Alarm method and device, storage medium and electronic equipment

Abstract

The present disclosure relates to an alarm method, device, storage medium and electronic equipment, the alarm method comprising: determining a first offset degree of a current index value of a target index relative to a value in a preset target threshold interval; determining a second offset degree of the current index value of the target index according to a distance between the current index value of the target index and a plurality of historical index values of the target index; obtaining a target offset degree corresponding to the current index value of the target index according to the first offset degree and the second offset degree; and determining that the current index value of the target index is abnormal and performing alarm if the target offset degree is greater than or equal to an offset degree threshold corresponding to the target index. Compared with the scheme of alarm discrimination based on a single set of fixed threshold interval, the present technical scheme has higher alarm accuracy and lower false negative rate.

Description

Technical Field

[0001] This disclosure relates to the field of operation and maintenance management technology, and more specifically, to an alarm method, device, storage medium, and electronic device. Background Technology

[0002] Alarms are a fundamental and crucial aspect of daily operations and maintenance management. Currently, common alarm solutions primarily rely on fixed or dynamic threshold ranges to monitor various metrics in the business system in real time. When a metric value exceeds a set threshold range, an alarm is promptly sent to operations and maintenance personnel. However, alarm solutions based on fixed threshold ranges can only rely on the set fixed threshold range for alarm detection, resulting in a relatively high false negative rate. Summary of the Invention

[0003] The purpose of this disclosure is to provide an alarm method, apparatus, storage medium, and electronic device to solve the aforementioned technical problems.

[0004] To achieve the above objectives, this disclosure provides an alarm method, including:

[0005] Determine the first offset of the current value of the target indicator relative to a value within a preset target threshold range;

[0006] Based on the distance between the current value of the target indicator and multiple historical values ​​of the target indicator, a second offset of the current value of the target indicator is determined;

[0007] Based on the first offset and the second offset, the target offset corresponding to the current value of the target indicator is obtained;

[0008] If the target offset is greater than or equal to the offset threshold corresponding to the target indicator, the current indicator value of the target indicator is determined to be abnormal and an alarm is issued.

[0009] Optionally, determining the first offset of the current value of the target indicator relative to a value within a preset target threshold range includes:

[0010] Obtain the preset target threshold range for the target indicator;

[0011] Determine the difference between the current value of the target indicator and the mean of the target threshold interval, as well as the interval width of the target threshold interval;

[0012] Determine the ratio of the difference to the interval width value, and obtain the first offset corresponding to the current index value of the target index based on the ratio.

[0013] Optionally, determining the second offset of the current value of the target indicator based on the distance between the current value of the target indicator and multiple historical values ​​of the target indicator includes:

[0014] Based on the periodic change characteristics of the target indicator, obtain multiple historical indicator values ​​corresponding to different time points in the previous period for the target indicator.

[0015] Based on the mean and standard deviation of the multiple historical indicator values, the current indicator value of the target indicator is standardized, and the second offset corresponding to the current indicator value of the target indicator is obtained based on the standardization result.

[0016] Optionally, the average value corresponding to the plurality of historical indicator values ​​is obtained in the following way:

[0017] Calculate the weighted average of the multiple historical indicator values ​​based on each historical indicator value and the weighting coefficient corresponding to the historical indicator value;

[0018] The weighting coefficient corresponding to each historical indicator value is calculated using the following formula;

[0019]

[0020] f(t) is the weighting coefficient, t0 is the end time of the previous period, t is the time point corresponding to the historical index value, T is the time length of the previous period, and δ is the step function.

[0021] Optionally, obtaining the target offset corresponding to the current indicator value of the target indicator based on the first offset and the second offset includes:

[0022] Based on the target model, determine the weighting weight and the offset threshold corresponding to the target indicator;

[0023] The first offset and the second offset are weighted according to the weighting weight to obtain the target offset corresponding to the current index value of the target index.

[0024] Optionally, the target model is trained through the following process:

[0025] Obtain a training sample set, wherein each training sample in the training sample set includes the indicator value of the target indicator at a point in time, and includes at least one of the mean, maximum and minimum values ​​of multiple historical indicator values ​​of the target indicator in the previous period at that point in time.

[0026] A base learner is determined as the model to be trained, and the weighting weights and offset thresholds in the model to be trained are initialized.

[0027] The model to be trained is trained according to the training sample set; wherein the model to be trained is used to predict the target offset corresponding to the indicator value of the target indicator in the training sample based on the weighted weights and the input training sample, and output a prediction result on whether the indicator value of the target indicator is abnormal based on the offset threshold and the predicted target offset.

