be set for different manufacturers, device types, and scenarios, resulting in a massive number of rules. Traditional rule engines load all these rules into memory upon startup and then analyze each reported alarm data one by one. Such a large volume of rules leads to huge system memory overhead, reduced analysis performance, and may even cause system memory overflow and system crashes.

[0054] Therefore, in order to solve the above problems, this disclosure provides an alarm parsing and processing method, apparatus, device and medium to reduce the amount of rule data and the memory usage of the system, thereby improving the parsing speed.

[0055] First refer to Figure 1 This is a schematic diagram of an application scenario of an embodiment of the present disclosure, including a first data source 10, a second data source 11, and a server 12. The first data source 10 is used to collect alarm data, the second data source 11 is used to collect an original rule dataset including multiple original rule data in a target scenario, and the server 12 is used to merge the original rule dataset collected by the second data source 11 to obtain an updated rule dataset, and to perform alarm parsing based on the alarm data collected by the first data source 10 and the rule dataset.

[0056] In this embodiment, server 12 acquires an original rule dataset for a target scenario. The original rule dataset includes multiple original rule data entries, each consisting of attribute values ​​corresponding to different attributes. Following a traversal order, each original rule data entry is used as a baseline. For each attribute, the similarity coefficient and Euclidean distance between the baseline original rule data entry and other original rule data entries are calculated. Based on the similarity coefficient and Euclidean distance, multiple rule data entries in the original rule dataset with the same attribute value for the same attribute are identified as to be merged. Attributes with the same attribute value are identified as to be merged attributes, resulting in an attribute set consisting of the to-be-merged attribute and its corresponding attribute value. The to-be-merged attributes in the attribute set are concatenated into a target attribute, and the attribute values ​​in the attribute set are concatenated into the attribute value corresponding to the target attribute. Attribute values ​​corresponding to attributes outside the attribute set in the to-be-merged rule data are merged using an OR relationship to obtain first rule data. Based on the first rule data and the non-to-be-merged rule data in the original rule dataset, an updated rule dataset is obtained. The acquired alarm data is matched with each rule data entry in the rule dataset to determine the matched rule data, and a corresponding alarm action is issued.

[0057] In this disclosure, an alarm parsing and processing method is provided. Based on the same concept, this disclosure also provides an alarm parsing and processing apparatus, an electronic device, and a computer-readable storage medium.

[0058] In some embodiments, the alarm parsing and processing method provided in this disclosure is described below through specific examples, such as... Figure 2 As shown, it includes:

[0059] Step 201: Obtain the original rule dataset for the target scenario. The original rule dataset includes multiple original rule data, which are composed of attribute values ​​corresponding to different attributes.

[0060] The target scenarios mentioned above can include alarm dispatching scenarios, alarm supervision scenarios, etc. The attributes mentioned above can be set based on the target scenario. For example, in an alarm dispatching scenario, this attribute could be system name, specialty, device type, manufacturer, alarm level, alarm title, dispatching delay, etc. All original rule data contain the same attributes.

[0061] Step 202: Using each original rule data as a baseline according to the traversal order, calculate the similarity coefficient and Euclidean distance between the attribute values ​​of the baseline original rule data and other original rule data for each attribute.

[0062] The similarity coefficients mentioned above can be Jaccard similarity coefficients or other similarity coefficients. The Euclidean distance mentioned above can be obtained based on the similarity coefficients.

[0063] Step 203: Based on the similarity coefficient and Euclidean distance, determine multiple rule data to be merged in the original rule dataset that have the same attribute value for the same attribute. Take the attribute with the same attribute value as the attribute to be merged and obtain the attribute set consisting of the attribute to be merged and the corresponding attribute value.

[0064] The above-mentioned attributes to be merged can be one or more. The above-mentioned set of attributes can be one or more.

[0065] Step 204: Concatenate the attributes to be merged in the attribute set as a target attribute, concatenate the attribute values ​​in the attribute set as the attribute value corresponding to the target attribute, and merge the attribute values ​​corresponding to the attributes that are not in the attribute set in the rule data to be merged using an OR relationship to obtain the first rule data;

[0066] If the attribute set is one, then the first rule data is also one; if the attribute set is multiple, then the first rule data is also multiple.

[0067] Step 205: Based on the first rule data and the non-merging rule data in the original rule dataset, obtain the updated rule dataset. Match the acquired alarm data with each rule data in the rule dataset to determine the matched rule data and issue the corresponding alarm action.

[0068] The non-merging rule data in the original rule dataset also needs to be merged based on each attribute in the attribute set to obtain second rule data with the same format as the first rule data. Then, an updated rule dataset is obtained based on the first and second rule data. The process of matching the acquired alarm data with each rule data to determine the matched rule data and issuing the corresponding alarm action is existing technology and will not be elaborated here. In the alarm dispatch scenario, the above alarm action is a dispatch action.

[0069] This disclosure reduces the amount of rule data and system memory usage, thereby improving parsing speed.

[0070] This disclosure provides an alarm parsing and processing method, the specific process of which is as follows:

[0071] First, obtain the original rule dataset for the target scenario. The original rule dataset includes multiple original rule data, which are composed of attribute values ​​corresponding to different attributes.

[0072] like Figure 3 As shown, the merging module obtains the original rule dataset sent by the user, which contains multiple original rule data, and performs merging processing based on the original rule dataset. This reduces the data volume of business rules and the system's memory usage, improves parsing speed, and facilitates subsequent user maintenance. The original rule dataset can be in Excel spreadsheet format, such as... Figure 4 As shown, the original rule dataset includes 8 original rule data.

[0073] Secondly, each original rule data is used as a benchmark in the traversal order, and the similarity coefficient and Euclidean distance between the attribute values ​​of the benchmark original rule data and other original rule data are calculated for each attribute.

[0074] For example, as shown in Table 1, the original rule dataset contains four original rule data: rule A, rule B, rule C, and rule D. Using rule A as the baseline, the similarity coefficients and Euclidean distances between rule A and the attribute values ​​of rules B, C, and D are calculated for various attributes. These attributes include system name, specialty, alarm level, manufacturer, dispatch delay, alarm ID, and alarm title.

[0075] Table 1

[0076]

[0077]

[0078] The similarity coefficient d between the baseline original rule data and any other original rule data for the same attribute value can be calculated using the following formula:

[0079]

[0080] Where A is the attribute value corresponding to this attribute in the baseline original rule data, and B is the attribute value corresponding to this attribute in any other original rule data. A larger similarity coefficient indicates greater similarity between the two attribute values. When the similarity coefficient is 1, it means that A and B are the same.

[0081] For example, in Table 1, the similarity coefficient between Rule A and Rule B for the attribute value of "System Name" is 1; the similarity coefficient between Rule A and Rule B for the attribute value of "Alarm ID" is 0.5; and the similarity coefficient between Rule A and Rule B for the attribute value of "Alarm Title" is 0.

[0082] This disclosure uses an improved Euclidean distance as the basis for judging similarity. The original Euclidean distance is the distance between two points in the computation space. In order to control the similarity within the range of (0,1], the Euclidean distance W between the baseline original rule data and any other original rule data for the same attribute value is calculated using the following formula:

[0083]

[0084] Where d is the similarity coefficient between the baseline original rule data and the attribute value of any other original rule data for that attribute. The closer the similarity is to 0.5, the greater the similarity between the two rules.

