A method and apparatus for determining an alarm threshold

Abstract

The application provides a method and device for determining an alarm threshold, which comprises the following steps: obtaining historical index data within a preset time range; confirming an initial alarm threshold range by sampling the historical index data according to a standard time dimension and a specific time dimension; confirming a special alarm threshold range based on sampling data with a special scene alarm mark in the historical index data; adjusting the initial alarm threshold range by screening data beyond the initial alarm threshold range but within the special alarm threshold range from the historical index data, and obtaining a final alarm threshold range. In the embodiment of the application, the data obtained by sampling the historical index data according to the standard time dimension and the specific time dimension confirms the initial alarm threshold range, and the initial alarm threshold range is adjusted in combination with the data confirmed by the special scene alarm, so as to obtain an alarm threshold range that meets the special scene and is beyond a reasonable range, thereby reducing false alarms and achieving the purpose of accurate alarm.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method and apparatus for determining alarm thresholds. Background Technology

[0002] With technological advancements, banking systems now offer a variety of transaction types. During these transactions, anomalies may occur, often reflected in relevant technical indicators. In some cases, these anomalies suggest potential vulnerabilities in the banking system; therefore, triggering appropriate alerts when such events occur is crucial.

[0003] Currently, alarms are implemented by setting alarm thresholds. The existing alarm thresholds are generally determined based on sampled historical data to roughly determine the alarm thresholds for different transactions at different times. However, the existing methods have certain drawbacks, such as imperfect processing of historical data and subjectivity in manually setting thresholds, which leads to inaccurate alarm thresholds and false alarms for abnormal events. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a method and apparatus for determining alarm thresholds to solve the problem that the prior art's determination of alarm thresholds is inaccurate, leading to false alarms of abnormal events.

[0005] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0006] The first aspect of this invention discloses a method for determining an alarm threshold, the method comprising:

[0007] Obtain historical indicator data within a preset time range;

[0008] The historical indicator data is sampled using both standard and specific time dimensions to obtain the corresponding first historical indicator sample data.

[0009] Based on the sampling data of the first historical index, a probability calculation is performed to obtain the initial alarm threshold range;

[0010] Obtain second historical indicator sampling data with special scenario alarm markers from the historical indicator data;

[0011] The range of special alarm thresholds is obtained by performing probability calculations based on the sampling data of the second historical indicator.

[0012] The third historical indicator sampling data is filtered from the historical indicator data, which exceeds the initial alarm threshold range but is within the special alarm threshold range;

[0013] The initial alarm threshold range is adjusted based on the sampling data of the third historical indicator to obtain the final alarm threshold range.

[0014] Optionally, the step of sampling the historical indicator data using a standard time dimension and a specific time dimension to obtain first historical indicator sampling data corresponding to the standard time dimension and second historical indicator sampling data corresponding to the specific time dimension includes:

[0015] Configure an identifier for a specified time point for the historical indicator data;

[0016] Historical indicator data with identifiers configured at specified time points are sampled using a standard time dimension to obtain historical indicator sampling data corresponding to the standard time dimension at the specified time point; the standard time dimension includes days, weeks, and / or months.

[0017] Sampling is performed on historical indicator data with identifiers configured at specified time points using a specific time dimension to obtain historical indicator sampling data corresponding to the specific time dimension at the specified time point.

[0018] By combining the historical indicator sampling data corresponding to the standard time dimension and the historical indicator sampling data corresponding to a specific time dimension, the first historical indicator sampling data is obtained.

[0019] Optionally, based on the first historical indicator sampling data, a probability calculation is performed to obtain the initial alarm threshold range, including:

[0020] Obtain the mean value of the first historical indicator sampling data, and use the mean value as the first benchmark value;

[0021] The initial upper limit threshold is set by adding a preset multiple of the standard deviation to the first benchmark value;

[0022] The initial lower limit threshold is obtained by subtracting a preset multiple of the standard deviation from the first benchmark value.