[0028] The residuals of the model to be trained are fitted using another base learner, and the base learner is superimposed on the model to be trained to obtain a new model to be trained.

[0029] Based on the new model to be trained, return to the step of training the model to be trained based on the training sample set until the training stopping condition is met, and finally determine the final model to be trained as the target model.

[0030] Optionally, the method further includes: determining the influence relationship between various indicators in the business system; after determining that the current indicator value of the target indicator is abnormal, determining the related indicators affected by the target indicator according to the influence relationship, and reducing the offset threshold corresponding to the related indicators.

[0031] Optionally, before determining the first offset of the current value of the target indicator relative to a value within a preset target threshold range, the method further includes: determining that the current value of the target indicator is within the target threshold range.

[0032] This disclosure also provides an alarm device, including:

[0033] The first offset determination module is used to determine the first offset of the current value of the target indicator relative to a value within a preset target threshold range.

[0034] The second offset determination module is used to determine the second offset of the current indicator value of the target indicator based on the distance between the current indicator value of the target indicator and multiple historical indicator values ​​of the target indicator.

[0035] The target offset determination module is used to obtain the target offset corresponding to the current index value of the target index based on the first offset and the second offset;

[0036] The alarm determination module is used to determine that the current value of the target indicator is abnormal and issue an alarm if the target offset is greater than or equal to the offset threshold corresponding to the target indicator.

[0037] This disclosure also provides a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the steps of the aforementioned alarm method.

[0038] This disclosure also provides an electronic device, including:

[0039] A memory on which computer programs are stored;

[0040] A processor is configured to execute the computer program in the memory to implement the steps of the aforementioned alarm method.

[0041] The alarm method provided in this disclosure proposes alarm discrimination based on offset. On one hand, a first offset is used to represent the degree of deviation of the current value of a target indicator relative to a fixed target threshold range, where the target threshold range can be preset based on human experience. On the other hand, a second offset is used to represent the degree of deviation of the current value of the target indicator relative to its historical data. The target offset is then obtained by comprehensively considering the influence of human experience and the historical data of the target indicator. Therefore, the target offset can accurately reflect the degree of deviation of the current value of the target indicator relative to its normal state. Ultimately, it can accurately determine whether the current value of the target indicator is abnormal based on the target offset, and thus issue an alarm. Compared to schemes that solely rely on a set fixed threshold range for alarm discrimination, the alarm accuracy and false negative rate of this disclosure embodiment are higher.

[0042] Other features and advantages of this disclosure will be described in detail in the following detailed description section. Attached Figure Description

[0043] The accompanying drawings are provided to further illustrate the present disclosure and form part of the specification. They are used together with the following detailed description to explain the present disclosure, but do not constitute a limitation thereof. In the drawings:

[0044] Figure 1 A flowchart of an alarm method in an exemplary embodiment is shown;

[0045] Figure 2 A flowchart illustrating the training of a target model in an exemplary embodiment is shown;

[0046] Figure 3 A detailed flowchart of an alarm method in an exemplary embodiment is shown;

[0047] Figure 4 A block diagram of an alarm device in an exemplary embodiment is shown;

[0048] Figure 5 A block diagram of an electronic device in an exemplary embodiment is shown. Detailed Implementation

[0049] The specific embodiments of this disclosure will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit this disclosure.

[0050] It should be noted that all actions involving the acquisition of signals, information, or data in this disclosure are carried out in compliance with the relevant data protection laws and policies of the country where the location is situated, and with authorization from the owner of the relevant device.

[0051] In view of the technical problems existing in the background art, the present disclosure provides an alarm method. Figure 1 A flowchart of an alarm method in an exemplary embodiment is shown. Please refer to... Figure 1 The method includes:

[0052] S101, determine the first offset of the current value of the target indicator relative to a value within a preset target threshold range.

[0053] The business system has multiple metrics, including but not limited to CPU utilization, memory utilization, memory idle rate, disk utilization, disk idle rate, response time, response rate, success rate, error rate, and request count. Each metric is associated with a specific object in the business system (such as a host, service, or application). For example, one metric might represent the CPU utilization of host A, another might represent the CPU utilization of host B, and yet another might represent the response time of application a.

[0054] In this disclosure, alarm monitoring can be performed separately for each set indicator, and an alarm can be promptly sent to the operation and maintenance personnel when the monitored indicator shows an anomaly. Here, the target indicator refers to any one of the monitored indicators. The aforementioned target threshold range can be a fixed threshold range set based on human experience for the target indicator, and the target threshold range is a threshold range composed of a preset upper threshold bound and a preset lower threshold bound, representing the reasonable range that the indicator value should fall within. In an exemplary embodiment, corresponding target threshold ranges are set separately for different indicators; that is, the target threshold ranges for different indicators may be different.

