A method for determining an alarm device, related apparatuses and devices

Abstract

Embodiments of the present application disclose a method, device and equipment for determining an alarm device in the field of cloud security, which is used for determining a root alarm device through an alarm convergence matrix to quickly locate a fault and ensure safe operation. The present application comprises: obtaining device monitoring data corresponding to a target area, wherein the device monitoring data comprises a total number of alarms, state information of each device and state information of each measuring point in at least one measuring point; if the total number of alarms of the device is greater than or equal to an alarm threshold, generating an alarm matrix according to the state information of each device; generating a fault matrix according to the state information of each measuring point in the at least one measuring point; generating an alarm convergence matrix according to the alarm matrix, the fault matrix and a current matrix; and if the alarm convergence matrix is a non-zero matrix, determining a device corresponding to a non-zero element position in the alarm convergence matrix as an alarm device.

Description

Technical Field

[0001] This application relates to the field of cloud security, and in particular to a method for determining alarm devices, related apparatus, and device. Background Technology

[0002] As information technology infrastructure development deepens, the scale of data centers, IoT devices, and edge computing infrastructure is growing, requiring timely maintenance by operations and maintenance personnel to ensure their normal operation. Therefore, monitoring systems can generate a large number of alarm messages to help operations and maintenance personnel promptly identify, respond to, and resolve problems.

[0003] Typically, the monitoring system monitors the operating data of multiple devices and generates corresponding alarm information. The alarm information is then pushed to designated maintenance personnel, enabling them to perform appropriate maintenance on the devices based on the alarm information.

[0004] However, when a large-scale network anomaly occurs, there may be a surge in alarms, known as an alarm storm. In this case, maintenance personnel may receive alarm notifications continuously during a certain period of time. This may lead to duplicate alarms or alarm stacking. Furthermore, a large number of alarm messages can interfere with the maintenance personnel's ability to obtain important information, causing them trouble and making it more difficult to troubleshoot equipment failures. This reduces the accuracy of identifying faulty equipment and ultimately reduces equipment maintenance efficiency. Summary of the Invention

[0005] This application provides a method, related apparatus, and device for determining alarm devices. By constructing a current matrix with devices within a target area as elements, an alarm matrix based on device status information, and a fault matrix based on measurement point status information, and combining the current matrix, alarm matrix, and fault matrix to determine an alarm convergence matrix, the correlation between devices is enhanced and the dimensions of reference information for determining alarm devices are increased. Thus, alarm devices are determined through elements in the alarm convergence matrix, improving the accuracy of alarm device acquisition. This eliminates the need for extensive manpower for device fault diagnosis, improves the efficiency of alarm device acquisition, and ultimately enhances the efficiency of device maintenance.

[0006] This application provides a method for determining an alarm device, including:

[0007] Obtain device monitoring data corresponding to the target area, wherein the target area includes K devices, and the device monitoring data includes the total number of alarms of the K devices, the status information of each of the K devices, and the status information of each of at least one measurement point, where K is an integer greater than 1;

[0008] If the total number of alarms from the K devices is greater than or equal to the alarm threshold, then an alarm matrix is ​​generated based on the status information of each device.

[0009] A fault matrix is ​​generated based on the status information of each measurement point in at least one measurement point;

[0010] Based on the alarm matrix, fault matrix, and current matrix, an alarm convergence matrix is ​​generated. The current matrix is ​​used to represent the causal network relationship between K devices. The causal network relationship represents the logical relationship between any two devices among the K devices. The current matrix consists of K elements, and there is a one-to-one correspondence between the K elements and the K devices.

[0011] If the alarm convergence matrix is ​​a non-zero matrix, then the device corresponding to the position of the non-zero element in the alarm convergence matrix is ​​determined as the alarm device.

[0012] Another aspect of this application provides a device for determining an alarm device, comprising:

[0013] The acquisition unit is used to acquire device monitoring data corresponding to the target area. The target area includes K devices, and the device monitoring data includes the total number of alarms of the K devices, the status information of each of the K devices, and the status information of each of at least one measurement point. K is an integer greater than 1.

[0014] The generation unit is used to generate an alarm matrix based on the status information of each device if the total number of alarms of K devices is greater than or equal to the alarm threshold.

[0015] The generation unit is also used to generate a fault matrix based on the state information of each measurement point in at least one measurement point;

[0016] The generation unit is also used to generate an alarm convergence matrix based on the alarm matrix, fault matrix and current matrix. The current matrix is ​​used to represent the causal network relationship between K devices. The causal network relationship represents the logical relationship between any two devices among the K devices. The current matrix consists of K elements, and there is a one-to-one correspondence between the K elements and the K devices.

[0017] The determination unit is used to determine the device corresponding to the non-zero element position in the alarm convergence matrix as the alarm device if the alarm convergence matrix is ​​a non-zero matrix.

[0018] In one possible design, in another implementation of the embodiments of this application,

[0019] The acquisition unit is also used to acquire the causal network relationship corresponding to the target area, wherein the causal network relationship includes K nodes and Q directed edges, each node corresponds to a device, each directed edge is used to connect two devices, and Q is an integer greater than or equal to 1.

[0020] The determining unit is also used to determine the element values ​​of any two devices among the K devices in the K*K matrix based on the causal network relationship;

[0021] The generation unit is also used to generate a current matrix based on the element values ​​of any two devices in the K*K matrix.

[0022] In one possible design, in another implementation of the embodiments of this application, the determining unit is specifically used for:

[0023] If the i-th device and the j-th device among the K devices satisfy a non-causal relationship, then the element in the i-th row and j-th column of the K*K matrix is ​​determined as the first element, where i and j are both integers greater than or equal to 1 and less than or equal to K;

[0024] If the i-th device and the j-th device among the K devices satisfy a causal relationship, then the element in the i-th row and j-th column of the K*K matrix is ​​determined as the second element.

[0025] In one possible design, in another implementation of the embodiments of this application, the determining unit is specifically used for:

[0026] If there is a current flowing between the i-th device and the j-th device among the K devices, then the element in the i-th row and j-th column of the K*K matrix is ​​determined as the first element;

[0027] If there is no current flowing between the i-th device and the j-th device among the K devices, then the element in the i-th row and j-th column of the K*K matrix is ​​determined as the second element.

[0028] In one possible design, in another implementation of the embodiments of this application,

[0029] The acquisition unit is also used to acquire the device wiring diagram corresponding to the target area;

[0030] The processing unit is used to divide the K devices in the equipment wiring diagram into nodes to obtain K nodes;

[0031] The processing unit is also used to connect any two nodes among the K nodes with an edge to obtain a node connection graph.

[0032] The processing unit is also used to determine the directed edges in the node connection graph and the relationships between pairs of nodes based on the causal network, so as to obtain the causal network relationship.

[0033] In one possible design, in another implementation of the embodiments of this application,

[0034] The acquisition unit is also used to acquire the historical device wiring diagram corresponding to the target area;

[0035] The processing unit is also used to transpose the current matrix to obtain the target current matrix when the equipment wiring diagram is inconsistent with the historical equipment wiring diagram.

[0036] The generation unit is specifically used to generate an alarm convergence matrix based on the alarm matrix, fault matrix, and target current matrix.

[0037] In one possible design, in another implementation of the embodiments of this application, the generating unit is specifically used for:

[0038] If the device status of the i-th device among the K devices is normal, then the element in the i-th row of the K*1 matrix is ​​determined as the first element;

[0039] If the device status of the i-th device among the K devices is abnormal, then the element in the i-th row of the K*1 matrix is ​​determined as the second element;

[0040] A fault matrix is ​​generated based on the element values ​​of the K devices in the K*1 matrix.

[0041] In one possible design, in another implementation of the embodiments of this application,

[0042] The processing unit is also used to change the second element in the fault matrix to the first element if the device load of each of the K devices meets the preset load conditions, so as to obtain the target fault matrix.

[0043] The processing unit is also used to change the first element of the fault matrix to the second element of the device whose load does not meet the preset load conditions if the device load of any of the K devices does not meet the preset load conditions, so as to obtain the target fault matrix.

[0044] The generation unit is specifically used to generate an alarm convergence matrix based on the alarm matrix, the target fault matrix, and the current matrix.

[0045] In one possible design, in another implementation of the embodiments of this application, the generating unit is specifically used for:

[0046] If the alarm status of the i-th device among the K devices is normal, then the element in the i-th row of the K*1 matrix is ​​determined as the first element;

[0047] If the alarm status of the i-th device among the K devices is abnormal, then the element in the i-th row of the K*1 matrix is ​​determined as the second element;

[0048] An alarm matrix is ​​generated based on the element values ​​of the K devices in the K*1 matrix.

[0049] In one possible design, in another implementation of the embodiments of this application,

[0050] The determination unit is also used to determine the elements to be updated in the alarm matrix based on the mapping relationship between the fault matrix and the alarm matrix if the alarm convergence matrix is ​​a zero matrix;

[0051] The processing unit is also used to update the element value of the element to be updated to the first element, so as to obtain the updated target alarm matrix;

[0052] The processing unit is also used to release the alarms of the device corresponding to the first element in the target alarm matrix, and obtain the total number of alarm convergences.

[0053] In one possible design, in another implementation of the embodiments of this application,

[0054] The determining unit is also used to determine the transfer matrix based on the current matrix and the alarm matrix;

[0055] The generation unit is specifically used to perform a bitwise AND operation on each element in the transition matrix and the fault matrix to obtain the alarm convergence matrix.