[0085] For example, in Table 1, the Euclidean distance between the attribute values ​​of "System Name" for Rule A and Rule B is 0.5; the Euclidean distance between the attribute values ​​of "Alarm ID" for Rule A and Rule B is 2 / 3; and the Euclidean distance between the attribute values ​​of "Alarm Title" for Rule A and Rule B is 1.

[0086] Then, based on the similarity coefficient and Euclidean distance, multiple rule data to be merged in the original rule dataset with the same attribute value for the same attribute are identified. The attribute with the same attribute value is taken as the attribute to be merged, and an attribute set consisting of the attribute to be merged and the corresponding attribute value is obtained.

[0087] The specific process for this step is as follows:

[0088] For each benchmark original rule data, the attribute values ​​and similarity coefficients of other original rule data whose Euclidean distance is less than a set threshold are added to the candidate attribute feature set corresponding to that benchmark original rule data;

[0089] The threshold value can be 0.6 or other values ​​set according to the actual situation.

[0090] For example, as shown in Table 1, taking Rule A as the baseline, the Euclidean distance between Rule A and Rule B for the attribute value of "System Name" is 0.5; the Euclidean distance between Rule A and Rule B for the attribute value of "Specialty" is 0.5; the Euclidean distance between Rule A and Rule B for the attribute value of "Alarm Level" is 0.5; the Euclidean distance between Rule A and Rule B for the attribute value of "Manufacturer" is 0.5; the Euclidean distance between Rule A and Rule B for the attribute value of "Dispatch Delay" is 0.5; the Euclidean distance between Rule A and Rule B for the attribute value of "Alarm ID" is 2 / 3; and the Euclidean distance between Rule A and Rule B for the attribute value of "Alarm Title" is 1.

[0091] If the threshold is set to 0.6, the attribute values ​​and similarity coefficients corresponding to "System Name", "Specialty", "Alarm Level", "Manufacturer", "Dispatch Delay" and "Alarm ID" in Rule B are added to the candidate attribute feature set. Then, the above steps are repeated for Rule A with Rules C and Rule D respectively to obtain the candidate attribute feature set A corresponding to Rule A.

[0092] When using rule B as a benchmark, if rule B is determined to exist in the candidate attribute feature set A, then for each attribute, the similarity coefficient and Euclidean distance between the attribute values ​​of rule B and rule A need not be calculated, nor is it necessary to add the attribute values ​​and similarity coefficients of rule A with Euclidean distances less than a set threshold to the candidate attribute feature set B corresponding to rule B. If rule B is determined not to exist in the candidate attribute feature set A, then for each attribute, the similarity coefficient and Euclidean distance between the attribute values ​​of rule B and rule A are calculated, and the attribute values ​​and similarity coefficients of rule A with Euclidean distances less than a set threshold are added to the candidate attribute feature set B corresponding to rule B.

[0093] like Figure 5 As shown, if there are n original rule data in the original rule dataset, each original rule data is processed as a basis to obtain a corresponding set of n candidate attribute features. For example, processing original rule data 1 as a basis yields a corresponding set of candidate attribute features T1, and processing original rule data 2 as a basis yields a corresponding set of candidate attribute features T2.

[0094] For each set of candidate attribute features, based on the number of attributes in each original rule data in the set of candidate attribute features and the similarity coefficient corresponding to each attribute value, the average similarity coefficient corresponding to the original rule data is determined, and attribute values ​​with similarity coefficients less than the average similarity coefficient are deleted from the original rule data to obtain the set of attribute features corresponding to the set of candidate attribute features.

[0095] The average similarity coefficient D corresponding to any original rule data can be calculated using the following formula:

[0096]

[0097] Where m is the number of attributes in the original rule data in the candidate attribute feature set, and d i The similarity coefficient is the value of the i-th attribute of the original rule data in the set of candidate attribute features, where i ranges from [1, m].

[0098] For example, as shown in Table 1, if the candidate attribute feature set A corresponding to rule A includes the attribute values ​​and similarity coefficients corresponding to "system name," "specialty," "alarm level," "manufacturer," "dispatch delay," and "alarm ID" in rule B, the attribute values ​​and similarity coefficients corresponding to "system name," "alarm level," and "alarm ID" in rule C, and the attribute values ​​and similarity coefficients corresponding to "system name," "alarm level," "dispatch delay," and "alarm ID" in rule D, then the average similarity coefficient of rule B is (1+1+1+1+1+0.5) / 6 = 11 / 12. It is determined that the similarity coefficient corresponding to "alarm ID" in rule B is less than the average similarity coefficient, and therefore it is removed from the candidate attribute feature set A. The attribute values ​​and similarity coefficients of rules C and D in the candidate attribute feature set A are processed in the same way to obtain the attribute feature set A.

[0099] like Figure 5 As shown, for each original rule data in each candidate attribute feature set, attribute values ​​with similarity coefficients lower than the average similarity coefficient are deleted to obtain the attribute feature set corresponding to the candidate attribute feature set. For example, the candidate attribute feature set T1 is processed to obtain the corresponding attribute feature set H1, and the candidate attribute feature set T2 is processed to obtain the corresponding attribute feature set H2.

[0100] The intersection of the attribute values ​​corresponding to each attribute in each attribute feature set is taken as the attribute set, and multiple original rule data in the original rule dataset are determined as each rule data to be merged.

[0101] The intersection of the attribute values ​​corresponding to each attribute in the above attribute feature sets represents the occurrence of that attribute value in each original rule data. For example... Figure 4 As shown, the attribute values ​​corresponding to "System Name", "Specialty", "Equipment Type", "Manufacturer", "Alarm Level" and "Dispatch Target" appear in each of the original rule data. These 8 original rule data are all rule data to be merged.

[0102] In addition to the above situations, the following situations also exist:

[0103] If there is no intersection between the attribute values ​​corresponding to each attribute in each attribute feature set, then the intersection between the attribute values ​​corresponding to each attribute in multiple attribute feature sets in each attribute feature set is taken as the attribute set, and the corresponding multiple rules data to be merged are determined.

[0104] The intersection of the attribute values ​​corresponding to each attribute in the above multiple attribute feature sets indicates that the attribute value corresponding to that attribute appears in multiple original rule data. For example... Figure 6As shown, one attribute value corresponding to the attributes "System Name", "Specialty", "Equipment Type", "Manufacturer", "Alarm Level", and "Dispatch Target" appears in the first 7 original rule data entries; these 7 original rule data entries are all rule data to be merged. Another attribute value corresponding to the attributes "System Name", "Specialty", "Equipment Type", "Manufacturer", "Alarm Level", and "Dispatch Target" appears in the 8th and 9th original rule data entries; these 2 original rule data entries are both rule data to be merged.