[0023] The initial alarm threshold range is obtained based on the initial upper limit threshold and the initial lower limit threshold.

[0024] Optionally, based on the first historical indicator sampling data, a probability calculation is performed to obtain the initial alarm threshold range, including:

[0025] Obtain the mean value of the first historical indicator sampling data, and use the mean value as the first benchmark value;

[0026] The initial upper limit threshold is set by adding 1.5 times the standard deviation to the first benchmark value;

[0027] The initial lower limit threshold is obtained by subtracting 1.5 times the standard deviation from the first benchmark value;

[0028] The initial alarm threshold range is obtained based on the initial upper limit threshold and the initial lower limit threshold.

[0029] Optionally, based on the first historical indicator sampling data, a probability calculation is performed to obtain the initial alarm threshold range, including:

[0030] Obtain the mean value of the first historical indicator sampling data, and use the mean value as the first benchmark value;

[0031] The initial upper limit threshold is set by adding twice the standard deviation to the first benchmark value.

[0032] The initial lower limit threshold is obtained by subtracting twice the standard deviation from the first benchmark value.

[0033] The initial alarm threshold range is obtained based on the initial upper limit threshold and the initial lower limit threshold.

[0034] Optionally, the step of performing probability calculations based on the second historical indicator sampling data to obtain the special alarm threshold range includes:

[0035] Obtain the mean value of the sampled data of the second historical indicator, and use the mean value as the second benchmark value;

[0036] A preset multiple of the standard deviation is added to the second benchmark value as a special upper limit threshold;

[0037] The special lower limit threshold is obtained by subtracting a preset multiple of the standard deviation from the second benchmark value.

[0038] The special alarm threshold range is obtained based on the special upper limit threshold and the special lower limit threshold.

[0039] A second aspect of this invention discloses an apparatus for determining an alarm threshold, the apparatus comprising:

[0040] The acquisition unit is used to acquire historical indicator data within a preset time range;

[0041] The first sampling unit is used to sample the historical indicator data in a standard time dimension and a specific time dimension to obtain the corresponding first historical indicator sampling data.

[0042] The initial alarm confirmation unit is used to perform probability calculations based on the first historical index sampling data to obtain the initial alarm threshold range.

[0043] The second sampling unit is used to acquire second historical indicator sampling data with special scene alarm markers from the historical indicator data;

[0044] The special alarm confirmation unit is used to perform probability calculations based on the second historical index sampling data to obtain the special alarm threshold range.

[0045] A filtering unit is used to filter third historical indicator sampling data from the historical indicator data that exceeds the initial alarm threshold range but is within the special alarm threshold range;

[0046] The adjustment unit is used to adjust the initial alarm threshold range based on the sampling data of the third historical index to obtain the final alarm threshold range.

[0047] Optionally, the first sampling unit includes:

[0048] The identifier module is used to configure an identifier for a specified time point for the historical indicator data;

[0049] The standard data sampling module is used to sample historical indicator data with identifiers configured at specified time points in a standard time dimension to obtain historical indicator sampling data corresponding to the standard time dimension at the specified time point; the standard time dimension includes days, weeks and / or months.

[0050] The specific data sampling module is used to sample historical indicator data with identifiers configured with specified time points in a specific time dimension to obtain historical indicator sampling data corresponding to the specified time point in the specific time dimension.

[0051] The collection module is used to collect the historical indicator sampling data corresponding to the standard time dimension and the historical indicator sampling data corresponding to a specific time dimension to obtain the first historical indicator sampling data.

[0052] Optionally, the initial alarm confirmation unit includes:

[0053] The first acquisition module is used to acquire the mean value of the first historical indicator sampling data and use the mean value as the first benchmark value.

[0054] The initial upper limit confirmation module is used to add a preset multiple of the standard deviation to the first benchmark value as the initial upper limit threshold.

[0055] The initial lower limit confirmation module is used to subtract a preset multiple of the standard deviation from the first benchmark value to obtain the initial lower limit threshold.