[0056] In one possible design, in another implementation of the embodiments of this application,

[0057] The processing unit is further configured to set the alarm index of the first time to the second index if the total number of alarms at the first time is greater than the preset first alarm threshold and the alarm index at the second time is the first index, wherein the second time is the time immediately preceding the first time.

[0058] The processing unit is further configured to set the alarm index at the first moment to the first index if the total number of alarms at the first moment is less than a preset second alarm threshold and the alarm index at the second moment is the second index, wherein the second alarm threshold is greater than the first alarm threshold.

[0059] The processing unit is further configured to set the alarm index of the first time to the alarm index of the second time if the total number of alarms at the first time is less than or equal to the first alarm threshold and greater than or equal to the second alarm threshold.

[0060] The determination unit is also used to determine the alarm level at the first moment based on the alarm index.

[0061] Another aspect of this application provides a computer device, including: a memory, a processor, and a bus system;

[0062] The memory is used to store program code;

[0063] The processor is configured to execute the alarm device determination method described in any of the preceding aspects according to the instructions in the program code;

[0064] Bus systems are used to connect memory and processor to enable communication between them.

[0065] Another aspect of this application provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the methods described above.

[0066] One aspect of this application provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the alarm device determination method provided in any of the above aspects.

[0067] As can be seen from the above technical solutions, the embodiments of this application have the following advantages:

[0068] By acquiring equipment monitoring data corresponding to the target area, when the total number of alarms in the equipment monitoring data is greater than or equal to the alarm threshold, an alarm matrix is ​​generated based on the status information of each device, and a fault matrix is ​​generated based on the status information of each measurement point in at least one measurement point in the equipment monitoring data. Then, an alarm convergence matrix is ​​generated based on the alarm matrix, fault matrix, and current matrix. When the alarm convergence matrix is ​​non-zero, the device corresponding to the non-zero element position in the alarm convergence matrix is ​​identified as the alarm device. Through this method, the correlation between devices and the dimension of reference information for identifying alarm devices are enhanced by constructing a current matrix with devices as elements in the target area, an alarm matrix based on device status information, and a fault matrix based on measurement point status information. The alarm convergence matrix is ​​then determined by combining the current matrix, alarm matrix, and fault matrix. This improves the accuracy of alarm device acquisition, eliminates the need for extensive manpower for equipment fault diagnosis, and increases the efficiency of alarm device acquisition, thereby improving equipment maintenance efficiency. Attached Figure Description

[0069] Figure 1 This is a schematic diagram of an alarm processing architecture in an embodiment of this application;

[0070] Figure 2 This is a schematic diagram of one embodiment of the method for determining alarm devices in this application;

[0071] Figure 3 This is a schematic diagram of another embodiment of the alarm device determination method in this application;

[0072] Figure 4 This is a schematic diagram of another embodiment of the alarm device determination method in this application;

[0073] Figure 5 This is a schematic diagram of another embodiment of the alarm device determination method in this application;

[0074] Figure 6 This is a schematic diagram of another embodiment of the alarm device determination method in this application;

[0075] Figure 7 This is a schematic diagram of another embodiment of the alarm device determination method in this application;

[0076] Figure 8 This is a schematic diagram of another embodiment of the alarm device determination method in this application;

[0077] Figure 9 This is a schematic diagram of another embodiment of the alarm device determination method in this application;

[0078] Figure 10 This is a schematic diagram of another embodiment of the alarm device determination method in this application;

[0079] Figure 11 This is a schematic diagram of another embodiment of the alarm device determination method in this application;

[0080] Figure 12 This is a schematic diagram of another embodiment of the alarm device determination method in this application;

[0081] Figure 13 This is a schematic diagram of another embodiment of the alarm device determination method in this application;

[0082] Figure 14 This is a schematic diagram of the device wiring for a method of determining an alarm device in an embodiment of this application;

[0083] Figure 15 This is a schematic diagram of a causal network relationship in the method for determining alarm devices in the embodiments of this application;

[0084] Figure 16 This is a schematic diagram of a current matrix in the method for determining alarm devices in the embodiments of this application;

[0085] Figure 17 This is a schematic diagram of a fault matrix change in the alarm device determination method of this application embodiment;

[0086] Figure 18 This is a schematic diagram of one embodiment of the alarm device determination device in the embodiments of this application;

[0087] Figure 19 This is a schematic diagram of one embodiment of the computer device described in this application. Detailed Implementation

[0088] This application provides a method, related apparatus, and device for determining alarm devices. The method involves constructing a current matrix with devices within a target area as elements, an alarm matrix based on device status information, and a fault matrix based on measurement point status information. The method combines the current matrix, alarm matrix, and fault matrix to determine an alarm convergence matrix. This enhances the correlation between devices and increases the dimensions of reference information for determining alarm devices. By identifying alarm devices through elements in the alarm convergence matrix, the accuracy of alarm device acquisition is improved. This eliminates the need for extensive manpower for device fault diagnosis, increases the efficiency of alarm device acquisition, and ultimately improves equipment maintenance efficiency.

[0089] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented, for example, in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0090] With the deepening of information technology construction, the scale of data centers, public / private clouds, and the Internet of Things (IoT) is growing larger and larger. Therefore, to ensure the normal operation of these facilities, cloud security technologies can be used for construction and maintenance. A data center typically refers to a physical space where information is centrally processed, stored, transmitted, exchanged, and managed. Computer equipment, server equipment, network equipment, and storage devices are generally considered key equipment in the core network room. Among these, the environmental factors required for the operation of key equipment, such as power supply systems, cooling systems, rack systems, fire protection systems, and monitoring systems, are generally considered critical physical infrastructure.

[0091] Cloud security refers to the collective term for security software, hardware, users, organizations, and security cloud platforms based on cloud computing business models. Cloud security integrates emerging technologies and concepts such as parallel processing, grid computing, and the identification of unknown virus behavior. Through a large network of clients, it monitors abnormal software behavior on the network, obtains the latest information on Trojans and malware on the internet, sends it to the server for automatic analysis and processing, and then distributes solutions for viruses and Trojans to each client.

[0092] The main research directions in cloud security include: 1. Cloud computing security, which focuses on how to ensure the security of the cloud itself and various applications on the cloud, including cloud computer system security, secure storage and isolation of user data, user access authentication, information transmission security, network attack protection, and compliance auditing; 2. Cloudification of security infrastructure, which focuses on how to use cloud computing to build and integrate security infrastructure resources and optimize security protection mechanisms, including building a large-scale security event and information collection and processing platform through cloud computing technology to achieve the collection and correlation analysis of massive amounts of information and improve the ability to control network-wide security events and risks; 3. Cloud security services, which focuses on various security services provided to users based on cloud computing platforms, such as antivirus services.

[0093] It should be understood that the method for determining alarm devices provided in this application can be applied to the field of cloud security, specifically in scenarios where alarm devices are located using monitoring data and alarms. For example, the method can be used to locate alarm devices in a computer room by processing monitoring data and alarms collected from data processing equipment, storage devices, network transmission equipment, and data center security equipment. Another example is the use of monitoring data and alarms from various electrical devices in the electrical system of an IoT park to locate alarm devices within the park. Yet another example is the use of monitoring data from various electrical devices in the electrical system of a fire protection park. Monitoring data and alarms are used to locate alarm devices within the park; as another example, monitoring data and alarms collected from various electrical devices in the power supply system are used to locate alarm devices in the power supply system. In all the above scenarios, in order to locate alarm devices, the traditional method of determining alarm devices mainly involves manually analyzing the collected operating data and alarm information of multiple devices to troubleshoot faulty devices and find alarm devices. This not only consumes a lot of manpower and time costs, but is also easily interfered with by a large number of alarm information, resulting in low accuracy in determining alarm devices and low efficiency in maintaining equipment safety.

[0094] To address the aforementioned problems, this application proposes a method for determining alarm devices, which is applied to... Figure 1 Please refer to the alarm handling system shown. Figure 1 , Figure 1 This is a schematic diagram of the architecture of the alarm processing system in this application embodiment, as shown below. Figure 1 As shown, the server acquires device monitoring data corresponding to the target area. When the total number of alarms from devices in the monitoring data is greater than or equal to the alarm threshold, it generates an alarm matrix based on the status information of each device, and a fault matrix based on the status information of each measurement point in at least one measurement point in the monitoring data. Then, based on the alarm matrix, fault matrix, and current matrix, an alarm convergence matrix is ​​generated. When the alarm convergence matrix is ​​non-zero, the device corresponding to the non-zero element in the alarm convergence matrix is ​​identified as the alarm device. This method enhances the correlation between devices and increases the dimensions of reference information for identifying alarm devices by constructing a current matrix with devices as elements within the target area, an alarm matrix based on device status information, and a fault matrix based on measurement point status information. Combining these three matrices to determine the alarm convergence matrix enhances the correlation between devices and increases the dimensions of reference information for identifying alarm devices. This improves the accuracy of alarm device acquisition by identifying alarm devices through elements in the alarm convergence matrix, eliminating the need for extensive manpower for device fault diagnosis and improving the efficiency of alarm device acquisition, thereby improving equipment maintenance efficiency.