[0105] Next, the attributes to be merged in the attribute set are concatenated into a target attribute, the attribute values ​​in the attribute set are concatenated into the attribute value corresponding to the target attribute, and the attribute values ​​corresponding to the attributes that are not in the attribute set in the rule data to be merged are merged using an OR relationship to obtain the first rule data;

[0106] If it is determined that all original rule data in the original rule dataset are rule data to be merged, then all original rule data in the original rule dataset will be merged. For example, if the original rule dataset is as follows: Figure 4 As shown, these 8 original rule data entries are all rule data to be merged. The attributes "System Name", "Specialty", "Equipment Type", "Manufacturer", "Alarm Level", and "Dispatch Target" are concatenated to form the target attribute. The attribute values ​​in the attribute set are then concatenated to obtain "MAPP-Virtualization-5G Message-MBC-Manufacturer A-Level Alarm-Send to Group A" as the attribute value corresponding to the target attribute. The attribute values ​​corresponding to "Alarm Title", "Alarm ID", and "Dispatch Delay" in the 8 rule data to be merged are then merged using OR relationships, resulting in the following: Figure 7 The first rule data shown is shown.

[0107] If multiple rules to be merged are identified in the original rule dataset, then these multiple rules will be merged. For example, if the original rule dataset is as follows: Figure 6 As shown, there are two attribute sets. For the first attribute set, the original rule data of rules 1-7 are the rule data to be merged. The attributes "System Name", "Specialty", "Equipment Type", "Manufacturer", "Alarm Level", and "Dispatch Target" are concatenated to form the target attribute. The attribute values ​​in the attribute set are concatenated to obtain "MAPP-Virtualization-5G Message-MBC-Manufacturer A-Level Alarm-Send to Group A" as the attribute value corresponding to the target attribute. The attribute values ​​corresponding to "Alarm Title", "Alarm ID", and "Dispatch Delay" in the 7 rule data to be merged are merged using OR relationships, resulting in the following: Figure 8 The first rule data shown is shown.

[0108] For the second attribute set, the original rule data in entries 8-9 is the rule data to be merged. The attributes "System Name," "Specialty," "Equipment Type," "Manufacturer," "Alarm Level," and "Dispatch Target" are concatenated as the target attribute. The attribute values ​​in the attribute set are concatenated to obtain "MAQQ-Virtualization-Regional Network Halo-MAC-Manufacturer B-Level 3 Alarm-Send to Group A and Group B" as the attribute value corresponding to the target attribute. The attribute values ​​corresponding to "Alarm Title," "Alarm ID," and "Dispatch Delay" in the two rule data to be merged are merged using OR relationships, resulting in the following: Figure 8 The second rule data shown.

[0109] Finally, based on the first rule data and the non-merging rule data in the original rule dataset, an updated rule dataset is obtained. The acquired alarm data is matched with each rule data in the rule dataset to determine the matched rule data and issue the corresponding alarm action.

[0110] like Figure 3 As shown, after obtaining the rule dataset, the merging module sends the rule dataset to the alarm parsing module. The alarm parsing module receives the alarm data sent by the data source and matches it with the rule data in the obtained rule dataset to determine the matched rule data and issue the corresponding alarm action. For example, it may dispatch an order based on the matched rule data and display it to the user.

[0111] The updated rule dataset, obtained from the first rule data and the non-merging rule data in the original rule dataset, includes:

[0112] For each attribute in the attribute set, the corresponding attribute values ​​in each non-mergeable rule data in the original rule dataset are concatenated to obtain the attribute value corresponding to the target attribute of the non-mergeable rule data. Based on the attribute values ​​corresponding to the attributes in the non-attribute set, the second rule data is obtained.

[0113] Based on the first rule data and the second rule data, an updated rule dataset is obtained.

[0114] For example, if multiple rules to be merged are identified in the original rule dataset, then these multiple rules to be merged are merged. For example, if the original rule dataset is as follows... Figure 9 As shown, there is an attribute set. The original rule data from rules 1 to 7 are the rule data to be merged. The seven rules to be merged are merged using the method described above, resulting in the following: Figure 10The first rule in the rule dataset shown. The eighth original rule is a non-merging rule. The attribute values ​​corresponding to each attribute in the attribute set are concatenated in this non-merging rule to obtain "MAQQ-Virtualization-Regional Network Cloud-MAC-Manufacturer B-Level 3 Alarm-Send to Group A and Group B" as the attribute value corresponding to the target attribute. Based on the attribute values ​​corresponding to each attribute in the non-attribute set, the following is obtained: Figure 10 The second rule in the rule dataset shown.

[0115] With the large-scale development of 5G networks, more and more manufacturers' equipment is being connected to the network, resulting in a large amount of rule data in any scenario of the existing network management system. The number of rules for a single scenario in some systems can even reach more than 30,000, which makes the workload and maintenance costs of the rules relatively large.

[0116] To address the aforementioned issues, this disclosure provides a method for updating rule data, such as... Figure 11 As shown, it includes:

[0117] Step 111: In response to the rule update instruction, obtain the first original rule dataset in the rule update instruction. The first original rule dataset includes multiple first original rule data, and the first original rule data consists of attribute values ​​corresponding to different attributes.

[0118] When rule data is updated or added, a rule update command is triggered. When rule data is deleted, the entire rule dataset needs to be deleted, and a new rule dataset needs to be obtained based on the original rule data.

[0119] The attributes in the first set of original rule data are the same as those in the original rule data. For example... Figure 4 As shown, it is the original rule dataset, such as Figure 12 As shown, the first original rule dataset includes four first original rule data.

[0120] The existing network management system receives over 100 alarm reports per second. When enabling rules, the system encounters a problem where alarms within a certain timeframe (from the start of rule loading to rule activation) cannot be parsed. This problem becomes even more pronounced when the number of rules and the volume of alarm reports per second are large. This results in a large amount of rule data in the network management system, significant memory consumption, and latency issues during alarm parsing, causing a backlog of subsequent alarms and hindering real-time processing.

[0121] Therefore, in order to solve the problem of mismatched alarm data during the time window between rule activation and rule effectiveness, and to avoid affecting subsequent business dispatching functions based on alarm discovery time, thus achieving zero-delay alarm matching, this disclosure proposes an alarm data caching method, which performs the following operations in response to a rule update command:

[0122] If a rule update is detected, the update information will be broadcast.

[0123] The information will be updated according to the rules, and the first alarm data obtained from the data source will be stored in the sequential cache queue.

[0124] like Figure 13 As shown, when rule data is updated, the merging module uses Kafka's (a subscription method) broadcast mechanism to broadcast the rule update start information. The logic processing center in the business delay handling module is a switch system, which is off by default. Upon receiving the rule update start information, the switch opens, storing the first alarm data sent from the data source in a sequential cache queue to ensure no alarm data is lost within the rule data update time window. After the rule data takes effect, the alarm data in the sequential cache queue is sent to the alarm parsing module for matching. Upon receiving the rule update start information, the alarm parsing module cuts off the first alarm data sent from the data source.

[0125] Step 112: Using each first original rule data as a baseline according to the traversal order, calculate the similarity coefficient and Euclidean distance between the attribute values ​​of the first baseline original rule data and other first original rule data for each attribute.

[0126] The specific process of this step has been described above and will not be repeated here.

[0127] Step 113: Based on the similarity coefficient and Euclidean distance, determine multiple first rule data to be merged in the first original rule dataset that have the same attribute value for the same attribute, take the attribute with the same attribute value as the first attribute to be merged, and obtain the first attribute set consisting of the first attribute to be merged and the corresponding attribute value.