[0056] The initial alarm confirmation module is used to obtain the initial alarm threshold range based on the initial upper limit threshold and the initial lower limit threshold.

[0057] Optionally, the special alarm confirmation unit includes:

[0058] The second acquisition module is used to acquire the mean value of the second historical indicator sampling data and use the mean value as the second benchmark value.

[0059] The special upper limit confirmation module is used to add a preset multiple of the standard deviation to the second benchmark value as a special upper limit threshold.

[0060] The special lower limit confirmation module is used to subtract a preset multiple of the standard deviation from the second benchmark value to obtain the special lower limit threshold.

[0061] The special alarm confirmation module is used to obtain the special alarm threshold range based on the special upper limit threshold and the special lower limit threshold.

[0062] Based on the above embodiments of the present invention, a method and apparatus for determining alarm thresholds are provided. The method involves: acquiring historical indicator data within a preset time range; sampling the historical indicator data using a standard time dimension and a specific time dimension to obtain corresponding first historical indicator sampling data; performing probability calculations based on the first historical indicator sampling data to obtain an initial alarm threshold range; acquiring second historical indicator sampling data with special scenario alarm markers from the historical indicator data; performing probability calculations based on the second historical indicator sampling data to obtain a special alarm threshold range; filtering third historical indicator sampling data from the historical indicator data that exceeds the initial alarm threshold range but falls within the special alarm threshold range; and adjusting the initial alarm threshold range based on the third historical indicator sampling data to obtain a final alarm threshold range. In this embodiment of the invention, the data obtained by sampling the historical indicator data using a standard time dimension and a specific time dimension confirms the initial alarm threshold range, and then the initial alarm threshold range is adjusted in conjunction with data confirming special scenario alarms, thereby obtaining an alarm threshold range that meets the special scenario requirements and is outside a reasonable range, thereby reducing false alarms and achieving accurate alarms. Attached Figure Description

[0063] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0064] Figure 1 This is a flowchart of a method for determining an alarm threshold disclosed in an embodiment of the present invention;

[0065] Figure 2 This is a structural diagram of a device for determining an alarm threshold disclosed in an embodiment of the present invention. Detailed Implementation

[0066] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0067] In this application, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0068] like Figure 1 The diagram shows a flowchart of a method for determining an alarm threshold according to an embodiment of the present invention. The method includes the following steps:

[0069] S101: Obtain historical indicator data within a preset time range.

[0070] During the execution of S101, the time period from the current historical time point to the current time point is obtained as the baseline, and this time period is used as the preset time range. The specific historical time point can be freely selected. After determining the preset time range, historical indicator data within the preset time range is obtained.

[0071] This historical metric data includes metric data corresponding to each business system, including but not limited to system name, transaction name, invocation method, transaction volume, processing time, system success rate, sender and receiver, error code, deployment server, etc.

[0072] S102: Sample the historical indicator data using a standard time dimension and a specific time dimension to obtain the corresponding first historical indicator sampling data.

[0073] In the specific execution of S102, a marker for a specified time point is added to the historical indicator data, and the historical indicator data at the marker for that specified time point is obtained according to different time dimensions, thereby obtaining the first historical indicator sampling data.

[0074] In one embodiment of the present invention, the process of sampling the historical indicator data using a standard time dimension and a specific time dimension to obtain first historical indicator sampling data corresponding to the standard time dimension and second historical indicator sampling data corresponding to the specific time dimension includes:

[0075] First, configure the identifier for the specified time point for the historical indicator data.

[0076] It should be noted that the marker for the specified time point is not limited to one. Multiple time point markers can be set.

[0077] Secondly, historical indicator data with identifiers configured at specified time points are sampled using a standard time dimension to obtain historical indicator sampling data corresponding to the standard time dimension at the specified time points.

[0078] It should be noted that the standard time dimension includes days, weeks, and / or months.

[0079] Secondly, historical indicator data with identifiers configured at specified time points are sampled using a specific time dimension to obtain historical indicator sampling data corresponding to the specified time point in the specific time dimension.