[0095] To address the aforementioned issues, this application proposes a method for determining alarm devices. This method is generally executed by a server or terminal device, and correspondingly, the device for determining alarm devices is generally located in the server or terminal device.

[0096] The method for determining the alarm devices in this application will be described below. Please refer to [link / reference]. Figure 2 One embodiment of the method for determining alarm devices in this application includes:

[0097] In step S101, the device monitoring data corresponding to the target area is obtained. The target area includes K devices. The device monitoring data includes the total number of alarms of the K devices, the status information of each of the K devices, and the status information of each of the at least one measurement point. K is an integer greater than 1.

[0098] In this embodiment, with the development of the Internet, in order to better store and utilize data, major enterprises are carrying out information construction, such as building data centers. Therefore, the target area can be represented as an area where equipment such as computer rooms, power distribution substations, and power supply systems of data centers are regularly distributed, or it can be other areas such as Internet of Things parks, power systems, etc. No specific restrictions are made here.

[0099] However, due to business requirements, data centers often contain tens of thousands of devices, and different monitoring points are set up for the security of each device. Therefore, there are multiple devices such as various electrical devices in the target area that are interconnected. In actual operation, electrical devices often experience failures such as aging lines, short circuits, and open circuits. If these failures are not addressed in time, they can lead to power system failures, which can seriously endanger the normal power supply to users. Furthermore, since devices can generate and issue corresponding alarm information after a failure, such as device A having too high a voltage, when a failure occurs in the target area, it is often accompanied by thousands or even tens of thousands of alarms, which can easily form an alarm storm. This makes it impossible for maintenance personnel to determine the root cause of the failure and to perform timely equipment maintenance, resulting in the paralysis of equipment in the target area.

[0100] Therefore, in order to maintain the safe operation of equipment within the target area, such as enabling the power system to quickly restore power supply in a short period of time, real-time monitoring of the equipment within the target area can be performed to obtain equipment monitoring data. This equipment monitoring data includes the total number of alarms, equipment status information, and measurement point status information. Among them, the equipment status information includes the alarms of each device, the alarm type, alarm location, alarm content, and alarm time, etc., without any specific restrictions. The measurement point status information includes whether the measurement point is normal, the measurement point is abnormal, and the equipment load of each device, etc., without any specific restrictions. Then, by analyzing and processing the acquired equipment monitoring data, the faulty equipment can be located.

[0101] Specifically, obtaining the equipment monitoring data corresponding to the target area can be achieved by using a Supervisory Control and Data Acquisition (SCADA) system to monitor the data of each device within the target area and to detect device alarms. Other monitoring devices can also be used, without specific limitations. This allows the monitoring data to be analyzed and processed using methods such as constructing time-series causal networks, Granger causal networks, or analytical models, thereby accurately locating the alarming devices based on the processing results.

[0102] SCADA, or Supervisory Control and Data Acquisition, is a computer-based distributed control system (DCS) and power automation monitoring system. It can be applied to data acquisition, monitoring, control, and process control in industries such as power, metallurgy, petroleum, chemical, gas, and railway. SCADA mainly involves configuration software, data transmission links (such as data radios and General Packet Radio Service (GPRS),) and industrial isolation security gateways. These security gateways ensure the security of industrial information networks; most industries use such security gateways to prevent viruses and ensure the security of industrial data and information.

[0103] In step S102, if the total number of alarms from the K devices is greater than or equal to the alarm threshold, an alarm matrix is ​​generated based on the status information of each device.

[0104] In this embodiment, after obtaining the equipment monitoring data corresponding to the target area, since there is a certain correlation between the equipment in the target area, such as the logical relationship between equipment faults and protection and circuit breaker operations in the power system, and this relationship can be described by a causal network, and physical quantities such as current and voltage can be detected between the electrically connected equipment in the target area, and the types of alarms generated by the equipment are numerous, this embodiment can introduce an alarm matrix to construct a new causal network, namely a current network, on the basis of the original causal network. This current network is based on the causal network and is a network composed of devices through which current flows as nodes, used to locate faults in the equipment in the target area.

[0105] Furthermore, since devices within the target area can be pre-configured with alarm policies, corresponding alarm information, i.e., device information, such as the time of alarm occurrence, location of alarm occurrence, and alarm content, can be generated when devices malfunction or fail. Therefore, by pre-designing the definition of the alarm matrix, an alarm matrix can be constructed for each moment within a certain period of time to initially classify device alarms. This can be used to accurately eliminate non-faulty devices, thereby enabling further analysis and processing of other alarm-generating devices that have been eliminated from the non-faulty devices, in order to accurately identify alarm devices.

[0106] The types of alarms generated by the device can be categorized as follows: ,in, k represents the number of devices within the target area. s represents the number of device alarm policies configured on devices within the target area, and the alarm types. The following rules exist:

[0107]

[0108] It should be noted that the target area in this embodiment can also be configured according to the above formulas (1.1) and (1.2) when configuring the device alarm policy.

[0109] Furthermore, if the total number of alarms from K devices at a certain moment is greater than or equal to the alarm threshold within a certain period of time, it can be understood that the number of alarms at that moment may form an alarm storm. In this case, a pre-set alarm convergence program can be started to converge the acquired device alarms according to a preset time window. This can avoid the blocking of the transmission channel caused by the alarm storm, enable maintenance personnel to obtain effective alarm information in a timely manner, thereby improving equipment maintenance efficiency to a certain extent and ensuring the safe operation of the equipment.

[0110] Specifically, in the acquired device monitoring data, if the total number of alarms from K devices at a certain moment is greater than or equal to the alarm threshold within a certain period, it can be understood that the number of alarms at that moment may form an alarm storm. In order to avoid device paralysis, the device information of each acquired device can be used to generate an alarm matrix for that moment according to the pre-designed alarm matrix definition. This can be understood as analyzing faulty devices through the internal information of the devices, which is used to classify non-faulty devices and devices that may be faulty devices. This can accurately exclude non-faulty devices, thereby improving the accuracy of acquiring alarm devices to a certain extent.

[0111] In step S103, a fault matrix is ​​generated based on the status information of each measurement point in at least one measurement point;

[0112] In this embodiment, since the causes of device alarms are not limited to device failure, but may also be due to instability caused by upstream equipment, resulting in false alarms, if the device that generates the alarm is directly analyzed as the faulty device during device fault diagnosis, it is easy to be affected by false alarms, which will reduce the accuracy of locating the alarming device. Moreover, since there are many types of devices and corresponding alarm types in the target area, after obtaining the device monitoring data, in order to further investigate or locate the root cause of the fault in the device that generated the alarm, the status information corresponding to the measurement points used to measure the device's operating status in the device monitoring data, such as device abnormality, device normality, or device load, can be used to construct a fault matrix corresponding to each moment within a certain period of time according to the definition of a preset fault matrix, so as to analyze whether the device belongs to the root cause of the fault.

[0113] Specifically, after acquiring the equipment monitoring data, the status information of the measurement points at various times within a certain period of time can be used to construct the fault matrix corresponding to each time point according to the definition of the preset fault matrix. This can be understood as analyzing whether the equipment belongs to the root cause of the fault through the external information of the equipment, thereby improving the accuracy of acquiring faulty equipment to a certain extent. Each measurement point can correspond to one or more devices, so the status information of each measurement point can correspond to the status information of one or more devices.

[0114] In step S104, an alarm convergence matrix is ​​generated based on the alarm matrix, fault matrix, and current matrix. The current matrix is ​​used to represent the causal network relationship between K devices. The causal network relationship represents the logical relationship between any two devices among the K devices. The current matrix consists of K elements, and there is a one-to-one correspondence between the K elements and the K devices.

[0115] In this embodiment, the current matrix includes K elements, and each element corresponds to a device in the target area. It is a regular matrix constructed with all devices in the target area as the object. It can be used to represent the causal network relationship between all devices in the target area. It can be understood as analyzing whether a device belongs to the root cause of the fault through the global information of the device.

[0116] Specifically, after obtaining the alarm matrix and fault matrix, the current matrix can be acquired, and the alarm matrix, fault matrix, and current matrix can be processed to obtain an alarm convergence matrix with multi-dimensional reference information. This alarm convergence matrix can then be used to analyze whether the device belongs to the root cause of the fault from multiple dimensions, thereby increasing the accuracy of obtaining alarm devices.

[0117] In step S105, if the alarm convergence matrix is ​​a non-zero matrix, then the device corresponding to the position of the non-zero element in the alarm convergence matrix is ​​determined as the alarm device.

[0118] In this embodiment, the alarm device is the root cause fault device that may cause the paralysis of the target area equipment. After obtaining the alarm convergence matrix, when the alarm convergence matrix is ​​a non-zero matrix, it can be understood that the root cause matrix of the fault has been captured. Therefore, the alarm device can be determined by the non-zero elements in the non-zero matrix.

[0119] Specifically, when the obtained alarm convergence matrix is ​​a non-zero matrix, the devices corresponding to the non-zero elements in the alarm convergence matrix can be used as alarm devices, which can accurately and quickly obtain alarm devices, improve the efficiency of alarm device identification, and thus improve the efficiency of equipment maintenance.