[0128] The specific process of the above steps is as follows:

[0129] For each first benchmark original rule data, the attribute values ​​and similarity coefficients of other first original rule data whose Euclidean distance is less than a set threshold are added to the first candidate attribute feature set corresponding to that first benchmark original rule data.

[0130] For each first candidate attribute feature set, based on the number of attributes and the similarity coefficients corresponding to each attribute value of each first original rule data in the first candidate feature set, the average similarity coefficient corresponding to the first original rule data is determined, and attribute values ​​with similarity coefficients less than the average similarity coefficient are deleted from the first original rule data to obtain the first attribute feature set corresponding to the first candidate attribute feature set.

[0131] The intersection of the attribute values ​​corresponding to each attribute in each first attribute feature set is taken as the first attribute set, and multiple first original rule data in the first original rule dataset are determined as each first rule data to be merged.

[0132] In addition to the above situations, the following situations also exist:

[0133] If there is no intersection between the attribute values ​​corresponding to each attribute in each first attribute feature set, then the intersection of the attribute values ​​corresponding to each attribute in multiple first attribute feature sets in each first attribute feature set is taken as the first attribute set, and the corresponding multiple first rules to be merged are determined.

[0134] The detailed descriptions of the above steps have been described above and will not be repeated here.

[0135] Step 114: Based on the attribute set and the first attribute set, merge the rule dataset and multiple first rule data to be merged to obtain the third rule data;

[0136] In the first case, if the attribute set is the same as the first attribute set, the attribute values ​​corresponding to the attributes that are not in the first attribute set in the multiple first rule data to be merged are merged with the attribute values ​​corresponding to the attribute in the rule dataset using an OR relationship to obtain the third rule data.

[0137] like Figure 7 As shown, this is a rule dataset. During the merging of the original rule data in the original rule dataset, the attribute set is saved. For example... Figure 12 As shown, the first original rule dataset includes four first original rule data. The first attribute set is obtained through the above method. If the attribute set is the same as the first attribute set, then the attribute value corresponding to "alarm title" in the four first original rule data is ORed with... Figure 7 The attribute values ​​corresponding to "Alarm Title" are merged, and the attribute values ​​corresponding to "Alarm ID" and "Dispatch Delay" are processed in the same way to obtain the following result: Figure 14 The data shown is one third rule.

[0138] In the second case, if each attribute in the attribute set is the same as each attribute in the first attribute set, and each attribute value in the attribute set is different from each attribute value in the first attribute set, then the attribute values ​​in the first attribute set are concatenated as the attribute value corresponding to the target attribute, and the attribute values ​​corresponding to attributes that are not in the first attribute set in the multiple first candidate rule data are merged using an OR relationship to obtain the third rule data.

[0139] like Figure 7 As shown, this is a rule dataset. During the merging of the original rule data in the original rule dataset, the attribute set is saved. For example... Figure 15 As shown, the first original rule dataset includes four first original rule data. A first attribute set is obtained through the above method. If the attributes in the attribute set and the first attribute set are the same but have different values, then the attribute values ​​in the first attribute set are concatenated to obtain the attribute value corresponding to the target attribute. Figure 15 In the four original first rule data, the attribute values ​​corresponding to "Alarm Title" are merged using an OR relationship. The attribute values ​​corresponding to "Alarm ID" and "Dispatch Delay" are processed in the same way, resulting in the following: Figure 16 The data for Rule 2, Rule 3, is shown below.

[0140] In the third scenario, if each attribute in the attribute set is different from each attribute in the first attribute set, and the attribute values ​​in the attribute set are different from the attribute values ​​in the first attribute set, then the attribute values ​​corresponding to each attribute in the attribute set in each first rule data to be merged are concatenated, and based on the attribute values ​​corresponding to each attribute in the first attribute set in the multiple first rule data to be merged, and the attribute values ​​corresponding to attributes in the first rule data that are not in the attribute set and not in the first attribute set, a third rule data is obtained.

[0141] like Figure 7 As shown, this is a rule dataset. During the merging of the original rule data in the original rule dataset, the attribute set is saved. For example... Figure 17 As shown, the first original rule dataset includes two first original rule data. A first attribute set is obtained through the above method. The first attribute set includes dispatch delay and the corresponding attribute value 60. It is determined that the attributes in the attribute set and the first attribute set are different and have different attribute values. Therefore, for the target attribute, the corresponding attribute values ​​in the two first original rule data are concatenated. Based on the attribute values ​​corresponding to each attribute in the first attribute set of the two first rule data to be merged, as well as the attribute values ​​corresponding to "alarm title" and "alarm ID", the following is obtained: Figure 18 The data for Rule 2 and Rule 3 shown.

[0142] In addition to the three situations mentioned above, the following situations also apply:

[0143] If each attribute in the first attribute set includes each attribute in the attribute set, then for each attribute in the attribute set, the attribute values ​​corresponding to the attributes in the first attribute set that are the same as each attribute in the attribute set are concatenated as the attribute value corresponding to the target attribute. The attribute values ​​corresponding to the attributes that are not in the first attribute set in the multiple first candidate rule data are merged using an OR relationship. Based on the attribute values ​​corresponding to the attributes that are different from each attribute in the first attribute set and each attribute in the attribute set, the third rule data is obtained.

[0144] like Figure 7 As shown, this is a rule dataset. During the merging of the original rule data in the original rule dataset, an attribute set is saved. This attribute set includes "System Name", "Specialty", "Equipment Type", "Manufacturer", "Alarm Level", and "Dispatch Object" along with their corresponding attribute values. For example... Figure 19 As shown, the first original rule dataset includes two first original rule data. A first attribute set is obtained through the above method. The first attribute set includes "System Name", "Specialty", "Equipment Type", "Manufacturer", "Alarm Level", "Dispatch Target", and "Dispatch Delay" along with their corresponding attribute values. Since the first attribute set includes an attribute set, for the target attribute, the corresponding attribute values ​​in the first attribute set are concatenated. The attribute values ​​corresponding to "Alarm Title" in the two first original rule data are merged using an OR relationship. The attribute value corresponding to "Alarm ID" is processed in the same way. Based on the attribute value corresponding to "Dispatch Delay" in the first attribute set, the following is obtained: Figure 20 The data for Rule 2, Rule 3, is shown below.

[0145] Step 115: Based on the third rule data and the non-first rule data to be merged in the first original rule dataset, obtain the updated first rule dataset;

[0146] The above steps specifically include:

[0147] For each attribute in the attribute set, the corresponding attribute values ​​in each non-first rule data in the first original rule dataset are concatenated to serve as the attribute value corresponding to the target attribute of the non-first rule data. Based on the attribute values ​​corresponding to the attributes in the non-attribute set, the fourth rule data is obtained.

[0148] Based on the third and fourth rule data, the updated first rule dataset is obtained.