[0055] In the above steps, for the target indicator, the first offset of the current indicator value relative to a value within a preset target threshold range for the target indicator is calculated. It can be understood that the value within the target threshold range can refer to the center value of the target threshold range; that is, the first offset characterizes the degree of deviation of the current indicator value from the center of the target threshold range.

[0056] S102, determine the second offset of the current value of the target indicator based on the distance between the current value of the target indicator and multiple historical values ​​of the target indicator.

[0057] Understandably, prior to this step, it is necessary to obtain multiple historical values ​​for the target metric.

[0058] In one possible embodiment, multiple historical index values ​​of the target index within a preset time period prior to the current day are obtained. For example, multiple historical index values ​​of the target index within the previous week are obtained, and a second offset corresponding to the current index value of the target index is determined based on the multiple historical index values ​​within the previous week.

[0059] In another possible embodiment, some alarm monitoring systems have the ability to analyze the periodic change characteristics of indicators. They can analyze a series of indicator values ​​to determine if the indicators change periodically in a manner such as "yearly," "monthly," "weekly," or "daily," thereby obtaining the periodic change characteristics of the indicators. Based on this, multiple historical indicator values ​​corresponding to different time points within the previous period can be obtained according to the periodic change characteristics of the target indicator. For example, if the target indicator exhibits a "weekly" periodic change characteristic, multiple historical indicator values ​​of the target indicator in the previous week of the current week can be obtained; or if the target indicator exhibits a "dayly" periodic change characteristic, multiple historical indicator values ​​of the target indicator in the day before the current day can be obtained.

[0060] After obtaining multiple historical values ​​of the target indicator, a second offset of the current indicator value is determined based on the distance between the current indicator value and these historical values. The greater the distance between the current indicator value and these historical values, the more the current indicator value deviates from the historical data of the target indicator.

[0061] Steps S101 and S102 can be executed in parallel or in a certain order. This disclosure does not limit the execution order between the two.

[0062] S103, based on the first offset and the second offset, obtain the target offset corresponding to the current value of the target indicator.

[0063] In an exemplary embodiment, the first offset and the second offset can be weighted according to a preset weighting weight to obtain the target offset corresponding to the current value of the target indicator. It is understood that the weighting weights for each indicator may be different.

[0064] For example, the target offset corresponding to the current value of the target indicator can be obtained using the following weighted formula:

[0065] ν=βθ+(1-β)η;

[0066] Where v represents the target offset, β represents the preset weighting weight, η represents the first offset, and θ represents the second offset.

[0067] S104, if the target offset is greater than or equal to the offset threshold corresponding to the target indicator, determine that the current indicator value of the target indicator is abnormal and issue an alarm.

[0068] Understandably, the offset threshold may differ for each metric.

[0069] In the above process, for any monitored target indicator, firstly, the first offset of the current indicator value of the target indicator relative to a fixed target threshold range is determined, and secondly, the offset corresponding to the current indicator value is obtained based on the distance between the current indicator value and the historical indicator value of the target indicator. Then, the required target offset is obtained based on the first offset and the second offset. Finally, the current indicator value of the target indicator is judged to be abnormal based on the magnitude of the target offset. When the target offset is greater than or equal to the offset threshold corresponding to the target indicator, the current indicator value of the target indicator is determined to be abnormal, and an alarm is issued.

[0070] Unlike conventional alarm schemes, the alarm method provided in this disclosure proposes to determine alarms based on offset. On one hand, a first offset represents the degree of deviation of the current value of a target indicator relative to a fixed target threshold range, which can be preset based on human experience. On the other hand, a second offset represents the degree of deviation of the current value of the target indicator relative to its historical data. The target offset is then obtained by comprehensively considering the influence of both human experience and historical data. Therefore, the target offset accurately reflects the degree of deviation of the current value of the target indicator from its normal state, ultimately enabling accurate determination of whether the current value of the target indicator is abnormal, and thus triggering an alarm. Compared to schemes that solely rely on a fixed threshold range for alarm determination, this disclosure provides higher alarm accuracy and a lower false negative rate.

[0071] Furthermore, the embodiments of this disclosure can flexibly adjust the weighting of the first offset and the second offset, changing the influence ratio of human experience and historical data of the target indicator in the target offset, so that the target offset can be more biased towards human experience or more biased towards historical data.

[0072] In some embodiments, when the target offset is less than a preset offset threshold, the current value of the target indicator is determined to be normal, and no alarm is issued.