[0120] For example, suppose we construct a current matrix R corresponding to a target area using devices as elements. Suppose we can obtain an 88th-order sparse matrix. Suppose that when line 1 in the target area is interrupted, power is momentarily maintained by line 2 through the bus joint switch, allowing the service to continue operating normally. However, this still results in 437 alarms. Suppose the alarm threshold is 10. 437 is obviously greater than 10, indicating an alarm storm at this moment. Therefore, to avoid the congestion of the transmission channel caused by the alarm storm, and to enable maintenance personnel to obtain effective alarm information in a timely manner and accurately locate the alarming devices, thereby improving equipment maintenance efficiency and ensuring operational safety to a certain extent, an alarm convergence program can be started to converge the alarms. An alarm matrix A can be generated based on the alarms to exclude non-faulty devices, and a fault matrix F can be constructed by checking whether the operation of the measurement points is abnormal. The alarm matrix, fault matrix, and current matrix are then calculated to obtain the alarm convergence matrix, which is used to identify the final converged devices.

[0121] As shown in Table 1, the device corresponding to the element with a value of 1 in the transformation matrix T* indicates that the upstream device of that device did not generate an alarm, but the device itself generated an alarm. These alarms could be the root cause of the alarm storm. By obtaining the same elements in F and T*, and starting the alarm convergence procedure, the final converged device is identified as the alarm device, which is device 1. Assuming that during the convergence process, after releasing the alarms of the devices corresponding to elements 0 in the alarm matrix A, 5 alarm root causes are output, then out of 437 alarms, if there are 20 remaining alarms (unconverged alarms) and 412 converged alarms, the alarm convergence rate reaches 97.3%. This not only achieves good convergence results but also allows maintenance personnel to quickly locate faults based on device 1, thereby maintaining operational safety.

[0122]

[0123] Table 1

[0124] For example, suppose that power is restored to line 1 in a target area after an outage, and a total of 3569 alarms are generated. Assume the alarm threshold is 10, as shown in Table 2. Assume that when the total number of alarms exceeds the alarm threshold, an alarm convergence procedure is initiated to perform alarm convergence and generate a fault matrix F based on the status information of the measurement points. Assume that during the power restoration process of line 1, as shown in Table 2, the alarm devices identified are devices 5, 7, and 8. Assume that during the convergence process, the alarms corresponding to the devices with elements 0 in the alarm matrix are released. Ultimately, 30 root causes of the alarms are located, resulting in 3321 converged alarms and 218 non-converged alarms, achieving a convergence rate of 93%.

[0125]

[0126] Table 2

[0127] In this application embodiment, a method for determining alarm devices is provided. This method involves constructing a current matrix with devices within a target area as elements, an alarm matrix based on device status information, and a fault matrix based on measurement point status information. The alarm convergence matrix is ​​then determined by combining the current matrix, alarm matrix, and fault matrix. This enhances the correlation between devices and increases the dimensions of reference information for determining alarm devices. Alarm devices are then identified through elements in the alarm convergence matrix, improving the accuracy of alarm device acquisition. This eliminates the need for extensive manpower for device fault diagnosis, increasing the efficiency of alarm device acquisition and ultimately improving equipment maintenance efficiency.

[0128] Optionally, in the above Figure 2 Based on the corresponding embodiments, in another optional embodiment of the alarm device determination method provided in this application, such as... Figure 3 As shown, the method also includes:

[0129] In step S301, the causal network relationship corresponding to the target area is obtained. The causal network relationship includes K nodes and Q directed edges. Each node corresponds to a device, and each directed edge is used to connect two devices. Q is an integer greater than or equal to 1.

[0130] In step S302, based on the causal network relationship, the element values ​​corresponding to any two devices among the K devices in the K*K matrix are determined;

[0131] In step S303, a current matrix is ​​generated based on the element values ​​of any two devices among the K devices in the K*K matrix.

[0132] In this embodiment, the causal network relationship is obtained by transforming the electrical wiring diagram of the equipment in the target area based on the causal network. This relationship can be used to represent the logical relationships between devices. The causal network is based on the Granger causal network and consists of fault nodes, circuit breaker nodes, and protection device nodes, such as... Figure 15 As shown, devices can be transformed into nodes, and then nodes can be connected by directed edges. The logical relationships between devices can be expressed through directed edges based on causal networks, that is, each directed edge corresponds to a logical relationship.

[0133] Therefore, after obtaining the causal network relationship corresponding to the target area, a current network can be introduced to construct a current matrix. The causal network relationship corresponding to this current network is also a network relationship composed of devices through which current flows as nodes. Therefore, a current matrix can be constructed based on the causal network relationship. According to the preset definition of the current matrix, a K-order binary matrix is ​​constructed with the number of devices in the current network as the order and the current flow direction as the element. This current matrix can be used to enhance the correlation between devices in the target area and clearly describe the logical relationship between each device, so that further fault reasoning can be performed on the current matrix, thereby accurately obtaining alarm devices.

[0134] Specifically, before obtaining the alarm convergence matrix, a current matrix can be constructed by obtaining the causal network relationship of the target area. The number of devices in the current network is the order and the current flow direction is the element. Specifically, according to the obtained causal network relationship, the K devices are divided according to the preset definition of the current matrix, and the element values ​​of any two devices in the K*K matrix are obtained, thus obtaining the K-order current matrix.

[0135] Optionally, in the above Figure 3 Based on the corresponding embodiments, in another optional embodiment of the alarm device determination method provided in this application, such as... Figure 4 As shown, based on the causal network relationship, determine the element values ​​corresponding to any two devices among the K devices in the K*K matrix, including:

[0136] In step S401, if the i-th device and the j-th device among the K devices satisfy a non-causal relationship, then the element in the i-th row and j-th column of the K*K matrix is ​​determined as the first element, where i and j are both integers greater than or equal to 1 and less than or equal to K.

[0137] In step S402, if the i-th device and the j-th device among the K devices satisfy a causal relationship, then the element in the i-th row and j-th column of the K*K matrix is ​​determined as the second element.

[0138] In this embodiment, the current matrix is ​​constructed as a K-order binary matrix, which can more clearly represent the logical relationship between devices. Therefore, the element values ​​in the current matrix can be represented by the first element and the second element. The element values ​​are preferably 0 and 1, but other element values ​​can also be used. No specific restrictions are imposed here.

[0139] Furthermore, since causal networks can be used to represent logical relationships between devices, see [reference needed]. Figure 15The logical relationship between devices can be specifically manifested as causal relationship and non-causal relationship, such as protection and support. Therefore, in order to further enhance the correlation between devices in the target area and to more accurately and clearly describe the logical relationship between each device, this embodiment can construct the current matrix by the definition in the following equation (2):

[0140]

[0141] Among them, the current matrix All diagonal elements are 1. , Indicates separation, and Current matrix The elements in the text are used to represent various electrical devices. k represents the number of electrical devices. This is used to indicate that the i-th device and the j-th device satisfy a causal relationship, specifically representing... Is it the cause The cause of the occurrence, It is by The result is indicated by "else", which means that the i-th device and the j-th device have a non-causal relationship.

[0142] For example, such as Figure 16 As shown, assuming a causal relationship exists between devices C2 and C3, see [reference needed]. Figure 15 As can be seen from the directed edges, device C3 is the cause of C2, and C2 is the result of C3. Therefore, the value of the element in the second row and third column can be set to 1.

[0143] Optionally, in the above Figure 3 Based on the corresponding embodiments, in another optional embodiment of the alarm device determination method provided in this application, such as... Figure 5 As shown, based on the causal network relationship, determine the element values ​​corresponding to any two devices among the K devices in the K*K matrix, including:

[0144] In step S501, if there is a current flowing between the i-th device and the j-th device among the K devices, then the element in the i-th row and j-th column of the K*K matrix is ​​determined as the first element;

[0145] In step S502, if there is no current flowing between the i-th device and the j-th device among the K devices, then the element in the i-th row and j-th column of the K*K matrix is ​​determined as the second element.

[0146] In this embodiment, since the rule matrix R in the causal network is derived from the belief network, the default Bayesian conditional probability between associated nodes is 1, which is perfectly suitable for the power system. However, it introduces a large number of expert rules in terms of convergence alarm content, which increases the workload of manual labor and is not generalizable. If fault location is carried out on the low-voltage side of the target area in the power system, it may lead to a decrease in location accuracy and poor alarm convergence effect. Therefore, this embodiment constructs a current matrix by introducing the current flow state to enhance the correlation between devices and thus better describe the logical relationship between each device. This embodiment can construct the current matrix by the definition in the following equation (3):

[0147]

[0148] Among them, the current matrix All diagonal elements are 1. and Current matrix The elements in k represents the number of electrical devices. This indicates that current flows from electrical device i to electrical device j, and else indicates that there is no current flow between the two electrical devices.

[0149] For example, such as Figure 16 As shown, assuming that there is a current flowing between devices C2 and C3, it can be understood that devices C2 and C3 have a strong correlation. Therefore, the element value in the second row and third column can be set to 1.

[0150] Optionally, in the above Figure 3 Based on the corresponding embodiments, in another optional embodiment of the alarm device determination method provided in this application, such as... Figure 6 As shown, the causal network relationships corresponding to the target region are obtained, including:

[0151] In step S601, the device wiring diagram corresponding to the target area is obtained;

[0152] In step S602, the K devices in the equipment wiring diagram are divided into nodes to obtain K nodes;

[0153] In step S603, any two nodes among the K nodes are connected by an edge to obtain a node connection graph;

[0154] In step S604, the directed edges in the node connection graph and the relationships between pairs of nodes are determined based on the causal network to obtain the causal network relationship.

