Security alarm deduplication method, device, equipment and storage medium

Abstract

The present disclosure provides a security alarm deduplication method, device, equipment and storage medium, which can be applied to the field of financial security alarm technology. The method includes: obtaining security alarm information, the security alarm information includes abnormal device alarm information and normal device alarm information; identifying the security alarm information and generating a unique identifier ID; transmitting the identifier ID to an alarm hotspot area, the alarm hotspot area is used to store N identifier IDs; scanning the N identifier IDs in the alarm hotspot area at a preset time interval, merging multiple security alarm information that meet the first preset condition into the same security alarm information as the parent security alarm information; continuously scanning the N identifier IDs in the alarm hotspot area at a preset time interval, taking multiple security alarm information that meet the second preset condition as child security alarm information, and establishing a parent-child relationship with the parent security alarm information.

Description

Technical Field

[0001] The present disclosure relates to the technical field of financial security alarm technology, and in particular to a security alarm deduplication method, device, equipment and storage medium. Background Art

[0002] In the financial security system, alarm is the core function of security monitoring. Financial system security consists of human defense, physical defense and technical defense. Physical defense uses various sensors to sense key security parts to ensure the safety of key parts. However, with long-term use, the equipment itself will have a certain probability of false alarms. For example, the fire level sensor is placed in a humid environment for a long time, causing problems, or the intelligent alarm equipment generates false alarms due to model accuracy, and some equipment causes continuous false alarms for a period of time due to unexpected time, such as leaves blocking the camera, causing the recorder to generate a video occlusion alarm, etc.

[0003] At the same time, various types of alarms will be displayed to the on-duty police officers in the form of pop-up windows or lists in the security police handling platform. Since the above-mentioned types of false alarms will be generated quickly and continuously, the continuous pop-up windows or rapid growth of lists make it difficult for police officers to quickly discover real alarms and handle alarms. The most common solution at present is to replace damaged equipment as soon as possible or reduce the accuracy of the intelligent model algorithm (which is easy to miss real alarms) or reduce the sensitivity of the sensor (which is easy to miss real alarms). Summary of the invention

[0004] In view of the above problems, the present disclosure provides a security alarm deduplication method, apparatus, device and storage medium.

[0005] According to the first aspect of the present disclosure, a security alarm deduplication method is provided, comprising: obtaining security alarm information, the security alarm information including abnormal device alarm information and normal device alarm information; identifying the security alarm information and generating a unique identifier ID; transmitting the identifier ID to an alarm hotspot area, the alarm hotspot area being used to store N identifier IDs; scanning the N identifier IDs in the alarm hotspot area at a preset time interval, merging multiple security alarm information that meet a first preset condition into the same security alarm information as parent security alarm information; continuously scanning the N identifier IDs in the alarm hotspot area at a preset time interval, taking multiple security alarm information that meet a second preset condition as child security alarm information, establishing a parent-child relationship with the parent security alarm information, and integrating and merging a large amount of alarm information, thereby achieving the beneficial effect of avoiding neglect of important alarm information.

[0006] According to an embodiment of the present disclosure, an abnormal device list is configured in the alarm hotspot area, and the abnormal device list includes abnormal device alarm information generated by the abnormal device, thereby achieving the beneficial effect of reducing the processing of security alarm information and improving the efficiency of the deduplication process.

[0007] According to an embodiment of the present disclosure, scanning N identifier IDs in the alarm hotspot area at a preset time interval includes: determining whether the device that issues the security alarm information exists in the abnormal device list. If so, it is abnormal device alarm information, and the abnormal device alarm information is discarded; if it does not exist in the abnormal device list, it is normal device alarm information, which is used to establish a parent-child relationship, thereby achieving the beneficial effect of reducing the processing of a large amount of security alarm information and improving the efficiency of the deduplication process.

[0008] According to an embodiment of the present disclosure, the identifier ID includes: key part ID, equipment number ID, alarm type ID and time ID, which are used to synthesize a unique identifier ID. Based on the identifier ID, security alarm information can be better identified to achieve effective identification of false alarms or duplicate alarm information.

[0009] According to an embodiment of the present disclosure, scanning N identifier IDs within the alarm hotspot area at a preset time also includes: obtaining a list of abnormal devices, adding labels to the devices in the list of abnormal devices for identifying the abnormal devices; identifying the list of abnormal devices, and establishing an association with the device database, thereby achieving the beneficial effect of standardized management of abnormal devices.

[0010] According to an embodiment of the present disclosure, merging multiple security alarm messages that meet the first preset condition into the same security alarm message also includes: when the time is less than the preset time and has the same key part ID, equipment number ID and alarm type ID, it is judged as a duplicate alarm, merged into the same security alarm message, and used as the parent security alarm message, thereby achieving the beneficial effect of standardized processing of false alarms or duplicate alarm messages.

[0011] According to an embodiment of the present disclosure, taking multiple security alarm information that meet the second preset condition as sub-security alarm information also includes: when the time is less than the preset time and also has the same key part ID, equipment number ID and alarm type ID, but the time ID of the second preset condition is greater than the time ID of the first preset condition, it is judged as sub-security alarm information, and used as sub-security alarm information of the parent security alarm information, and a parent-child relationship is established. According to the division of the identifier ID, the beneficial effects of better identification of the identifier ID and faster deduplication are achieved.

[0012] According to the embodiments of the present disclosure, it also includes: obtaining a parent-child relationship queue and displaying the parent-child relationship queue; obtaining an abnormal device list, marking the devices in the abnormal device list, and storing them in an alarm hotspot area, thereby achieving a better display of the parent-child relationship to provide security personnel with better conclusions.