[0149] like Figure 7As shown, this is a rule dataset. During the merging of the original rule data in the original rule dataset, an attribute set is saved. This attribute set includes "System Name", "Specialty", "Equipment Type", "Manufacturer", "Alarm Level", and "Dispatch Object" along with their corresponding attribute values. For example... Figure 21 As shown, the two first original rule data are not the first rule data to be merged. For each attribute in the attribute set, the corresponding attribute values ​​in the two non-first rule data to be merged are concatenated to obtain the attribute value corresponding to the target attribute of the non-first rule data to be merged. Based on the attribute values ​​corresponding to the attributes not in the attribute set, the fourth rule data is obtained. Figure 22 The first rule dataset contains the second and third rule data.

[0150] Step 116: Match the acquired alarm data with each rule data in the first rule dataset, determine the matched rule data, and issue the corresponding alarm action.

[0151] The above steps include:

[0152] Once a rule update is detected, the update information will be broadcast.

[0153] The information is updated according to the rules, and the first alarm data obtained from the data source is prohibited from being stored in the sequential cache queue;

[0154] The first alarm data is matched with each rule data in the first rule dataset to determine the matched rule data and issue the corresponding alarm action.

[0155] After determining the matched rule data and issuing the corresponding alarm action, the process includes:

[0156] If the sequential cache queue is found to be empty, second alarm data is obtained from the data source.

[0157] The second alarm data is matched with each rule data in the first rule dataset to determine the matched rule data and issue the corresponding alarm action.

[0158] To ensure high system reliability and avoid alarm loss, this disclosure proposes an alarm data caching method that delays alarm data arriving within the timeframe between rule activation and effectiveness. This scheme can control the compression ratio of rule data to within 100:1, significantly reducing the time from rule activation to effectiveness. Verification shows that the activation-effectiveness time difference for 300 compressed rules is within 10 seconds. The activation-effectiveness time difference is the difference between the activation time and the rule data import time. The activation-effectiveness time difference of the rules in this disclosure is negligible compared to the minimum delay of 5 minutes for traditional rules. Alarm data reported within the rule activation-effectiveness time window is stored in a sequential cache queue to prevent alarm data loss.

[0159] like Figure 13 As shown, after the merging module completes rule merging and obtains the first rule dataset, it uses Kafka's broadcast mechanism to broadcast the rule update completion information. The logic processing center in the business delay processing module receives the stop rule update completion information, closes the switch, and sends the first alarm data stored in the sequential cache queue to the alarm parsing module. The alarm parsing module matches the first alarm data with each rule data in the first rule dataset, determines the matched rule data, and issues the corresponding alarm action. The monitoring center continuously obtains the data size in the sequential cache queue, monitors the data in the sequential cache queue, and if the sequential cache queue is empty, it broadcasts a queue clearing message through the message sending module. Upon receiving the queue clearing message, the alarm parsing module begins receiving the second alarm data from the data source, matches the second alarm data with each rule data in the first rule dataset, determines the matched rule data, and issues the corresponding alarm action.

[0160] When configuring rule data in the existing network management system, alarm data reported cannot match the imported rule data within the window period between the rule data being imported and its effective date. This results in alarm data that meets the rule data being unable to be parsed, leading to problems such as alarm data parsing errors, data loss, and order dispatch time delays.

[0161] like Figure 13 As shown, when the business delay processing module receives the first alarm data from the data source, it assigns a timestamp tag T1 (the first time tag) to each first alarm data. This timestamp is combined with the dequeue timestamp (the second time tag) to determine the corresponding business time difference. The alarm parsing module determines the first delay time based on the rule data matched with the first alarm data, and updates the business dispatch time of the alarm data based on the business time difference, the alarm occurrence time, and the first delay time, thus resolving the business dispatch delay issue caused by rule changes.

[0162] The business time difference is calculated using the following method:

[0163] Determine the first time tag for each first alarm data entering the queue and the second time tag for each data leaving the queue;

[0164] Based on the difference between the second time tag and the first time tag, the business time difference corresponding to the first alarm data is determined and stored in the first alarm data.

[0165] Based on the business time difference corresponding to each first alarm data determined above, the following method is used for dispatching:

[0166] Based on the matched rule data, a corresponding first delay time is determined, and based on the difference between the first delay time and the service time difference, a second delay time corresponding to the first alarm data is determined.

[0167] Based on the sum of the alarm occurrence time, the second delay time, and the business time difference of the first alarm data, the corresponding dispatch time is determined, and the order is dispatched according to the dispatch time.

[0168] For example, if the above method is not used, and the alarm occurrence time of a first alarm data is 1:00, the business time difference is 1 minute, and the first delay time is 5 minutes, then the corresponding dispatch time will still remain 1:06, and the dispatch will be made according to the dispatch time. If the above method is used, and the alarm occurrence time of a first alarm data is 1:00, the business time difference is 1 minute, and the first delay time is 5 minutes, then the second delay time corresponding to the first alarm data is determined to be 5-1=4 minutes, and the corresponding dispatch time will still remain 1:05, and the dispatch will be made according to the dispatch time.

[0169] This disclosure presents a solution that combines the time difference between alarm enqueueing and dequeueing with business scenarios to update the dispatch time for alarm dispatch scenarios, thereby reducing the impact of delayed processing on business dispatch.

[0170] In some embodiments, based on the same inventive concept, the present disclosure also provides an alarm parsing and processing apparatus. Since this apparatus is the same as the apparatus in the method of the present disclosure, and the principle of the apparatus in solving the problem is similar to that of the method, the implementation of the apparatus can refer to the implementation of the method, and the repeated parts will not be described again.

[0171] like Figure 23 As shown, the above-mentioned device includes the following modules:

[0172] The acquisition module 231 is used to acquire the original rule dataset under the target scene. The original rule dataset includes multiple original rule data, and the original rule data is composed of attribute values ​​corresponding to different attributes.

[0173] The calculation module 232 is used to take each original rule data as a baseline according to the traversal order, and calculate the similarity coefficient and Euclidean distance between the attribute values ​​of the baseline original rule data and other original rule data for each attribute.

[0174] The module 233 is used to determine, based on the similarity coefficient and Euclidean distance, multiple rule data to be merged in the original rule dataset that have the same attribute value for the same attribute, take the attribute with the same attribute value as the attribute to be merged, and obtain the attribute set consisting of the attribute to be merged and the corresponding attribute value.

[0175] The merging module 234 is used to concatenate the attributes to be merged in the attribute set into a target attribute, concatenate the attribute values ​​in the attribute set into the attribute value corresponding to the target attribute, and merge the attribute values ​​corresponding to the attributes that are not in the attribute set in the rule data to be merged using an OR relationship to obtain the first rule data.

[0176] The matching module 235 is used to obtain an updated rule dataset based on the first rule data and the non-to-be-merged rule data in the original rule dataset, match the acquired alarm data with each rule data in the rule dataset, determine the matched rule data, and issue the corresponding alarm action.

[0177] As an optional implementation, the matching module is used for:

[0178] For each attribute in the attribute set, the corresponding attribute values ​​in each non-mergeable rule data in the original rule dataset are concatenated to obtain the attribute value corresponding to the target attribute of the non-mergeable rule data. Based on the attribute values ​​corresponding to the attributes in the non-attribute set, the second rule data is obtained.

[0179] Based on the first rule data and the second rule data, an updated rule dataset is obtained.