[0155] In this embodiment, the causal network relationship corresponding to the target area can be obtained by converting the wiring diagram of the equipment in the target area based on the causal network. This can be used to intuitively reflect the logical relationship between the devices, so as to quickly and accurately construct a current matrix. Then, the faulty equipment can be analyzed and located through the current matrix, thereby improving the accuracy of obtaining alarm devices to a certain extent. The equipment wiring diagram can be represented as the electrical master wiring diagram in the target area. It can be provided by the construction team, obtained from a big data platform, or obtained through other means. No specific restrictions are imposed here.

[0156] For example, such as Figure 14 As shown in the diagram, in a wiring diagram, L represents a device fault, CB1 represents circuit breaker 1, MR1 represents main protection 1, BR1 represents backup protection 1, CB2 represents circuit breaker 2, MR2 represents main protection 2, and BR2 represents backup protection 2. Specifically, if a single-phase ground fault occurs on line L, such as due to a lightning strike, the protection devices MR1, MR2, BR1, and BR2 can sense a large ground current, which may exceed the protection device's setting. These protection devices will then operate and trip the circuit breakers CB1 or CB2 (such as high-voltage switches) on this line, thereby cutting off the power supplied to the line and reducing the impact on the power grid.

[0157] Furthermore, when equipment failure triggers a large number of alarms, creating an alarm storm, in order to effectively eliminate interfering information, intuitively reflect the connections between devices, and thus better identify the root cause device of the fault, such as... Figure 15 As shown, this embodiment can introduce node types. First, the obtained device wiring diagram is divided according to the preset node types. Then, the classified nodes are connected by edges to obtain a node connection diagram. Furthermore, the direction of each edge is determined through a causal network to obtain directed edges, and each directed edge corresponds to a logical relationship, so that the devices and the relationships between devices can be better presented in the topology diagram of the causal network relationship. The node types of general electrical systems can be divided into fault nodes, circuit breaker nodes, and protection device nodes. However, since there are many types of devices in the target area, in order to better reflect the relationships between devices, this embodiment sets the node types to device nodes, circuit breaker nodes, and protection nodes. Among them, device nodes represent devices in the target area that are configured with alarm policies, circuit breaker nodes represent the status of each circuit breaker, and the addition of protection nodes is determined by the alarm policies configured in the target area.

[0158] Furthermore, as shown in Table 3, after obtaining the causal network relationship, in order to construct the current matrix more accurately and quickly, this embodiment can convert the obtained causal network relationship into a list to obtain a node list containing nodes, node content, and node labels.

[0159]

[0160] Table 3

[0161] Optionally, in the above Figure 6 Based on the corresponding embodiments, in another optional embodiment of the alarm device determination method provided in this application, such as... Figure 7 As shown, the method also includes:

[0162] In step S701, the historical device wiring diagram corresponding to the target area is obtained;

[0163] In step S702, when the equipment wiring diagram is inconsistent with the historical equipment wiring diagram, the current matrix is ​​transposed to obtain the target current matrix.

[0164] Based on the alarm matrix, fault matrix, and current matrix, the alarm convergence matrix is ​​generated as follows:

[0165] In step S703, an alarm convergence matrix is ​​generated based on the alarm matrix, the fault matrix, and the target current matrix.

[0166] In this embodiment, the historical device wiring diagram is the wiring diagram obtained at the previous moment relative to the current device wiring diagram. Since the connection between devices changes when the device wiring diagram is inconsistent with the historical device wiring diagram, the logical relationship between devices may also change accordingly. In order to avoid repeatedly constructing the current matrix and to ensure that the current matrix can accurately reflect the logical relationship between devices, this embodiment can achieve this by transposing the current matrix.

[0167] Specifically, since the causal relationship between devices is mainly reflected by the current matrix R, the original causal relationship between devices will also be transformed with the transpose of the current matrix. Therefore, when the device wiring diagram is inconsistent with the historical device wiring diagram, the current matrix is ​​transposed to obtain the target current matrix. This can accurately obtain the current matrix after the logical relationship between devices changes, thereby realizing reverse reasoning between alarm signals and fault signals to a certain extent.

[0168] Optionally, in the above Figure 2 Based on the corresponding embodiments, in another optional embodiment of the alarm device determination method provided in this application, such as... Figure 8 As shown, the fault matrix is ​​a K*1 matrix, and the status information of the measurement points includes the equipment status; the fault matrix is ​​generated based on the status information of each measurement point in at least one measurement point, including:

[0169] In step S801, if the device status of the i-th device among the K devices is normal, then the element in the i-th row of the K*1 matrix is ​​determined as the first element;

[0170] In step S802, if the device status of the i-th device among the K devices is abnormal, then the element in the i-th row of the K*1 matrix is ​​determined as the second element;

[0171] In step S803, a fault matrix is ​​generated based on the element values ​​corresponding to the K devices in the K*1 matrix.

[0172] In this embodiment, since the fault matrix can be used to determine whether equipment fault data has been captured, the fault matrix can be determined by judging the operating status of the measuring points. The operating status of the measuring points can be represented by the current value flowing through the equipment and the state change of the circuit breaker on the line. Thus, the faulty equipment can be analyzed and located through the fault matrix. Therefore, the fault matrix can be constructed by the definition in the following equation (4):

[0173]

[0174] Where F(i) is column vectors, k represents the number of electrical devices, where This means that the current flowing through electrical device i is 0. This indicates a change in the circuit breaker's switching state, while else indicates that the current flowing through electrical device i is not zero.

[0175] For example, when the obtained measurement point status information is that the device status of device i is abnormal, specifically, the current flowing through device i is 0, and the current state of the circuit breaker connected to device i has changed from the closed state at the previous moment to the open state, the element in the i-th row of the K*1 matrix corresponding to device i can be set to 1.

[0176] Optionally, in the above Figure 8 Based on the corresponding embodiments, in another optional embodiment of the alarm device determination method provided in this application, such as... Figure 9 As shown, the method also includes:

[0177] In step S901, if the device load of each of the K devices meets the preset load conditions, the second element in the fault matrix is ​​changed to the first element to obtain the target fault matrix.

[0178] In step S902, if the load of any of the K devices does not meet the preset load conditions, the first element of the fault matrix of the device whose load does not meet the preset load conditions is changed to the second element to obtain the target fault matrix.

[0179] Based on the alarm matrix, fault matrix, and current matrix, the alarm convergence matrix is ​​generated as follows:

[0180] In step S903, an alarm convergence matrix is ​​generated based on the alarm matrix, the target fault matrix, and the current matrix.

[0181] In this embodiment, since the upstream device does not generate an alarm, but the current device itself generates an alarm, and these alarms may be the root cause of this alarm storm, in order to further locate the accurate alarm root cause device, this embodiment can determine the target fault matrix by measuring the device load of each device, such as current value, voltage or switch status, etc., which are not specifically limited.

[0182] Specifically, after obtaining the fault matrix, in order to further locate the accurate root cause device of the alarm, it is possible to determine whether the device load of each device meets the preset load conditions. When the device load of each of the K devices meets the preset load conditions, it means that the device load is normal, and the 1 in the fault matrix is ​​changed to 0. Alternatively, when the device load of any of the K devices does not meet the preset load conditions, it means that the device load of a device is abnormal, and the 0 in the fault matrix is ​​changed to 1, thereby obtaining the target fault matrix.

[0183] For example, such as Figure 17 As shown, assuming the data center uses a dual-circuit power supply, let the elements corresponding to AC power supply A and AC power supply B in the current matrix R be C1 and C2, respectively. When the current values ​​of AC power supply A and AC power supply B do not reach the normal value, the corresponding position in matrix F jumps from 0 to 1. Specifically, this can be represented as follows: Figure 17 The indicated a and Figure 17 The indicated value 'b' can be understood as the current value of device C1 or device C2 not reaching the normal value, thus changing 0 to 1; and Figure 17 The 'c' indicates that the current values ​​of devices C1 and C2 have reached the normal value, so 1 is changed to 0. The normal value can be set according to the load of each data center. Under the specific load power of the location, a current greater than 0 is considered a normal value.

[0184] Furthermore, since each moment in a time period can correspond to a fault matrix, it is possible to determine whether the fault matrix has changed by comparing the fault matrix at the current moment with the fault matrix at the previous moment. The change of the fault matrix is ​​mainly to avoid false alarm convergence. For example, suppose that when the mains power A circuit fails at a certain moment, and the line switches to mains power B circuit, and then B circuit fails again, then the alarm convergence program should converge to B circuit, and not to A circuit.

[0185] Optionally, in the above Figure 2 Based on the corresponding embodiments, in another optional embodiment of the alarm device determination method provided in this application, such as... Figure 10 As shown, the alarm matrix is ​​a K*1 matrix. The device status information includes the alarm status. The alarm matrix is ​​generated based on the status information of each device, including:

[0186] In step S1001, if the alarm status of the i-th device among the K devices is normal, then the element in the i-th row of the K*1 matrix is ​​determined as the first element;

[0187] In step S1002, if the alarm status of the i-th device among the K devices is abnormal, then the element in the i-th row of the K*1 matrix is ​​determined as the second element;

[0188] In step S1003, an alarm matrix is ​​generated based on the element values ​​corresponding to the K devices in the K*1 matrix.