[0073] Furthermore, in some embodiments, in step S101, the first offset corresponding to the current value of the target indicator can be calculated by the following steps:

[0074] First, obtain the preset target threshold range for the target indicator. Then, determine the difference between the current indicator value of the target indicator and the mean of the target threshold range, as well as the range width of the target threshold range. Next, determine the ratio of the difference to the range width, and obtain the first offset corresponding to the current indicator value of the target indicator based on the ratio.

[0075] The target threshold interval is a threshold range consisting of a preset upper threshold and a preset lower threshold. The mean of the target threshold interval can be expressed as: (preset upper threshold + preset lower threshold) / 2, and the width of the target threshold interval can be expressed as: preset upper threshold - preset lower threshold.

[0076] For example, the first offset corresponding to the current value of the target indicator can be obtained according to the following formula:

[0077]

[0078] Where η represents the first offset, x represents the current value of the target indicator, and X represents the mean of the target threshold interval. sup X represents the upper bound of the preset threshold. inf This indicates the lower bound of the preset threshold.

[0079] Based on the above formula, the first offset corresponding to the current value of the target indicator can be obtained, and the value range of the first offset is [0,1].

[0080] Further, in step S102, the difference between the current value of the target indicator and the mean of multiple historical indicator values ​​can be calculated based on the mean of the target indicator. This difference can then be used as the distance between the current value and the multiple historical value of the target indicator. Alternatively, the current value of the target indicator can be standardized based on the mean and standard deviation of the multiple historical value of the target indicator. The standardized result can then be used as the distance between the current value and the multiple historical value of the target indicator. The distance between the current value and these multiple historical value values ​​can then be determined as the second offset.

[0081] Therefore, in step S102, the second offset corresponding to the current value of the target indicator can be determined through the following steps:

[0082] First, based on the cyclical characteristics of the target indicator, multiple historical indicator values ​​corresponding to different time points within the previous period are obtained. Then, based on the mean and standard deviation of these historical indicator values, the current indicator value is standardized, and the second offset corresponding to the current indicator value is obtained based on the standardization result. During the standardization process, the difference between the current indicator value and the mean can be calculated, and then this difference can be divided by the standard deviation. The result or the absolute value of the result is taken as the standardized result of the current indicator value.

[0083] For example, the second offset corresponding to the current value of the target indicator can be obtained according to the following formula:

[0084]

[0085] Where θ represents the second offset, x represents the current value of the target indicator, μ represents the mean of multiple historical values ​​of the target indicator in the previous period, and σ represents the standard deviation of multiple historical values ​​of the target indicator in the previous period.

[0086] Based on the above formula, the second offset corresponding to the current value of the target indicator can be obtained, and the value range of the second offset is (0,1).

[0087] In some embodiments, the mean of multiple historical indicator values ​​can be a weighted average. The mean of multiple historical indicator values ​​is obtained by calculating the weighted average of the multiple historical indicator values ​​based on each historical indicator value and its corresponding weighting coefficient.

[0088] The weighting coefficient for each historical indicator value can be calculated using the following formula;

[0089]

[0090] Where f(t) is the weighting coefficient, t0 is the end time of the previous period, t is the time point corresponding to the historical index value, T is the time length of the previous period, and δ is the step function.

[0091] As can be seen from the formula for the weighting coefficient above, the weighting coefficient for each historical indicator value is obtained based on the difference between the end time of the previous period and the time corresponding to that historical indicator value.

[0092] Understandably, the end of the previous period is the closest time point to the current moment within that period. Therefore, for historical indicator values ​​from time points further away from the current moment, the difference t0-t between the end of the previous period and that time point is larger, meaning the weighting coefficient is smaller. Conversely, for historical indicator values ​​from time points closer to the current moment, the difference t0-t between the end of the previous period and that time point is smaller, meaning the weighting coefficient is larger. It is evident that the weighting coefficient decays over time, the purpose of which is to reduce the impact of distant time points on the current moment and ensure the timeliness of the calculation results.

[0093] Furthermore, a step function is incorporated into the calculation of the weighting coefficients. The function value of this step function will jump from 0 to 1 at a certain point. According to the formula above, when the step function's value is 0, the effect of t0-t is ignored, and the weighting coefficient remains constant at 1. However, when the step function's value is 1, t0-t takes effect, and the weighting coefficient decays over time. Therefore, by setting a step function, the range of decay can be adjusted. For example, if we want the six hours closest to the current time in the previous period to be unaffected by decay, while the remaining times are subject to time decay, we can construct a step function such that the function value is 0 for the six hours closest to the current time, and 1 for the remaining times.