[0180] As an optional implementation, the merging module is used for:

[0181] For each benchmark original rule data, the attribute values ​​and similarity coefficients of other original rule data whose Euclidean distance is less than a set threshold are added to the candidate attribute feature set corresponding to that benchmark original rule data;

[0182] For each set of candidate attribute features, based on the number of attributes in each original rule data in the set of candidate attribute features and the similarity coefficient corresponding to each attribute value, the average similarity coefficient corresponding to the original rule data is determined, and attribute values ​​with similarity coefficients less than the average similarity coefficient are deleted from the original rule data to obtain the set of attribute features corresponding to the set of candidate attribute features.

[0183] The intersection of the attribute values ​​corresponding to each attribute in each attribute feature set is taken as the attribute set, and multiple original rule data in the original rule dataset are determined as each rule data to be merged.

[0184] As an optional implementation, the merging module is used for:

[0185] If there is no intersection between the attribute values ​​corresponding to each attribute in each attribute feature set, then the intersection between the attribute values ​​corresponding to each attribute in multiple attribute feature sets in each attribute feature set is taken as the attribute set, and the corresponding multiple rules data to be merged are determined.

[0186] As an optional implementation, the device further includes:

[0187] The update module is used to respond to a rule update instruction and obtain a first original rule dataset from the rule update instruction. The first original rule dataset includes multiple first original rule data, and the first original rule data consists of attribute values ​​corresponding to different attributes.

[0188] The first calculation module is used to take each first original rule data as a benchmark according to the traversal order, and calculate the similarity coefficient and Euclidean distance between the attribute values ​​of the first benchmark original rule data and other first original rule data for each attribute.

[0189] The first obtaining module is used to determine, based on the similarity coefficient and Euclidean distance, multiple first rules to be merged data with the same attribute value for the same attribute in the first original rule dataset, take the attribute with the same attribute value as the first attribute to be merged, and obtain a first attribute set consisting of the first attribute to be merged and the corresponding attribute value.

[0190] The first merging module is used to merge the original rule dataset and multiple first rule data to be merged according to the attribute set and the first attribute set to obtain the third rule data;

[0191] The second obtaining module is used to obtain the updated first rule dataset based on the third rule data and the non-first rule data to be merged in the first original rule dataset;

[0192] The first matching module is used to match the acquired alarm data with each rule data in the first rule dataset, determine the matched rule data, and issue the corresponding alarm action.

[0193] As an optional implementation, the first obtaining module is used to:

[0194] For each first benchmark original rule data, the attribute values ​​and similarity coefficients of other first original rule data whose Euclidean distance is less than a set threshold are added to the first candidate attribute feature set corresponding to that first benchmark original rule data.

[0195] For each first candidate attribute feature set, based on the number of attributes and the similarity coefficients corresponding to each attribute value of each first original rule data in the first candidate feature set, the average similarity coefficient corresponding to the first original rule data is determined, and attribute values ​​with similarity coefficients less than the average similarity coefficient are deleted from the first original rule data to obtain the first attribute feature set corresponding to the first candidate attribute feature set.

[0196] The intersection of the attribute values ​​corresponding to each attribute in each first attribute feature set is taken as the first attribute set, and multiple first original rule data in the first original rule dataset are determined as each first rule data to be merged.

[0197] As an optional implementation, the first obtaining module is used to:

[0198] If there is no intersection between the attribute values ​​corresponding to each attribute in each first attribute feature set, then the intersection of the attribute values ​​corresponding to each attribute in multiple first attribute feature sets in each first attribute feature set is taken as the first attribute set, and the corresponding multiple first rules to be merged are determined.

[0199] As an optional implementation, the first merging module is used for:

[0200] If the attribute set is the same as the first attribute set, then the attribute values ​​corresponding to the attributes that are not in the first attribute set in the multiple first rule data to be merged are merged with the attribute values ​​corresponding to the attribute in the rule dataset using an OR relationship to obtain the third rule data.

[0201] As an optional implementation, the first merging module is used for:

[0202] If each attribute in the attribute set is the same as each attribute in the first attribute set, and each attribute value in the attribute set is different from each attribute value in the first attribute set, then the attribute values ​​in the first attribute set are concatenated as the attribute value corresponding to the target attribute. The attribute values ​​corresponding to attributes that are not in the first attribute set in the multiple first candidate rule data are merged using an OR relationship to obtain the third rule data.

[0203] As an optional implementation, the first merging module is used for:

[0204] If each attribute in the attribute set is different from each attribute in the first attribute set, and each attribute value in the attribute set is different from each attribute value in the first attribute set, then the attribute values ​​corresponding to each attribute in the attribute set in each first rule data to be merged are concatenated, and based on the attribute values ​​corresponding to each attribute in the first attribute set in the multiple first rule data to be merged, and the attribute values ​​corresponding to attributes in the first rule data that are not in the attribute set and not in the first attribute set, a third rule data is obtained.

[0205] As an optional implementation, the second obtaining module is used for:

[0206] For each attribute in the attribute set, the corresponding attribute values ​​in each non-first rule data in the first original rule dataset are concatenated to serve as the attribute value corresponding to the target attribute of the non-first rule data. Based on the attribute values ​​corresponding to the attributes in the non-attribute set, the fourth rule data is obtained.

[0207] Based on the third and fourth rule data, the updated first rule dataset is obtained.

[0208] As an optional implementation, the similarity coefficient d between the baseline original rule data and any other original rule data for the same attribute value is calculated using the following formula:

[0209]

[0210] Wherein, A is the attribute value corresponding to this attribute of the baseline original rule data, and B is the attribute value corresponding to this attribute of any other original rule data.

[0211] As an optional implementation, the Euclidean distance W between the baseline original rule data and any other original rule data for the same attribute value is calculated using the following formula:

[0212]

[0213] Wherein, d is the similarity coefficient between the baseline original rule data and the attribute value corresponding to the attribute in any other original rule data.

[0214] As an optional implementation, the update module is used for:

[0215] If a rule update is detected, the update information will be broadcast.

[0216] The information will be updated according to the rules, and the first alarm data obtained from the data source will be stored in the sequential cache queue.

[0217] As an optional implementation, the first matching module is used for:

[0218] Once a rule update is detected, the update information will be broadcast.

[0219] The information is updated according to the rules, and the first alarm data obtained from the data source is prohibited from being stored in the sequential cache queue;

[0220] The first alarm data is matched with each rule data in the first rule dataset to determine the matched rule data and issue the corresponding alarm action.

[0221] As an optional implementation, after determining the matched rule data and issuing the corresponding alarm action, the first matching module is used to:

[0222] If the sequential cache queue is found to be empty, second alarm data is obtained from the data source.

[0223] The second alarm data is matched with each rule data in the first rule dataset to determine the matched rule data and issue the corresponding alarm action.

[0224] As an optional implementation, the first matching module is used for:

[0225] Determine the first time tag for each first alarm data entering the queue and the second time tag for each data leaving the queue;

[0226] Based on the difference between the second time tag and the first time tag, the business time difference corresponding to the first alarm data is determined and stored in the first alarm data.

[0227] As an optional implementation, the first matching module is used to match the first alarm data with each rule data in the first rule dataset, determine the matched rule data, and issue a corresponding alarm action.

[0228] Based on the matched rule data, a corresponding first delay time is determined, and based on the difference between the first delay time and the service time difference, a second delay time corresponding to the first alarm data is determined.