[0189] In this embodiment, since the alarm matrix can be used for initial classification of alarms and plays an important role in systematic analysis of alarm sequences, the alarm matrix can be constructed using the definition in the following formula (5):

[0190]

[0191] Where A(i) is column vectors, Indicate the type of alarm. k represents the number of electrical devices. This indicates that electrical device i has generated an alarm message. This indicates that electrical equipment i is operating normally.

[0192] For example, when device C1 generates an alarm, the element value of that device in the first row of the K*1 matrix is ​​set to 1. Or, when device C2 is running normally and does not generate an alarm, the element value of that device in the second row of the K*1 matrix is ​​set to 1. Similarly, the elements of K devices in the K*1 matrix can be quickly determined, thereby accurately obtaining the corresponding alarm matrix.

[0193] Optionally, in the above Figure 2 Based on the corresponding embodiments, in another optional embodiment of the alarm device determination method provided in this application, such as... Figure 11 As shown, the method also includes:

[0194] In step S1101, the transfer matrix is ​​determined based on the current matrix and the alarm matrix;

[0195] Based on the alarm matrix, fault matrix, and current matrix, the alarm convergence matrix is ​​generated as follows:

[0196] In step S1102, each element in the transition matrix and the fault matrix is ​​ANDed to obtain the alarm convergence matrix.

[0197] In this embodiment, the transition matrix is ​​a matrix in which all elements are non-negative and the sum of the elements in each row equals 1. Each element is represented by a probability, and they transition between each other under certain conditions; hence, it is called a transition matrix. The transition matrix is ​​used to represent that in the transition of certain factors of a system, the result of the nth transition is only affected by the result of the (n-1)th transition, that is, it is only related to the current state and not to the past states. Therefore, the concept of state transition can be introduced. A state refers to the possible state or existence of an objective thing; state transition refers to the probability of an objective thing transitioning from one state to another.

[0198] Specifically, since the causal relationship between devices is mainly reflected by the current matrix R, and the original causal relationship between devices will also change with the change of the matrix, and the alarm matrix can be used to reflect whether the device generates an alarm, the transition matrix between the current matrix R and the alarm matrix A can be calculated to achieve the transition from alarm state to fault state, thereby realizing the reverse reasoning between alarm signal and fault signal to locate the faulty device. Specifically, the current matrix R and the alarm matrix A can be calculated using binary multiplication using the calculation formula (6) below, and a transition matrix T* can be obtained:

[0199]

[0200] Furthermore, after performing matrix transformation on the current matrix R and the alarm matrix A to obtain the transition matrix T*, the alarm convergence matrix b can be obtained by performing a logical AND operation between the fault matrix F and the transition matrix T*. Since faults can only occur at faulty device nodes, the elements corresponding to the faulty devices in the alarm convergence matrix b are all non-zero elements. Therefore, the devices corresponding to the non-zero elements in the non-zero matrix b can be identified as alarm devices.

[0201] Optionally, in the above Figure 2Based on the corresponding embodiments, in another optional embodiment of the alarm device determination method provided in this application, such as... Figure 12 As shown, the method also includes:

[0202] In step S1201, if the alarm convergence matrix is ​​a zero matrix, the elements to be updated in the alarm matrix are determined according to the mapping relationship between the fault matrix and the alarm matrix.

[0203] In step S1202, the element value of the element to be updated is updated to the first element to obtain the updated target alarm matrix;

[0204] In step S1203, the alarms of the device corresponding to the first element in the target alarm matrix are released to obtain the total number of alarms converged.

[0205] In this embodiment, if the alarm convergence matrix b is a zero matrix, it can be understood that the current data acquisition system has not captured the status information of the measurement points containing operational anomalies, or that the equipment has generated false alarms, such as alarms generated by non-faults such as mains power changes or transformer shutdown for maintenance. This can easily cause the alarm convergence program to converge to false alarms, leading to mislocation of faulty equipment and affecting equipment maintenance. Since alarm convergence requires convergence to at least one alarm, this embodiment releases alarms to reduce false convergence and false alarms. Specifically, this can be manifested as not converging alarms generated by devices corresponding to elements with an alarm matrix of 0, or releasing alarms when the collected alarms are not in the alarm cluster, i.e., alarm types. The alarm can be output and displayed directly, or it can take other forms of presentation; no specific restrictions are made here.

[0206] Specifically, when the alarm convergence matrix is ​​a zero matrix, in order to reduce false convergence, this embodiment first determines the element position of the element to be updated in the alarm matrix according to the mapping relationship between the fault matrix and the alarm matrix. Then, the element to be updated at the position is set to 0, that is, A(i)=F(i)=0. For example, when the element in the i-th row of the K*1 fault matrix is ​​0, the element in the i-th row of the K*1 alarm matrix that is the same as the element in the fault matrix and the alarm matrix can be found according to the mapping relationship between the fault matrix and the alarm matrix. This element is determined as the element to be updated and set to 0. Then, by not converging the alarm generated by the device corresponding to the element to be updated, the false convergence of false alarms is avoided, thereby improving the alarm convergence effect.

[0207] For example, suppose the root cause device of the alarm is located more than one, causing the final convergence result to fail to pinpoint the root cause device. This is because, for instance, restoring power to line 1 does not typically trigger an alarm in the system, as power restoration is generally not considered a fault. Furthermore, the alarm system in the target area usually does not configure alarm strategies for non-fault states such as line restoration. This leads to situations where the data acquisition system's acquisition frequency is too low to capture the instantaneous abnormal state of the measurement point, such as a current of 0, causing irrelevant alarms, such as non-fault alarms, to be triggered by the convergence program. Therefore, to reduce false convergence, when a certain position in the fault matrix F is 0, the corresponding position in the alarm matrix can be forced to 0, and the alarms stored therein can be released, preventing them from being converged and thus improving the accuracy of alarm convergence.

[0208] Optionally, in the above Figure 2 Based on the corresponding embodiments, in another optional embodiment of the alarm device determination method provided in this application, such as... Figure 13 As shown, the method also includes:

[0209] In step S1301, if the total number of alarms at the first moment is greater than the preset first alarm threshold, and the alarm index at the second moment is the first index, then the alarm index at the first moment is set to the second index, wherein the second moment is the moment immediately preceding the first moment.

[0210] In step S1302, if the total number of alarms at the first moment is less than the preset second alarm threshold, and the alarm index at the second moment is the second index, then the alarm index at the first moment is set to the first index, wherein the second alarm threshold is greater than the first alarm threshold.

[0211] In step S1303, if the total number of alarms at the first moment is less than or equal to the first alarm threshold and greater than or equal to the second alarm threshold, then the alarm index at the first moment is set to the alarm index at the second moment.

[0212] In step S1304, the alarm level at the first moment is determined based on the alarm index.

[0213] In this embodiment, since there is no clear definition of alarm storm in the field of information construction, alarms can be handled better. This embodiment can adopt the industry definition of alarm storm to quickly and accurately determine whether an alarm storm has occurred in the target area. According to the International Society of Automation (ISA) standard 18.2: "An alarm storm is a situation where the alarm generation rate is greater than the effective management by the manager (the number of alarms exceeds 10 / 10 minutes)".

[0214] Therefore, based on the above time standard, two alarm thresholds can be defined, namely the first alarm threshold. and the second alarm threshold The first alarm threshold is greater than the second alarm threshold to obtain the alarm index that changes over time. The alarm index is then used to determine whether an alarm storm has occurred in the target area at the current moment. Specifically, the alarm index can be obtained through the definition in the following formula (7):

[0215]

[0216] in, as well as Used to indicate the preset alarm threshold. This represents the number of alarms at time t. for The alarm index at the previous moment, else indicates that the total number of alarms at the first moment is less than or equal to the first alarm threshold and greater than or equal to the second alarm threshold.

[0217] Among them, the first alarm threshold It is usually set to 10, and a second alarm threshold. It is usually set to 5.

[0218] For example, a data center experienced a power outage at 15:18 on May 20, 2020, and power was restored via mains circuit A at 20:14. This data center uses a dual-circuit power supply. Assuming the total number of alarms at 15:18 is 300, significantly exceeding the preset first alarm threshold of 10, and the alarm index at 15:17 is 0, then the alarm index at the first moment is set to 1. This indicates that alarms generated at that moment will create an alarm storm. Alternatively, assuming the alarms at 15:18... If the total number of alarms is 2, which is less than the preset second alarm threshold of 5, and the alarm index at the second time 15:17 is 1, then the alarm index at the first time is set to 0, which indicates that the alarms generated at that time will not generate an alarm storm. Alternatively, if the total number of alarms at the first time 15:18 is 8, which is greater than the preset second alarm threshold of 5 and less than the preset first alarm threshold of 10, then the alarm index at the first time is set to the alarm index at the second time 15:17, which indicates that the alarms generated at that time will not generate an alarm storm.

[0219] It should be noted that this alarm index can also be used to determine the start and end of the alarm convergence process. Specifically, it can be achieved by adjusting the initial... Set it to 0, and the convergence time window is generally T=10min=600s.

[0220] Furthermore, when the alarm converges at a certain time... At the beginning, The following conditions must be met: This indicates that the number of alarms exceeds the first alarm threshold. =10.

[0221] And, when the alarm converges at time At the end, The following conditions must be met: This indicates that the number of alarms is below the second alarm threshold. =5.