[0094] Furthermore, in some embodiments, the weighting weights used to weight the first offset and the second offset, and the offset thresholds used to determine the target offset, can be preset based on human experience or can be set by constructing a target model based on a learner.

[0095] Therefore, the alarm method in this embodiment further includes: determining the weighted weight and offset threshold corresponding to the target indicator based on the target model.

[0096] Figure 2 A flowchart illustrating the training of a target model in an exemplary embodiment is shown. Figure 2 As shown, the target model is trained through the following process:

[0097] S201, Obtain the training sample set. Each training sample in the training sample set includes the indicator value of the target indicator at a point in time, and at least one of the mean, maximum and minimum values ​​of multiple historical indicator values ​​of the target indicator in the previous period at that point in time.

[0098] As one example, a training sample is represented as a data matrix, the elements of which include the indicator value of the target indicator at a point in time, and the mean, maximum and minimum values ​​of multiple historical indicator values ​​of the target indicator in the previous period at that point in time. Therefore, the data matrix includes four element values.

[0099] S202, a base learner is determined as the model to be trained, and the weighting weights and offset thresholds in the model to be trained are initialized.

[0100] The weighted weights and offset thresholds of the target metric are used as model parameters in the model to be trained. Here, the weighted weights and offset thresholds are initialized first. As the model to be trained is continuously trained, the weighted weights and offset thresholds will be continuously optimized.

[0101] S203, train the model to be trained based on the training sample set; wherein, the model to be trained is used to predict the target offset corresponding to the indicator value of the target indicator in the training sample based on the weighted weights and the input training sample, and output the prediction result of whether the indicator value of the target indicator is abnormal based on the offset threshold and the predicted target offset.

[0102] As one example, the base learner is a logistic regression-based model. Therefore, the model to be trained can perform logistic regression based on the weighted weights in the model and the input training samples to obtain the target offset corresponding to the target indicator value in the training samples. Then, based on the offset threshold in the model and the obtained target offset, it outputs a prediction result regarding whether the target indicator value is abnormal. Finally, based on this prediction result and the actual result indicating whether the target indicator value is abnormal, the model parameters in the model to be trained are updated, including updating the weighted weights and the offset threshold.

[0103] S204, use another base learner to fit the residual of the model to be trained, and superimpose the base learner on the model to be trained to obtain a new model to be trained; based on the new model to be trained, return to step S203.

[0104] After one round of training of the model to be trained is completed, another base learner is used to fit the residual of the model to be trained. Then, the base learner is superimposed on the current model to be trained to obtain a new model to be trained. Then, the new model to be trained is trained again based on the training sample set. After one round of training of the new model to be trained is completed, another base learner is used to fit the residual of the new model to be trained, and the base learner is superimposed again. The above process is repeated until the training stopping condition is met.

[0105] S205: When the training stopping condition is met, the final model to be trained is determined as the target model.

[0106] The training of the target model described above is a cumulative process. It continuously fits the residuals to approach the true model, and gradually narrows the gap with the actual results through the stacking of learners, ultimately resulting in a more accurate target model. After obtaining the target model, the weighted weights and bias thresholds corresponding to the target metric can be determined from the trained model. This method is more accurate than setting weighted weights and bias thresholds based on human experience.

[0107] In an optional embodiment, after determining that the current value of the target indicator is abnormal, it is not only necessary to issue an alert for the target indicator itself, but also to identify related indicators that may be affected by the abnormality of the target indicator and adjust the offset threshold corresponding to the related indicators. Therefore, the alerting method in this disclosure further includes: determining the influence relationship between various indicators in the business system; after determining that the current value of the target indicator is abnormal, determining the related indicators affected by the target indicator based on the influence relationship, and reducing the offset threshold corresponding to the related indicators.

[0108] For example, when the CPU utilization of host A is abnormal, it may affect the response time of application a on host A. That is, the CPU utilization of host A has an impact on the response time of application a. Therefore, when the CPU utilization of host A is abnormal, it is necessary to lower the offset threshold corresponding to the response time of application a. Originally, the target offset corresponding to the response time of application a should be greater than 5s (original offset threshold) to be judged as abnormal. After lowering the offset threshold, the target offset corresponding to the response time of application a is greater than 3s (new offset threshold) to be judged as abnormal.

[0109] According to the above scheme, when an abnormality occurs in the business system, the offset threshold of related indicators that may be affected by the abnormal indicator is adjusted, so that the abnormality of related indicators can be more sensitive after the abnormality occurs.