[0080] It should be noted that sampling historical indicator data with identifiers configured at specified time points using a standard time dimension, or sampling historical indicator data with identifiers configured at specified time points using a specific time dimension, can be executed in parallel or sequentially, and the execution order is not limited.

[0081] Finally, by combining the historical indicator sampling data corresponding to the standard time dimension and the historical indicator sampling data corresponding to the specific time dimension, the first historical indicator sampling data is obtained.

[0082] Here is an example:

[0083] By day: The system collects indicator data at different specified time points every day within a preset time range. For example, if 365 days of historical transaction volume data for System A's transaction code b are obtained, then 365 records of transaction volume for System A's transaction code b at 0:00 AM each day can be sampled.

[0084] By week: Statistical data is collected for each Monday to Sunday within a preset time range, including Mondays, Tuesdays, and so on, at different specified time points. For example, if 365 days of historical transaction volume data for System A's transaction code b are obtained, then 52 or 53 transaction volume records for System A's transaction code b at 0:00 AM on each Monday and Tuesday can be sampled.

[0085] By month: Statistical data is collected at different specified time points within a preset time range, from the beginning of each month to the end of each month, and so on, based on the period from January to December. For example, if historical transaction volume data of System A's transaction code b is collected for 365 days, then 12 records of transaction volume of System A's transaction code b at 0:00 AM on the 1st and 2nd of each month can be sampled.

[0086] Using a specific time period as a dimension: statistically analyze special dates within a preset time range, such as sampling corresponding indicator data separately before and after Double 11, 6.18, New Year's Day and Spring Festival each year.

[0087] S103: Perform probability calculations based on the first historical index sampling data to obtain the initial alarm threshold range.

[0088] In the specific execution of S103, the normal distribution characteristics are used to perform probability calculations on the sampling data of the first historical index to determine the upper and lower limits of the initial alarm threshold range, thereby obtaining the initial alarm threshold range.

[0089] In one embodiment of the present invention, the process of performing probability calculation based on the first historical index sampling data to obtain the initial alarm threshold range includes:

[0090] First, the mean of the first historical indicator sampling data is obtained, and the mean is used as the first benchmark value.

[0091] Secondly, a preset multiple of the standard deviation is added to the first benchmark value as the initial upper limit threshold.

[0092] Secondly, the initial lower limit threshold is obtained by subtracting a preset multiple of the standard deviation from the first benchmark value.

[0093] It should be noted that this standard deviation can be determined based on historical experience.

[0094] Finally, the initial alarm threshold range is obtained based on the initial upper limit threshold and the initial lower limit threshold.

[0095] Here is an example:

[0096] For example: obtain the mean of the first historical indicator sampling data and use the mean as the first benchmark value; add 1.5 times the standard deviation to the first benchmark value as the initial upper limit threshold; subtract 1.5 times the standard deviation from the first benchmark value as the initial lower limit threshold; obtain the initial alarm threshold range based on the initial upper limit threshold and the initial lower limit threshold.

[0097] It should be noted that, based on the initial alarm threshold range determined by the above 1.5 times standard deviation, approximately 86.64% of the historical indicator data will fall within this alarm threshold range, while approximately 13.36% of the indicator data will trigger alarms and push alarm events.

[0098] For example: obtain the mean of the first historical indicator sampling data, and use the mean as the first benchmark value; add 2 times the standard deviation to the first benchmark value as the initial upper limit threshold; subtract 2 times the standard deviation from the first benchmark value as the initial lower limit threshold; and obtain the initial alarm threshold range based on the initial upper limit threshold and the initial lower limit threshold.

[0099] It should be noted that, based on the initial alarm threshold range determined by the above-mentioned 2 times standard deviation, approximately 95.45% of the historical indicator data will fall within this alarm threshold range, while approximately 4.55% of the indicator data will trigger alarms and push alarm events.