[0222] The alarm device determining apparatus in this application is described in detail below. Please refer to [link / reference]. Figure 18 , Figure 12 This is a schematic diagram of one embodiment of the alarm device determination device in this application. The alarm device determination device 20 includes:

[0223] The acquisition unit 201 is used to acquire the device monitoring data corresponding to the target area. The target area includes K devices. The device monitoring data includes the total number of alarms of the K devices, the status information of each of the K devices, and the status information of each of at least one measurement point. K is an integer greater than 1.

[0224] The generation unit 202 is used to generate an alarm matrix based on the status information of each device if the total number of alarms of K devices is greater than or equal to the alarm threshold.

[0225] The generation unit 202 is also configured to generate a fault matrix based on the state information of each measurement point in at least one measurement point;

[0226] The generation unit 202 is also used to generate an alarm convergence matrix based on the alarm matrix, fault matrix and current matrix. The current matrix is ​​used to represent the causal network relationship between K devices. The causal network relationship represents the logical relationship between any two devices among the K devices. The current matrix consists of K elements, and there is a one-to-one correspondence between the K elements and the K devices.

[0227] The determining unit 203 is used to determine the device corresponding to the position of the non-zero element in the alarm convergence matrix as the alarm device if the alarm convergence matrix is ​​a non-zero matrix.

[0228] Optionally, in the above Figure 18 Based on the corresponding embodiments, in another embodiment of the alarm device determination apparatus provided in this application,

[0229] The acquisition unit 201 is also used to acquire the causal network relationship corresponding to the target area, wherein the causal network relationship includes K nodes and Q directed edges, each node corresponds to a device, each directed edge is used to connect two devices, and Q is an integer greater than or equal to 1.

[0230] The determining unit 203 is also used to determine the element values ​​corresponding to any two devices in the K*K matrix based on the causal network relationship;

[0231] The generation unit 202 is also used to generate a current matrix based on the element values ​​of any two devices in the K*K matrix.

[0232] Optionally, in the above Figure 18 Based on the corresponding embodiments, in another embodiment of the alarm device determining apparatus provided in this application, the determining unit 203 is specifically used for:

[0233] If the i-th device and the j-th device among the K devices satisfy a non-causal relationship, then the element in the i-th row and j-th column of the K*K matrix is ​​determined as the first element, where i and j are both integers greater than or equal to 1 and less than or equal to K;

[0234] If the i-th device and the j-th device among the K devices satisfy a causal relationship, then the element in the i-th row and j-th column of the K*K matrix is ​​determined as the second element.

[0235] Optionally, in the above Figure 18 Based on the corresponding embodiments, in another embodiment of the alarm device determining apparatus provided in this application, the determining unit 203 is specifically used for:

[0236] If there is a current flowing between the i-th device and the j-th device among the K devices, then the element in the i-th row and j-th column of the K*K matrix is ​​determined as the first element;

[0237] If there is no current flowing between the i-th device and the j-th device among the K devices, then the element in the i-th row and j-th column of the K*K matrix is ​​determined as the second element.

[0238] Optionally, in the above Figure 18 Based on the corresponding embodiments, in another embodiment of the alarm device determination apparatus provided in this application,

[0239] The acquisition unit 201 is also used to acquire the device wiring diagram corresponding to the target area;

[0240] Processing unit 204 is used to divide the K devices in the equipment wiring diagram into nodes to obtain K nodes;

[0241] Processing unit 204 is also used to connect any two nodes among the K nodes with an edge to obtain a node connection graph.

[0242] The processing unit 204 is also used to determine the directed edges in the node connection graph and the relationships between pairs of nodes based on the causal network, so as to obtain the causal network relationship.

[0243] Optionally, in the above Figure 18 Based on the corresponding embodiments, in another embodiment of the alarm device determination apparatus provided in this application,

[0244] The acquisition unit 201 is also used to acquire the historical device wiring diagram corresponding to the target area;

[0245] The processing unit 204 is also used to transpose the current matrix to obtain the target current matrix when the equipment wiring diagram is inconsistent with the historical equipment wiring diagram;

[0246] The generation unit 202 is specifically used to generate an alarm convergence matrix based on the alarm matrix, the fault matrix, and the target current matrix.

[0247] Optionally, in the above Figure 18 Based on the corresponding embodiments, in another embodiment of the alarm device determination apparatus provided in this application, the generation unit 202 is specifically used for:

[0248] If the device status of the i-th device among the K devices is normal, then the element in the i-th row of the K*1 matrix is ​​determined as the first element;

[0249] If the device status of the i-th device among the K devices is abnormal, then the element in the i-th row of the K*1 matrix is ​​determined as the second element;

[0250] A fault matrix is ​​generated based on the element values ​​of the K devices in the K*1 matrix.

[0251] Optionally, in the above Figure 18 Based on the corresponding embodiments, in another embodiment of the alarm device determination apparatus provided in this application,

[0252] The processing unit 204 is also used to change the second element in the fault matrix to the first element if the equipment load of each of the K devices meets the preset load conditions, so as to obtain the target fault matrix.

[0253] The processing unit 204 is further configured to, if the equipment load of any of the K devices does not meet the preset load conditions, change the first element of the device that does not meet the preset load conditions in the fault matrix to the second element, so as to obtain the target fault matrix.

[0254] The generation unit 202 is specifically used to generate an alarm convergence matrix based on the alarm matrix, the target fault matrix, and the current matrix.

[0255] Optionally, in the above Figure 18 Based on the corresponding embodiments, in another embodiment of the alarm device determination apparatus provided in this application, the generation unit 202 is specifically used for:

[0256] If the alarm status of the i-th device among the K devices is normal, then the element in the i-th row of the K*1 matrix is ​​determined as the first element;

[0257] If the alarm status of the i-th device among the K devices is abnormal, then the element in the i-th row of the K*1 matrix is ​​determined as the second element;

[0258] An alarm matrix is ​​generated based on the element values ​​of the K devices in the K*1 matrix.

[0259] Optionally, in the above Figure 18 Based on the corresponding embodiments, in another embodiment of the alarm device determination apparatus provided in this application,

[0260] The determining unit 203 is also used to determine the element to be updated in the alarm matrix according to the mapping relationship between the fault matrix and the alarm matrix if the alarm convergence matrix is ​​a zero matrix;

[0261] The processing unit 204 is also used to update the element value of the element to be updated to the first element, so as to obtain the updated target alarm matrix;

[0262] The processing unit 204 is also used to release the alarms of the device corresponding to the first element in the target alarm matrix, so as to obtain the total number of alarm convergences.

[0263] Optionally, in the above Figure 18 Based on the corresponding embodiments, in another embodiment of the alarm device determination apparatus provided in this application,

[0264] The determining unit 203 is also used to determine the transfer matrix based on the current matrix and the alarm matrix;

[0265] The generation unit 202 is specifically used to perform a bitwise AND operation on each element in the transition matrix and the fault matrix to obtain the alarm convergence matrix.

[0266] Optionally, in the above Figure 18 Based on the corresponding embodiments, in another embodiment of the alarm device determination apparatus provided in this application,

[0267] The processing unit 204 is further configured to set the alarm index of the first time to the second index if the total number of alarms at the first time is greater than the preset first alarm threshold and the alarm index at the second time is the first index, wherein the second time is the time immediately preceding the first time.

[0268] The processing unit 204 is further configured to set the alarm index at the first moment to the first index if the total number of alarms at the first moment is less than a preset second alarm threshold and the alarm index at the second moment is the second index, wherein the second alarm threshold is greater than the first alarm threshold.

[0269] The processing unit 204 is further configured to set the alarm index at the first moment to the alarm index at the second moment if the total number of alarms at the first moment is less than or equal to the first alarm threshold and greater than or equal to the second alarm threshold.

[0270] The determination unit 203 is also used to determine the alarm level at the first moment based on the alarm index.

[0271] This application also provides a schematic diagram of another computer device, such as... Figure 19 As shown, Figure 19 This is a schematic diagram of a computer device structure provided in an embodiment of this application. The computer device 300 can vary significantly due to different configurations or performance. It may include one or more central processing units (CPUs) 310 (e.g., one or more processors) and a memory 320, and one or more storage media 330 (e.g., one or more mass storage devices) for storing application programs 331 or data 332. The memory 320 and storage media 330 can be temporary or persistent storage. The program stored in the storage media 330 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the computer device 300. Furthermore, the CPU 310 may be configured to communicate with the storage media 330 and execute the series of instruction operations in the storage media 330 on the computer device 300.

[0272] Computer device 300 may also include one or more power supplies 340, one or more wired or wireless network interfaces 350, one or more input / output interfaces 360, and / or one or more operating systems 333, such as Windows Server. TM Mac OS X TM Unix TM Linux TM FreeBSD TM etc.

[0273] The aforementioned computer device 300 is also used to perform, for example Figures 2 to 13 The steps in the corresponding embodiments.

[0274] Another aspect of this application provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform actions such as... Figures 2 to 13 The steps in the method described in the illustrated embodiment.

[0275] Another aspect of this application provides a computer program product containing instructions that, when run on a computer or processor, cause the computer or processor to perform actions such as Figures 2 to 13 The steps in the method described in the illustrated embodiment.