[0229] Based on the sum of the alarm occurrence time, the second delay time, and the business time difference of the first alarm data, the corresponding dispatch time is determined, and the order is dispatched according to the dispatch time.

[0230] In some embodiments, based on the same inventive concept, this disclosure also provides an alarm parsing and processing device, which can implement the alarm parsing and processing functions described above. Please refer to... Figure 24The device includes a processor 241 and a memory 242, wherein the memory 242 is used to store program instructions;

[0231] The processor 241 calls the program instructions stored in the memory and executes the program instructions to implement the steps of the alarm parsing and processing method described above.

[0232] In some possible implementations, various aspects of this disclosure can also be implemented in the form of a program product, such as... Figure 25 As shown, the computer program product 250 includes computer program code that, when run on a computer, causes the computer to execute any of the alarm parsing and processing methods discussed above. Since the principle by which the above computer program product solves the problem is similar to that of the alarm parsing and processing method, the implementation of the above computer program product can be found in the implementation of the method; repeated details will not be elaborated further.

[0233] Those skilled in the art will understand that embodiments of this disclosure can be provided as methods, systems, or computer program products. Therefore, this disclosure can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this disclosure can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0234] This disclosure is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 Devices that specify the functions in one or more boxes.

[0235] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including an instruction device, which is implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0236] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0237] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the following claims.

[0238] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. An alarm parsing and processing method, characterized in that, The method includes: Obtain the original rule dataset for the target scenario. The original rule dataset includes multiple original rule data, and the original rule data consists of attribute values ​​corresponding to different attributes. Each original rule data is used as a baseline in the traversal order, and the similarity coefficient and Euclidean distance between the attribute values ​​of the baseline original rule data and other original rule data are calculated for each attribute. Based on the similarity coefficient and Euclidean distance, multiple rule data to be merged are identified in the original rule dataset that have the same attribute value for the same attribute. The attribute with the same attribute value is taken as the attribute to be merged, and an attribute set consisting of the attribute to be merged and the corresponding attribute value is obtained. Each attribute to be merged in the attribute set is concatenated into a target attribute, and each attribute value in the attribute set is concatenated into the attribute value corresponding to the target attribute. The attribute values ​​corresponding to attributes that are not in the attribute set in each rule data to be merged are merged using an OR relationship to obtain the first rule data. Based on the first rule data and the non-merging rule data in the original rule dataset, an updated rule dataset is obtained. The acquired alarm data is matched with each rule data in the rule dataset to determine the matched rule data and issue the corresponding alarm action. Specifically, based on the similarity coefficient and Euclidean distance, multiple rule data points with the same attribute value corresponding to the same attribute in the original rule dataset are identified as to be merged. The attributes with the same attribute value are then used as the attributes to be merged, resulting in an attribute set consisting of the attributes to be merged and their corresponding attribute values. This includes: For each benchmark original rule data, the attribute values ​​and similarity coefficients of other original rule data whose Euclidean distance is less than a set threshold are added to the candidate attribute feature set corresponding to that benchmark original rule data; For each set of candidate attribute features, based on the number of attributes in each original rule data in the set of candidate attribute features and the similarity coefficient corresponding to each attribute value, the average similarity coefficient corresponding to the original rule data is determined, and attribute values ​​with similarity coefficients less than the average similarity coefficient are deleted from the original rule data to obtain the set of attribute features corresponding to the set of candidate attribute features. The intersection of the attribute values ​​corresponding to each attribute in each attribute feature set is taken as the attribute set, and multiple original rule data in the original rule dataset are determined as each rule data to be merged.

2. The method according to claim 1, characterized in that, The step of obtaining the updated rule dataset based on the first rule data and the non-to-be-merged rule data in the original rule dataset includes: For each attribute in the attribute set, the corresponding attribute values ​​in each non-mergeable rule data in the original rule dataset are concatenated to obtain the attribute value corresponding to the target attribute of the non-mergeable rule data. Based on the attribute values ​​corresponding to the attributes in the non-attribute set, the second rule data is obtained. Based on the first rule data and the second rule data, an updated rule dataset is obtained.

3. The method according to claim 1, characterized in that, Based on the similarity coefficient and Euclidean distance, multiple rule data points with the same attribute value corresponding to the same attribute in the original rule dataset are identified as to be merged. The attributes with the same attribute value are then selected as the attributes to be merged, resulting in an attribute set consisting of the attributes to be merged and their corresponding attribute values. If there is no intersection between the attribute values ​​corresponding to each attribute in each attribute feature set, then the intersection between the attribute values ​​corresponding to each attribute in multiple attribute feature sets in each attribute feature set is taken as the attribute set, and the corresponding multiple rules data to be merged are determined.

4. The method according to claim 1, characterized in that, The method further includes: In response to a rule update instruction, the first original rule dataset in the rule update instruction is obtained. The first original rule dataset includes multiple first original rule data, and the first original rule data consists of attribute values ​​corresponding to different attributes. Following the traversal order, each first original rule data is used as a baseline, and the similarity coefficient and Euclidean distance between the attribute values ​​of the first baseline original rule data and other first original rule data are calculated for each attribute. Based on the similarity coefficient and Euclidean distance, multiple first rules to be merged with the same attribute value for the same attribute are identified in the first original rule dataset. The attribute with the same attribute value is taken as the first attribute to be merged, and a first attribute set consisting of the first attribute to be merged and the corresponding attribute value is obtained. Based on the attribute set and the first attribute set, the rule dataset and multiple first rule data to be merged are merged to obtain the third rule data; Based on the third rule data and the non-first rule data to be merged in the first original rule dataset, the updated first rule dataset is obtained; The acquired alarm data is matched with each rule data in the first rule dataset to determine the matched rule data and issue the corresponding alarm action.

5. The method according to claim 4, characterized in that, Based on the similarity coefficient and Euclidean distance, multiple first rules to be merged with the same attribute value corresponding to the same attribute are identified in the first original rule dataset. The attributes with the same attribute value are taken as first attributes to be merged, thus obtaining a first attribute set consisting of the first attributes to be merged and their corresponding attribute values. This includes: For each first benchmark original rule data, the attribute values ​​and similarity coefficients of other first original rule data whose Euclidean distance is less than a set threshold are added to the first candidate attribute feature set corresponding to that first benchmark original rule data. For each first candidate attribute feature set, based on the number of attributes and the similarity coefficients corresponding to each attribute value of each first original rule data in the first candidate feature set, the average similarity coefficient corresponding to the first original rule data is determined, and attribute values ​​with similarity coefficients less than the average similarity coefficient are deleted from the first original rule data to obtain the first attribute feature set corresponding to the first candidate attribute feature set. The intersection of the attribute values ​​corresponding to each attribute in each first attribute feature set is taken as the first attribute set, and multiple first original rule data in the first original rule dataset are determined as each first rule data to be merged.