[0100] It should be noted that the preset multiple of the standard deviation in the embodiments of the present invention is not limited to the above-mentioned 1.5 times or 2 times, but can also be 1 time.

[0101] S104: Obtain the second historical indicator sampling data with special scenario alarm markers from the historical indicator data.

[0102] In S104, special scenario alarm tags are pre-marked. During the historical execution of alarms, special scenario alarms that have occurred in the past are marked.

[0103] The tagged metrics include, but are not limited to, system, physical machine, virtual machine, transaction code, method name, sender, and receiver metrics. For example, when transmitting large files such as reports to corporate clients at the end of a quarter, technical metrics such as response time and processing time will increase to varying degrees. Therefore, this embodiment of the invention considers that if these metrics are outside the normal threshold range but are in a special scenario, no alarm will be triggered, thus reducing false alarms.

[0104] In this embodiment of the invention, alarms that have recovered in a short period of time in the past can also be marked with special alarm tags.

[0105] The tagged metrics include, but are not limited to, system, physical machine, virtual machine, transaction code, method name, sender, and receiver metrics. For example, a brief network card outage on a physical server of a system would be detected as an anomaly by monitoring. However, in this embodiment of the invention, considering a reasonable delay before checking such anomalies, an alarm is only issued if the anomaly has not been resolved. This is to reduce false alarms.

[0106] During the specific execution of S104, historical indicator data that are marked based on special scenario alarms or alarms that recover in a short time in the above history are sampled to obtain the second historical indicator sampling data.

[0107] It should be noted that S102 and S104 can be used in parallel or in series. Figure 1 The example shown is a parallel scheme.

[0108] S105: Perform probability calculations based on the second historical index sampling data to obtain the special alarm threshold range.

[0109] In the specific execution of S105, the normal distribution characteristics are used to perform probability calculations on the sampled data of the second historical index to determine the upper and lower limits of the special alarm threshold range, thereby obtaining the special alarm threshold range.

[0110] In one embodiment of the present invention, the process of performing probability calculation based on the second historical index sampling data to obtain the special alarm threshold range specifically includes:

[0111] First, the mean of the second historical indicator sampling data is obtained, and the mean is used as the second benchmark value.

[0112] Secondly, a preset multiple of the standard deviation is added to the second benchmark value as a special upper limit threshold.

[0113] Secondly, a special lower limit threshold is obtained by subtracting a preset multiple of the standard deviation from the second benchmark value.

[0114] Finally, the special alarm threshold range is obtained based on the special upper limit threshold and the special lower limit threshold.

[0115] It should be noted that, in the embodiments of the present invention, the preset multiple of the standard deviation includes, but is not limited to, 1.5 times, 2 times, and can also be 1 time.

[0116] S106: Filter the third historical indicator sampling data from the historical indicator data that exceeds the initial alarm threshold range but is within the special alarm threshold range.

[0117] In the specific execution of S106, the third historical indicator sampling data that is not within the initial alarm threshold range but is within the special alarm threshold range is selected and used as the adjustment parameter.

[0118] For example, when transmitting large files such as reports to corporate clients at the end of a quarter, technical indicators such as response time and processing time may increase to varying degrees. If these indicators are not within the initial threshold range but fall within a specific alarm threshold range, no alarm will be triggered.

[0119] For example, if the network card of a physical server in a certain system experiences a brief outage, monitoring will detect the anomaly. After a reasonable delay (i.e., the upper limit of the delay time threshold for special scenarios, such as 1 minute), the system will be checked again. If the problem is not resolved, an alarm will be issued.

[0120] S107: Adjust the initial alarm threshold range based on the sampling data of the third historical index to obtain the final alarm threshold range.

[0121] In the specific execution of S107, the initial upper limit or lower limit of the initial alarm threshold range is adjusted based on the sampling data of the third historical indicator, thereby obtaining the final alarm threshold range.