[0110] In some embodiments, the influence relationships between various indicators can be pre-analyzed according to the set rules. In other embodiments, when there is a sufficient amount of historical alarm data, the possible influence range of the anomaly can be given by performing causal inference on the historical alarms, thereby obtaining the influence relationships between various indicators.

[0111] In an optional embodiment, before steps S101 and S102, the method further includes: determining that the current value of the target indicator is within the target threshold range. That is, steps S101 and S102 are triggered only when the current value of the target indicator is determined to be within the target threshold range.

[0112] In an exemplary embodiment, when the current value of a target indicator exceeds the target threshold range, the current value of the target indicator can be directly determined to be abnormal and an alarm can be issued.

[0113] Figure 3 A detailed flowchart of an alarm method in an exemplary embodiment is shown. Figure 3 As shown, for a target indicator, the process first determines whether the current value of the target indicator is within the target threshold range. If the current value is not within the target threshold range, the current value is considered abnormal and an alarm is triggered. If the current value is within the target threshold range, the process then determines the first offset of the current value relative to a value within the target threshold range, and the second offset of the current value relative to historical values. The first and second offsets are then weighted and summed according to a preset weighting to obtain the target offset corresponding to the current value. Finally, the process checks whether the target offset is greater than or equal to the offset threshold. If the target offset is greater than or equal to the offset threshold, the current value is considered abnormal and an alarm is triggered. If the target offset is less than the offset threshold, the current value is considered normal and no alarm is triggered.

[0114] Figure 4 A block diagram of an alarm device in an exemplary embodiment is shown. Figure 4 As shown, the alarm device 300 includes:

[0115] The first offset determination module 301 is used to determine the first offset of the current value of the target indicator relative to a value within a preset target threshold range.

[0116] The second offset determination module 302 is used to determine the second offset of the current indicator value of the target indicator based on the distance between the current indicator value of the target indicator and multiple historical indicator values ​​of the target indicator.

[0117] The target offset determination module 303 is used to obtain the target offset corresponding to the current index value of the target index based on the first offset and the second offset;

[0118] The alarm discrimination module 304 is used to determine that the current indicator value of the target indicator is abnormal and to issue an alarm if the target offset is greater than or equal to the offset threshold corresponding to the target indicator.

[0119] Optionally, the first offset determination module 301 includes:

[0120] The threshold range acquisition module is used to acquire a preset target threshold range for the target indicator;

[0121] The first processing module is used to determine the difference between the current value of the target indicator and the mean of the target threshold interval, as well as the interval width of the target threshold interval.

[0122] The second processing module is used to determine the ratio of the difference to the interval width value, and to obtain the first offset corresponding to the current index value of the target index based on the ratio.

[0123] Optionally, the second offset determination module 302 includes:

[0124] The historical data acquisition module is used to acquire multiple historical indicator values ​​of the target indicator at different time points in the previous period based on the periodic change characteristics of the target indicator.

[0125] The standardization processing module is used to standardize the current indicator value of the target indicator based on the mean and standard deviation corresponding to the multiple historical indicator values, and to obtain the second offset corresponding to the current indicator value of the target indicator based on the standardization processing result.

[0126] Optionally, the alarm device 300 further includes: a historical data processing module, used to calculate the weighted average of the plurality of historical index values ​​based on each of the historical index values ​​and the weighting coefficients corresponding to the historical index values; wherein, the weighting coefficients corresponding to each of the historical index values ​​are calculated by the following formulas respectively;

[0127]

[0128] f(t) is the weighting coefficient, t0 is the end time of the previous period, t is the time point corresponding to the historical index value, T is the time length of the previous period, and δ is the step function.

[0129] Optionally, the target offset determination module 303 includes:

[0130] The parameter acquisition module is used to determine the weighted weight and the offset threshold corresponding to the target indicator based on the target model.

[0131] The weighted processing module is used to weight the first offset and the second offset according to the weighting weight to obtain the target offset corresponding to the current index value of the target index.

[0132] Optionally, the target model is trained through the following process:

[0133] Obtain a training sample set, wherein each training sample in the training sample set includes the indicator value of the target indicator at a point in time, and includes at least one of the mean, maximum and minimum values ​​of multiple historical indicator values ​​of the target indicator in the previous period at that point in time.

[0134] A base learner is determined as the model to be trained, and the weighting weights and offset thresholds in the model to be trained are initialized.

[0135] The model to be trained is trained according to the training sample set; wherein the model to be trained is used to predict the target offset corresponding to the indicator value of the target indicator in the training sample based on the weighted weights and the input training sample, and output a prediction result on whether the indicator value of the target indicator is abnormal based on the offset threshold and the predicted target offset.