[0276] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0277] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0278] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0279] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0280] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A method of determining an alarm device, characterized by, include: Acquire device monitoring data corresponding to the target area, wherein the target area includes the K devices, the device monitoring data includes the total number of alarms of the K devices, the status information of each of the K devices, and the status information of each of at least one measurement point, wherein K is an integer greater than 1, the device status information includes the alarms of each device, the alarm type, alarm location, alarm content, and alarm time of each alarm, and the status information of the measurement points includes whether the measurement point is normal, whether the measurement point is abnormal, and the device load of each device; If the total number of alarms from the K devices is greater than or equal to the alarm threshold, then an alarm matrix is ​​generated based on the status information of each device. A fault matrix is ​​generated based on the status information of each measurement point in the at least one measurement point; An alarm convergence matrix is ​​generated based on the alarm matrix, the fault matrix, and the current matrix. The current matrix is ​​used to represent the causal network relationship between the K devices. The causal network relationship represents the logical relationship between any two of the K devices. The current matrix consists of K elements, and there is a one-to-one correspondence between the K elements and the K devices. If the alarm convergence matrix is ​​a non-zero matrix, then the device corresponding to the position of the non-zero element in the alarm convergence matrix is ​​determined as the alarm device. The current matrix is ​​generated as follows: Obtain the causal network relationship corresponding to the target region, wherein the causal network relationship includes K nodes and Q directed edges, each node corresponds to a device, each directed edge is used to connect two devices, and Q is an integer greater than or equal to 1; Based on the causal network relationship, determine the element values ​​corresponding to any two devices among the K devices in the K*K matrix, including: if there is a current flowing between the i-th device and the j-th device among the K devices, then the element in the i-th row and j-th column of the K*K matrix is ​​determined as the first element; if there is no current flowing between the i-th device and the j-th device among the K devices, then the element in the i-th row and j-th column of the K*K matrix is ​​determined as the second element. The current matrix is ​​generated based on the element values ​​of any two devices among the K devices in the K*K matrix.

2. The method of claim 1, wherein, The step of determining the element values ​​corresponding to any two devices among the K devices in the K*K matrix based on the causal network relationship includes: If the i-th device and the j-th device among the K devices satisfy a non-causal relationship, then the element in the i-th row and j-th column of the K*K matrix is ​​determined as the first element, where i and j are both integers greater than or equal to 1 and less than or equal to K; If the i-th device and the j-th device among the K devices satisfy a causal relationship, then the element in the i-th row and j-th column of the K*K matrix is ​​determined as the second element.

3. The method according to claim 1, characterized in that, The acquisition of the causal network relationship corresponding to the target region includes: Obtain the device wiring diagram corresponding to the target area; The K devices in the device wiring diagram are divided into nodes to obtain the K nodes; Connect any two nodes among the K nodes with an edge to obtain a node connection graph; The directed edges in the node connection graph and the relationships between pairs of nodes are determined based on the causal network to obtain the causal network relationship.

4. The method according to claim 3, characterized in that, Before generating the alarm convergence matrix based on the alarm matrix, the fault matrix, and the current matrix, the method further includes: Obtain the historical device wiring diagram corresponding to the target area; When the device wiring diagram is inconsistent with the historical device wiring diagram, the current matrix is ​​transposed to obtain the target current matrix; The step of generating the alarm convergence matrix based on the alarm matrix, the fault matrix, and the current matrix includes: The alarm convergence matrix is ​​generated based on the alarm matrix, the fault matrix, and the target current matrix.

5. The method according to claim 1, characterized in that, The fault matrix is ​​a K*1 matrix, and the status information of the measurement points includes the equipment status. The step of generating a fault matrix based on the state information of each of the at least one measurement point includes: If the device status of the i-th device among the K devices is normal, then the element in the i-th row of the K*1 matrix is ​​determined as the first element; If the device status of the i-th device among the K devices is abnormal, then the element in the i-th row of the K*1 matrix is ​​determined as the second element; The fault matrix is ​​generated based on the element values ​​corresponding to the K devices in the K*1 matrix.

6. The method according to claim 5, characterized in that, The status information of the measurement points includes the device load. Before generating the alarm convergence matrix based on the alarm matrix, the fault matrix, and the current matrix, the method further includes: If the device load of each of the K devices meets the preset load conditions, then the second element in the fault matrix is ​​changed to the first element to obtain the target fault matrix; If the load of any of the K devices does not meet the preset load condition, then the device whose load does not meet the preset load condition is changed from the first element to the second element in the fault matrix to obtain the target fault matrix. The step of generating the alarm convergence matrix based on the alarm matrix, the fault matrix, and the current matrix includes: The alarm convergence matrix is ​​generated based on the alarm matrix, the target fault matrix, and the current matrix.

7. The method according to claim 1, characterized in that, The alarm matrix is ​​a K*1 matrix, and the device status information includes alarm status. Generating the alarm matrix based on the status information of each device includes: If the alarm status of the i-th device among the K devices is normal, then the element in the i-th row of the K*1 matrix is ​​determined as the first element; If the alarm status of the i-th device among the K devices is abnormal, then the element in the i-th row of the K*1 matrix is ​​determined as the second element; The alarm matrix is ​​generated based on the element values ​​corresponding to the K devices in the K*1 matrix.

8. The method according to claim 1, characterized in that, Before generating the alarm convergence matrix based on the alarm matrix, the fault matrix, and the current matrix, the method further includes: The transition matrix is ​​determined based on the current matrix and the alarm matrix; The step of generating the alarm convergence matrix based on the alarm matrix, the fault matrix, and the current matrix includes: The alarm convergence matrix is ​​obtained by performing a bitwise AND operation on each element of the transition matrix and the fault matrix.

9. The method according to claim 1, characterized in that, After generating the alarm convergence matrix based on the alarm matrix, the fault matrix, and the current matrix, the method further includes: If the alarm convergence matrix is ​​a zero matrix, then the elements to be updated in the alarm matrix are determined according to the mapping relationship between the fault matrix and the alarm matrix; The element value of the element to be updated is updated to the first element to obtain the updated target alarm matrix; Release the alarms of the device corresponding to the first element in the target alarm matrix to obtain the total number of alarms converged.

10. The method according to claim 1, characterized in that, Before generating an alarm matrix based on the status information of each device if the total number of alarms from the K devices is greater than or equal to the alarm threshold, the method further includes: If the total number of alarms at the first moment is greater than the preset first alarm threshold, and the alarm index at the second moment is the first index, then the alarm index at the first moment is set to the second index, wherein the second moment is the moment immediately preceding the first moment. If the total number of alarms at the first moment is less than the preset second alarm threshold, and the alarm index at the second moment is the second index, then the alarm index at the first moment is set to the first index, wherein the second alarm threshold is greater than the first alarm threshold. If the total number of alarms at the first moment is less than or equal to the first alarm threshold and greater than or equal to the second alarm threshold, then the alarm index at the first moment is set as the alarm index at the second moment. The alarm level at the first moment is determined based on the alarm index.

11. A device for determining an alarm device, characterized in that, include: An acquisition unit is used to acquire device monitoring data corresponding to a target area, wherein the target area includes the K devices, the device monitoring data includes the total number of alarms of the K devices, the status information of each of the K devices, and the status information of each of at least one measurement point, wherein K is an integer greater than 1, the device status information includes the alarms of each device, the alarm type, alarm location, alarm content, and alarm time of each alarm, and the status information of the measurement points includes whether the measurement point is normal, whether the measurement point is abnormal, and the device load of each device; The generation unit is used to generate an alarm matrix based on the status information of each device if the total number of alarms of the K devices is greater than or equal to the alarm threshold. The generation unit is further configured to generate a fault matrix based on the state information of each measurement point among the at least one measurement point; The generation unit is further configured to generate an alarm convergence matrix based on the alarm matrix, the fault matrix, and the current matrix, wherein the current matrix is ​​used to represent the causal network relationship between the K devices, the causal network relationship represents the logical relationship between any two devices among the K devices, and the current matrix consists of K elements, with a one-to-one correspondence between the K elements and the K devices; The determining unit is used to determine the device corresponding to the position of the non-zero element in the alarm convergence matrix as an alarm device if the alarm convergence matrix is ​​a non-zero matrix. The current matrix is ​​generated as follows: Obtain the causal network relationship corresponding to the target region, wherein the causal network relationship includes K nodes and Q directed edges, each node corresponds to a device, each directed edge is used to connect two devices, and Q is an integer greater than or equal to 1; Based on the causal network relationship, determine the element values ​​corresponding to any two devices among the K devices in the K*K matrix, including: if there is a current flowing between the i-th device and the j-th device among the K devices, then the element in the i-th row and j-th column of the K*K matrix is ​​determined as the first element; if there is no current flowing between the i-th device and the j-th device among the K devices, then the element in the i-th row and j-th column of the K*K matrix is ​​determined as the second element. The current matrix is ​​generated based on the element values ​​of any two devices among the K devices in the K*K matrix.

12. A computer device, characterized in that, include: Memory, transceiver, processor, and bus system; The memory is used to store programs; When the processor executes a program in the memory, it implements the method as described in any one of claims 1 to 10; The bus system is used to connect the memory and the processor to enable communication between the memory and the processor.

13. A computer-readable storage medium comprising instructions which, when executed on a computer, cause the computer to perform the method as claimed in any one of claims 1 to 10.

14. A computer program product, characterized in that, The computer program product includes computer instructions, which are executed by a processor of a computer device to cause the computer device to perform the method of any one of claims 1 to 10.

Images