[0122] In the method for determining alarm thresholds provided in this embodiment of the invention, historical indicator data within a preset time range is acquired; the historical indicator data is sampled using a standard time dimension and a specific time dimension to obtain corresponding first historical indicator sample data; probability calculation is performed based on the first historical indicator sample data to obtain an initial alarm threshold range; second historical indicator sample data with special scenario alarm markers is acquired from the historical indicator data; probability calculation is performed based on the second historical indicator sample data to obtain a special alarm threshold range; third historical indicator sample data that exceeds the initial alarm threshold range but falls within the special alarm threshold range is filtered from the historical indicator data; the initial alarm threshold range is adjusted based on the third historical indicator sample data to obtain a final alarm threshold range. In this embodiment of the invention, the data obtained by sampling the historical indicator data using a standard time dimension and a specific time dimension confirms the initial alarm threshold range, and then the initial alarm threshold range is adjusted in conjunction with the data confirmed by special scenario alarms, thereby obtaining an alarm threshold range that meets the special scenario and is outside a reasonable range, thereby reducing false alarms and achieving the purpose of accurate alarms.

[0123] Based on the method for determining an alarm threshold disclosed in the above embodiments of the present invention, the present invention also discloses an apparatus for determining an alarm threshold, such as... Figure 2 As shown, it mainly includes: acquisition unit 21, first sampling unit 22, initial alarm confirmation unit 23, second sampling unit 24, special alarm confirmation unit 25, filtering unit 26 and adjustment unit 27.

[0124] The acquisition unit 21 is used to acquire historical indicator data within a preset time range.

[0125] The first sampling unit 22 is used to sample the historical indicator data in a standard time dimension and a specific time dimension to obtain the corresponding first historical indicator sampling data.

[0126] The initial alarm confirmation unit 23 is used to perform probability calculations based on the first historical index sampling data to obtain the initial alarm threshold range.

[0127] The second sampling unit 24 is used to acquire second historical indicator sampling data with special scene alarm markers in the historical indicator data.

[0128] The special alarm confirmation unit 25 is used to perform probability calculations based on the second historical index sampling data to obtain the special alarm threshold range.

[0129] The filtering unit 26 is used to filter out third historical indicator sampling data from the historical indicator data that are outside the range of the initial alarm threshold but within the range of the special alarm threshold.

[0130] The adjustment unit 27 is used to adjust the initial alarm threshold range based on the third historical index sampling data to obtain the final alarm threshold range.

[0131] In one embodiment of the present invention, the first sampling unit 22 includes:

[0132] The identifier module is used to configure an identifier for a specified time point for the historical indicator data.

[0133] The standard data sampling module is used to sample historical indicator data with identifiers configured at specified time points in a standard time dimension to obtain historical indicator sampling data corresponding to the standard time dimension at the specified time point; the standard time dimension includes days, weeks and / or months.

[0134] The specific data sampling module is used to sample historical indicator data with identifiers configured at specified time points in a specific time dimension, so as to obtain historical indicator sampling data corresponding to the specific time dimension at the specified time point.

[0135] The collection module is used to collect the historical indicator sampling data corresponding to the standard time dimension and the historical indicator sampling data corresponding to a specific time dimension to obtain the first historical indicator sampling data.

[0136] In one embodiment of the present invention, the initial alarm confirmation unit 23 includes:

[0137] The first acquisition module is used to acquire the mean value of the first historical indicator sampling data and use the mean value as the first benchmark value.

[0138] The initial upper limit confirmation module is used to add a preset multiple of the standard deviation to the first benchmark value as the initial upper limit threshold.

[0139] The initial lower limit confirmation module is used to subtract a preset multiple of the standard deviation from the first benchmark value to obtain the initial lower limit threshold.

[0140] The initial alarm confirmation module is used to obtain the initial alarm threshold range based on the initial upper limit threshold and the initial lower limit threshold.

[0141] In one embodiment of the present invention, the preset multiple of the standard deviation includes, but is not limited to, 1.5 times, 2 times, or 1 time.