[0136] The residuals of the model to be trained are fitted using another base learner, and the base learner is superimposed on the model to be trained to obtain a new model to be trained.

[0137] Based on the new model to be trained, return to the step of training the model to be trained based on the training sample set until the training stopping condition is met, and finally determine the final model to be trained as the target model.

[0138] Optionally, the alarm device 300 also includes:

[0139] The influence relationship determination module is used to determine the influence relationships between various indicators in the business system;

[0140] The threshold adjustment module is used to determine the related indicators affected by the target indicator based on the influence relationship after determining that the current indicator value of the target indicator is abnormal, and to reduce the offset threshold corresponding to the related indicators.

[0141] Optionally, the alarm device 300 also includes:

[0142] The indicator value coarse discrimination module is used to determine that the current indicator value of the target indicator is within the target threshold range before determining the first offset of the current indicator value of the target indicator relative to a value within the preset target threshold range.

[0143] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0144] Figure 5 This is a block diagram illustrating an electronic device 400 according to an exemplary embodiment. For example, the electronic device 400 may be provided as a server. (Refer to...) Figure 5The electronic device 400 includes a processor 422, which may be one or more, and a memory 432 for storing computer programs executable by the processor 422. The computer program stored in the memory 432 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processor 422 may be configured to execute the computer program to perform the alarm method described above.

[0145] Additionally, the electronic device 400 may also include a power supply component 426 and a communication component 450. The power supply component 426 may be configured to perform power management of the electronic device 400, and the communication component 450 may be configured to enable communication of the electronic device 400, such as wired or wireless communication. Furthermore, the electronic device 400 may also include an input / output (I / O) interface 458.

[0146] In another exemplary embodiment, a computer-readable storage medium including program instructions is also provided, which, when executed by a processor, implement the steps of the alarm method described above. For example, the non-transitory computer-readable storage medium may be the memory 432 including the program instructions described above, which may be executed by the processor 422 of the electronic device 400 to complete the alarm method described above.

[0147] In another exemplary embodiment, a computer program product is also provided, the computer program product comprising a computer program executable by a programmable device, the computer program having a code portion for performing the alarm method described above when executed by the programmable device.

[0148] The preferred embodiments of the present disclosure have been described in detail above with reference to the accompanying drawings. However, the present disclosure is not limited to the specific details of the above embodiments. Within the scope of the technical concept of the present disclosure, various simple modifications can be made to the technical solutions of the present disclosure, and these simple modifications all fall within the protection scope of the present disclosure.

[0149] It should also be noted that the various specific technical features described in the above embodiments can be combined in any suitable manner without contradiction. To avoid unnecessary repetition, this disclosure will not describe the various possible combinations separately.

[0150] Furthermore, various different embodiments of this disclosure can be combined in any way, as long as they do not violate the spirit of this disclosure, they should also be regarded as the content disclosed in this disclosure.

Claims

1. An alarm method characterized by, include: Determine whether the current value of the target indicator is within the target threshold range. If the current value is not within the target threshold range, determine that the current value of the target indicator is abnormal and issue an alarm. If it is determined that the current indicator value is within the target threshold range: Determine the first offset of the current value of the target indicator relative to a value within a preset target threshold range; A second offset of the current value of the target indicator is determined based on the distance between the current value of the target indicator and multiple historical values ​​of the target indicator. Based on the first offset and the second offset, the target offset corresponding to the current value of the target indicator is obtained; If the target offset is greater than or equal to the offset threshold corresponding to the target indicator, the current indicator value of the target indicator is determined to be abnormal and an alarm is issued; The step of obtaining the target offset corresponding to the current indicator value of the target indicator based on the first offset and the second offset includes: determining the weighted weight and the offset threshold corresponding to the target indicator based on the target model; and weighting the first offset and the second offset according to the weighted weight to obtain the target offset corresponding to the current indicator value of the target indicator. The target model is trained through the following process: Obtain a training sample set, wherein each training sample in the training sample set includes the indicator value of the target indicator at a point in time, and includes at least one of the mean, maximum and minimum values ​​of multiple historical indicator values ​​of the target indicator in the previous period at that point in time. A base learner is determined as the model to be trained, and the weighting weights and offset thresholds in the model to be trained are initialized. The model to be trained is trained based on the training sample set; wherein the model to be trained is used to predict the target offset corresponding to the indicator value of the target indicator in the training sample based on the weighted weights and the input training sample, and output a prediction result on whether the indicator value of the target indicator is abnormal based on the offset threshold and the predicted target offset; the base learner is a logistic regression-based model, and the model to be trained updates the model parameters in the model to be trained based on the prediction result and the true result of whether the indicator value of the target indicator is abnormal, including updating the weighted weights and the offset threshold; The residuals of the model to be trained are fitted using another base learner, and the base learner is superimposed on the model to be trained to obtain a new model to be trained. Based on the new model to be trained, return to the step of training the model to be trained based on the training sample set until the training stopping condition is met, and finally determine the final model to be trained as the target model.