6. The method according to claim 5, characterized in that, Based on the similarity coefficient and Euclidean distance, multiple first rules to be merged with the same attribute value corresponding to the same attribute are identified in the first original rule dataset. The attributes with the same attribute value are taken as first attributes to be merged, thus obtaining a first attribute set consisting of the first attributes to be merged and their corresponding attribute values. This includes: If there is no intersection between the attribute values ​​corresponding to each attribute in each first attribute feature set, then the intersection of the attribute values ​​corresponding to each attribute in multiple first attribute feature sets in each first attribute feature set is taken as the first attribute set, and the corresponding multiple first rules to be merged are determined.

7. The method according to claim 4, characterized in that, The step of merging the rule dataset and multiple first rule data to be merged according to the attribute set and the first attribute set to obtain the third rule data includes: If the attribute set is the same as the first attribute set, then the attribute values ​​corresponding to the attributes that are not in the first attribute set in the multiple first rule data to be merged are merged with the attribute values ​​corresponding to the attribute in the rule dataset using an OR relationship to obtain the third rule data.

8. The method according to claim 4, characterized in that, The step of merging the rule dataset and multiple first rule data to be merged according to the attribute set and the first attribute set to obtain the third rule data includes: If each attribute in the attribute set is the same as each attribute in the first attribute set, and each attribute value in the attribute set is different from each attribute value in the first attribute set, then the attribute values ​​in the first attribute set are concatenated as the attribute value corresponding to the target attribute. The attribute values ​​corresponding to attributes that are not in the first attribute set in the multiple first candidate rule data are merged using an OR relationship to obtain the third rule data.

9. The method according to claim 4, characterized in that, The step of merging the rule dataset and multiple first rule data to be merged according to the attribute set and the first attribute set to obtain the third rule data includes: If each attribute in the attribute set is different from each attribute in the first attribute set, and each attribute value in the attribute set is different from each attribute value in the first attribute set, then the attribute values ​​corresponding to each attribute in the attribute set in each first rule data to be merged are concatenated, and based on the attribute values ​​corresponding to each attribute in the first attribute set in the multiple first rule data to be merged, and the attribute values ​​corresponding to attributes in the first rule data that are not in the attribute set and not in the first attribute set, a third rule data is obtained.

10. The method according to claim 4, characterized in that, The step of obtaining the updated first rule dataset based on the third rule data and the non-first rule data to be merged in the first original rule dataset includes: For each attribute in the attribute set, the corresponding attribute values ​​in each non-first rule data in the first original rule dataset are concatenated to serve as the attribute value corresponding to the target attribute of the non-first rule data. Based on the attribute values ​​corresponding to the attributes in the non-attribute set, the fourth rule data is obtained. Based on the third and fourth rule data, the updated first rule dataset is obtained.

11. The method according to any one of claims 1-10, characterized in that, The similarity coefficient d between the baseline original rule data and any other original rule data for the same attribute value is calculated using the following formula: ； Wherein, A is the attribute value corresponding to this attribute of the baseline original rule data, and B is the attribute value corresponding to this attribute of any other original rule data.

12. The method according to claim 11, characterized in that, The Euclidean distance W between the baseline original rule data and any other original rule data for the same attribute value is calculated using the following formula: ； Wherein, d is the similarity coefficient between the baseline original rule data and the attribute value corresponding to the attribute in any other original rule data.

13. The method according to claim 4, characterized in that, The response to the rule update instruction includes: If a rule update is detected, the update information will be broadcast. The information will be updated according to the rules, and the first alarm data obtained from the data source will be stored in the sequential cache queue.

14. The method according to claim 4, characterized in that, The step of matching the acquired alarm data with each rule data in the first rule dataset, determining the matched rule data, and issuing the corresponding alarm action includes: Once a rule update is detected, the update information will be broadcast. The information is updated according to the rules, and the first alarm data obtained from the data source is prohibited from being stored in the sequential cache queue; The first alarm data is matched with each rule data in the first rule dataset to determine the matched rule data and issue the corresponding alarm action.

15. The method according to claim 14, characterized in that, After determining the matched rule data and issuing the corresponding alarm action, the process includes: If the sequential cache queue is found to be empty, second alarm data is obtained from the data source. The second alarm data is matched with each rule data in the first rule dataset to determine the matched rule data and issue the corresponding alarm action.

16. The method according to claim 14, characterized in that, The step of matching the first alarm data with each rule data in the first rule dataset, determining the matched rule data, and issuing the corresponding alarm action includes: Determine the first time tag for each first alarm data entering the queue and the second time tag for each data leaving the queue; Based on the difference between the second time tag and the first time tag, the business time difference corresponding to the first alarm data is determined and stored in the first alarm data.

17. The method according to claim 16, characterized in that, The step of matching the first alarm data with each rule data in the first rule dataset, determining the matched rule data, and issuing the corresponding alarm action includes: Based on the matched rule data, a corresponding first delay time is determined, and based on the difference between the first delay time and the service time difference, a second delay time corresponding to the first alarm data is determined. Based on the sum of the alarm occurrence time, the second delay time, and the business time difference of the first alarm data, the corresponding dispatch time is determined, and the order is dispatched according to the dispatch time.

18. An alarm parsing and processing device, characterized in that, The device includes: The acquisition module is used to acquire the original rule dataset under the target scenario. The original rule dataset includes multiple original rule data, and the original rule data consists of attribute values ​​corresponding to different attributes. The calculation module is used to take each original rule data as a baseline according to the traversal order, and calculate the similarity coefficient and Euclidean distance between the attribute values ​​of the baseline original rule data and other original rule data for each attribute. The acquisition module is used to determine, based on the similarity coefficient and Euclidean distance, multiple rule data to be merged in the original rule dataset that have the same attribute value for the same attribute, take the attribute with the same attribute value as the attribute to be merged, and obtain the attribute set consisting of the attribute to be merged and the corresponding attribute value; The merging module is used to concatenate the attributes to be merged in the attribute set into a target attribute, concatenate the attribute values ​​in the attribute set into the attribute value corresponding to the target attribute, and merge the attribute values ​​corresponding to the attributes that are not in the attribute set in the rule data to be merged using an OR relationship to obtain the first rule data. The matching module is used to obtain an updated rule dataset based on the first rule data and the non-to-merge rule data in the original rule dataset, match the acquired alarm data with each rule data in the rule dataset, determine the matched rule data, and issue the corresponding alarm action. The obtaining module is used for: For each benchmark original rule data, the attribute values ​​and similarity coefficients of other original rule data whose Euclidean distance is less than a set threshold are added to the candidate attribute feature set corresponding to that benchmark original rule data; For each set of candidate attribute features, based on the number of attributes in each original rule data in the set of candidate attribute features and the similarity coefficient corresponding to each attribute value, the average similarity coefficient corresponding to the original rule data is determined, and attribute values ​​with similarity coefficients less than the average similarity coefficient are deleted from the original rule data to obtain the set of attribute features corresponding to the set of candidate attribute features. The intersection of the attribute values ​​corresponding to each attribute in each attribute feature set is taken as the attribute set, and multiple original rule data in the original rule dataset are determined as each rule data to be merged.

19. An electronic device, characterized in that, include: processor; A memory for storing processor-executable instructions; wherein the processor implements the steps of the method according to any one of claims 1 to 17 by executing the executable instructions.

20. A computer-readable and writable storage medium storing computer instructions thereon, characterized in that, When executed by a processor, this instruction implements the steps of the method according to any one of claims 1 to 17.

Images