[0142] In one embodiment of the present invention, the special alarm confirmation unit 25 includes:

[0143] The second acquisition module is used to acquire the mean value of the second historical indicator sampling data and use the mean value as the second benchmark value.

[0144] The special upper limit confirmation module is used to add a preset multiple of the standard deviation to the second benchmark value as a special upper limit threshold.

[0145] The special lower limit confirmation module is used to subtract a preset multiple of the standard deviation from the second benchmark value to obtain the special lower limit threshold.

[0146] The special alarm confirmation module is used to obtain the special alarm threshold range based on the special upper limit threshold and the special lower limit threshold.

[0147] Based on the device for determining alarm thresholds disclosed in the embodiments of the present invention, the initial alarm threshold range is confirmed by sampling historical indicator data using standard time dimension and specific time dimension. Then, the initial alarm threshold range is adjusted by combining the data confirmed by alarms in special scenarios, thereby obtaining an alarm threshold range that meets the requirements of special scenarios and is outside the reasonable range, thereby reducing false alarms and achieving the purpose of accurate alarms.

[0148] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for system or system embodiments, since they are basically similar to method embodiments, the description is relatively simple, and relevant parts can be referred to the descriptions in the method embodiments. The systems and system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0149] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0150] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for determining an alarm threshold, characterized in that, The method includes: Obtain historical indicator data within a preset time range; The historical indicator data is sampled using both standard and specific time dimensions to obtain the corresponding first historical indicator sample data. Based on the sampling data of the first historical index, a probability calculation is performed to obtain the initial alarm threshold range; Obtain second historical indicator sampling data with special scenario alarm markers from the historical indicator data; the special scenario alarm markers are pre-marked, and special scenario alarms that occur in the past are marked during the historical execution of alarms; The range of special alarm thresholds is obtained by performing probability calculations based on the sampling data of the second historical indicator. The third historical indicator sampling data is filtered from the historical indicator data, which exceeds the initial alarm threshold range but is within the special alarm threshold range; The initial alarm threshold range is adjusted based on the sampling data of the third historical indicator to obtain the final alarm threshold range; The step of sampling the historical indicator data using a standard time dimension and a specific time dimension to obtain the first historical indicator sampling data corresponding to the standard time dimension includes: Configure an identifier for a specified time point for the historical indicator data; Historical indicator data with identifiers configured at specified time points are sampled using a standard time dimension to obtain historical indicator sampling data corresponding to the standard time dimension at the specified time point; the standard time dimension includes days, weeks, and / or months. Sampling is performed on historical indicator data with identifiers configured at specified time points using a specific time dimension to obtain historical indicator sampling data corresponding to the specific time dimension at the specified time point. By combining the historical indicator sampling data corresponding to the standard time dimension and the historical indicator sampling data corresponding to a specific time dimension, the first historical indicator sampling data is obtained.

2. The method according to claim 1, characterized in that, Obtain second historical indicator sampling data with special scenario alarm markers from the historical indicator data, including: Historical indicator data is sampled based on alarms that were marked for special scenarios or alarms that recovered quickly in the past, to obtain second historical indicator sampling data.

3. The method according to claim 1, characterized in that, Based on the probability calculation performed on the first historical indicator sampling data, the initial alarm threshold range is obtained, including: Obtain the mean value of the first historical indicator sampling data, and use the mean value as the first benchmark value; The initial upper limit threshold is set by adding a preset multiple of the standard deviation to the first benchmark value; The initial lower limit threshold is obtained by subtracting a preset multiple of the standard deviation from the first benchmark value. The initial alarm threshold range is obtained based on the initial upper limit threshold and the initial lower limit threshold.

4. The method according to claim 3, characterized in that, Based on the probability calculation performed on the first historical indicator sampling data, the initial alarm threshold range is obtained, including: Obtain the mean value of the first historical indicator sampling data, and use the mean value as the first benchmark value; The initial upper limit threshold is set by adding 1.5 times the standard deviation to the first benchmark value; The initial lower limit threshold is obtained by subtracting 1.5 times the standard deviation from the first benchmark value; The initial alarm threshold range is obtained based on the initial upper limit threshold and the initial lower limit threshold.