2. The method according to claim 1, characterized in that, Determining the first offset of the current value of the target indicator relative to a value within a preset target threshold range includes: Obtain the preset target threshold range for the target indicator; Determine the difference between the current value of the target indicator and the mean of the target threshold interval, as well as the interval width of the target threshold interval; Determine the ratio of the difference to the interval width value, and obtain the first offset corresponding to the current index value of the target index based on the ratio.

3. The method according to claim 1, characterized in that, The step of determining the second offset of the current value of the target indicator based on the distance between the current value of the target indicator and multiple historical values ​​of the target indicator includes: Based on the periodic change characteristics of the target indicator, obtain multiple historical indicator values ​​corresponding to different time points in the previous period for the target indicator. Based on the mean and standard deviation of the multiple historical indicator values, the current indicator value of the target indicator is standardized, and the second offset corresponding to the current indicator value of the target indicator is obtained based on the standardization result.

4. The method according to claim 3, characterized in that, The method for obtaining the mean value corresponding to the multiple historical indicator values ​​is as follows: Calculate the weighted average of the multiple historical indicator values ​​based on each historical indicator value and the weighting coefficient corresponding to the historical indicator value; The weighting coefficient corresponding to each historical indicator value is calculated using the following formula; f ( t ) represents the weighting coefficient. t 0 represents the end time of the previous cycle. t The time point corresponding to the historical indicator value. T The duration of the previous cycle. δ It is a step function.

5. The method according to claim 1, characterized in that, The method further includes: Determine the influence relationships between various indicators in the business system; After determining that the current value of the target indicator is abnormal, the related indicators affected by the target indicator are determined according to the influence relationship, and the offset threshold corresponding to the related indicators is reduced.

6. An alarm device, characterized in that, include: The first offset determination module is used to determine the first offset of the current value of the target indicator relative to a value within a preset target threshold range. The second offset determination module is used to determine the second offset of the current indicator value of the target indicator based on the distance between the current indicator value of the target indicator and multiple historical indicator values ​​of the target indicator. The module includes: determining the weighted weight and the offset threshold corresponding to the target indicator based on the target model; and weighting the first offset and the second offset according to the weighted weight to obtain the target offset corresponding to the current indicator value of the target indicator. The target offset determination module is used to obtain the target offset corresponding to the current index value of the target index based on the first offset and the second offset; The alarm judgment module is used to determine that the current indicator value of the target indicator is abnormal and to issue an alarm if the target offset is greater than or equal to the offset threshold corresponding to the target indicator. The indicator value coarse discrimination module is used to determine that the current indicator value of the target indicator is within the target threshold range before determining the first offset of the current indicator value of the target indicator relative to a value within the preset target threshold range; Wherein, if the current indicator value is not within the target threshold range, the current indicator value of the target indicator is determined to be abnormal and an alarm is issued; The target model is trained through the following process: Obtain a training sample set, wherein each training sample in the training sample set includes the indicator value of the target indicator at a point in time, and includes at least one of the mean, maximum and minimum values ​​of multiple historical indicator values ​​of the target indicator in the previous period at that point in time. A base learner is determined as the model to be trained, and the weighting weights and offset thresholds in the model to be trained are initialized. The model to be trained is trained based on the training sample set; wherein the model to be trained is used to predict the target offset corresponding to the indicator value of the target indicator in the training sample based on the weighted weights and the input training sample, and output a prediction result on whether the indicator value of the target indicator is abnormal based on the offset threshold and the predicted target offset; the base learner is a logistic regression-based model, and the model to be trained updates the model parameters in the model to be trained based on the prediction result and the true result of whether the indicator value of the target indicator is abnormal, including updating the weighted weights and the offset threshold; The residuals of the model to be trained are fitted using another base learner, and the base learner is superimposed on the model to be trained to obtain a new model to be trained. Based on the new model to be trained, return to the step of training the model to be trained based on the training sample set until the training stopping condition is met, and finally determine the final model to be trained as the target model.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the program implements the steps of the method described in any one of claims 1-5.

8. An electronic device, characterized in that, include: A memory on which computer programs are stored; A processor for executing the computer program in the memory to implement the steps of the method according to any one of claims 1-5.

Images