5. The method according to claim 3, characterized in that, Based on the probability calculation performed on the first historical indicator sampling data, the initial alarm threshold range is obtained, including: Obtain the mean value of the first historical indicator sampling data, and use the mean value as the first benchmark value; The initial upper limit threshold is set by adding twice the standard deviation to the first benchmark value. The initial lower limit threshold is obtained by subtracting twice the standard deviation from the first benchmark value. The initial alarm threshold range is obtained based on the initial upper limit threshold and the initial lower limit threshold.

6. The method according to claim 1, characterized in that, The step of calculating the probability based on the second historical index sampling data to obtain the special alarm threshold range includes: Obtain the mean value of the sampled data of the second historical indicator, and use the mean value as the second benchmark value; A preset multiple of the standard deviation is added to the second benchmark value as a special upper limit threshold; The special lower limit threshold is obtained by subtracting a preset multiple of the standard deviation from the second benchmark value. The special alarm threshold range is obtained based on the special upper limit threshold and the special lower limit threshold.

7. A device for determining an alarm threshold, characterized in that, The device includes: The acquisition unit is used to acquire historical indicator data within a preset time range; The first sampling unit is used to sample the historical indicator data in a standard time dimension and a specific time dimension to obtain the corresponding first historical indicator sampling data. The initial alarm confirmation unit is used to perform probability calculations based on the first historical index sampling data to obtain the initial alarm threshold range. The second sampling unit is used to acquire second historical indicator sampling data with special scenario alarm markers from the historical indicator data; the special scenario alarm markers are pre-marked, and special scenario alarms that occur in history are marked during the historical execution of alarms. The special alarm confirmation unit is used to perform probability calculations based on the second historical index sampling data to obtain the special alarm threshold range. A filtering unit is used to filter third historical indicator sampling data from the historical indicator data that exceeds the initial alarm threshold range but is within the special alarm threshold range; An adjustment unit is used to adjust the initial alarm threshold range based on the third historical indicator sampling data to obtain the final alarm threshold range; The first sampling unit includes: The identifier module is used to configure an identifier for a specified time point for the historical indicator data; The standard data sampling module is used to sample historical indicator data with identifiers configured at specified time points in a standard time dimension to obtain historical indicator sampling data corresponding to the standard time dimension at the specified time point; the standard time dimension includes days, weeks and / or months. The specific data sampling module is used to sample historical indicator data with identifiers configured with specified time points in a specific time dimension to obtain historical indicator sampling data corresponding to the specified time point in the specific time dimension. The collection module is used to collect the historical indicator sampling data corresponding to the standard time dimension and the historical indicator sampling data corresponding to a specific time dimension to obtain the first historical indicator sampling data.

8. The apparatus according to claim 7, characterized in that, The initial alarm confirmation unit includes: The first acquisition module is used to acquire the mean value of the first historical indicator sampling data and use the mean value as the first benchmark value. The initial upper limit confirmation module is used to add a preset multiple of the standard deviation to the first benchmark value as the initial upper limit threshold. The initial lower limit confirmation module is used to subtract a preset multiple of the standard deviation from the first benchmark value to obtain the initial lower limit threshold. The initial alarm confirmation module is used to obtain the initial alarm threshold range based on the initial upper limit threshold and the initial lower limit threshold.

9. The apparatus according to claim 7, characterized in that, The special alarm confirmation unit includes: The second acquisition module is used to acquire the mean value of the second historical indicator sampling data and use the mean value as the second benchmark value. The special upper limit confirmation module is used to add a preset multiple of the standard deviation to the second benchmark value as a special upper limit threshold. The special lower limit confirmation module is used to subtract a preset multiple of the standard deviation from the second benchmark value to obtain the special lower limit threshold. The special alarm confirmation module is used to obtain the special alarm threshold range based on the special upper limit threshold and the special lower limit threshold.

Images