[0013] According to an embodiment of the present disclosure, before obtaining security alarm information, it also includes: obtaining equipment location information and equipment number information in each area, establishing an equipment database, establishing an association with the equipment database based on the identifier ID, and obtaining the equipment location information and equipment number information corresponding to the identifier ID. The establishment of the equipment database achieves the beneficial effect of more standardized equipment management.

[0014] According to an embodiment of the present disclosure, scanning N identifier IDs within an alarm hotspot area at a preset time also includes: obtaining the identifier ID, segmentally identifying the identifier ID, and obtaining segmented identification results, which are key part ID, equipment number ID, alarm type ID, and time ID; according to the key part ID and equipment number ID of the segmented identification results, obtaining the equipment location corresponding to the key part ID and equipment number ID in the database, and establishing a key part list, thereby achieving the beneficial effect of providing security personnel with more complete risk alarm information.

[0015] According to the embodiments of the present disclosure, a plurality of security alarm messages are obtained; a plurality of security alarm messages are identified, and a plurality of unique identifier IDs are generated; the plurality of identifier IDs are transmitted to an alarm hotspot area; the plurality of identifier IDs in the alarm hotspot area are scanned at preset time intervals, a plurality of security alarm messages satisfying a first preset condition are merged into the same security alarm message, and a plurality of different parent security alarm messages are respectively generated; the plurality of identifier IDs in the alarm hotspot area are continuously scanned at preset time intervals, a plurality of security alarm messages satisfying a second preset condition are used as child security alarm messages, a plurality of different parent security alarm messages and a plurality of different child security alarm messages are respectively established with corresponding plurality of different parent security alarm messages and a plurality of different child security alarm messages, a large amount of alarm messages are standardized, integrated, and merged, thereby achieving the beneficial effect of avoiding neglect of important alarm messages.

[0016] According to an embodiment of the present disclosure, a plurality of different parent-child relationships are obtained, and the plurality of different parent-child relationships are respectively formed into parallel queues for display, so as to provide security personnel with more standardized alarm information and enable security personnel to identify effective alarms more quickly.

[0017] The second aspect of the present disclosure provides a security alarm deduplication device, including: an alarm receiving module, used to receive the alarm information of the equipment and generate an identifier ID; an alarm processing module, provided with an alarm hotspot area, used to receive and store the identifier ID; an alarm merging module, used to scan the identifier ID and merge multiple security alarm information to establish a parent-child relationship; and an alarm display module, used to display multiple different parent-child relationships in parallel.

[0018] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above method.

[0019] The fourth aspect of the present disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the above method.

[0020] According to the security alarm deduplication method, device, equipment and medium provided by the present invention, without reducing the sensor accuracy and algorithm accuracy, by acquiring multiple security alarm information, a parent-child relationship is established for the multiple security alarm information, and a large amount of alarm information is integrated and merged, thereby avoiding the neglect of important alarm information, and establishing a list of key parts, and exchanging information with the list of abnormal equipment, it is easy to judge and identify high-risk alarms, so that security personnel can better monitor key parts. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0022] Figure 1 The application scenario diagram of the security alarm deduplication method, device, equipment, medium and program product according to the embodiment of the present disclosure is schematically shown;

[0023] Figure 2 A flowchart of a security alarm deduplication method according to an embodiment of the present disclosure is schematically shown;

[0024] Figure 3 The following schematically shows a judgment flow chart of the security alarm deduplication method according to an embodiment of the present disclosure;

[0025] Figure 4 A flowchart of security alarm deduplication processing according to an embodiment of the present disclosure is schematically shown;

[0026] Figure 5 A flowchart schematically shows a method for deduplicating multiple security alarm information according to an embodiment of the present disclosure;

[0027] Figure 6 A schematic diagram of a structure of a security alarm deduplication device according to an embodiment of the present disclosure is shown; and

[0028] Figure 7 A block diagram of an electronic device suitable for implementing a security alarm deduplication method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0029] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0030] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0031] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0032] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0033] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision, disclosure and application of the data involved (including but not limited to user personal information) comply with the provisions of relevant laws and regulations, take necessary confidentiality measures, and do not violate public order and good morals.

[0034] The embodiment of the present disclosure provides a security alarm deduplication method, which performs deduplication processing on security alarm information from two levels, one is the background merging logic, and the other is the front-end display logic. The background merging logic establishes a parent-child relationship for a large amount of security alarm information and deduplicates it, and supports the marking of multiple damaged devices to facilitate the subsequent processing of normal device information, and transmits the security alarm information with a parent-child relationship to the front-end display logic for displaying the parallel parent-child relationship.

[0035] Figure 1 The application scenario diagram of the security alarm deduplication method according to the embodiment of the present disclosure is schematically shown.

[0036] like Figure 1As shown, the application scenario 100 according to this embodiment may include a banking and financial alarm scenario or other security alarm scenarios. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0037] The user may use at least one of the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications may be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0038] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0039] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0040] It should be noted that the security alarm deduplication method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the security alarm deduplication device provided in the embodiment of the present disclosure can generally be set in the server 105. The security alarm deduplication method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Correspondingly, the security alarm deduplication device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0041] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0042] The following will be based on Figure 1 The scene described by Figure 2 to Figure 5 The security alarm deduplication method of the disclosed embodiment is described in detail.

[0043] Security alarm information is generated by sensors or intelligent analysis devices, and a large number of false alarms are also generated based on the device. If the security alarm information is displayed to security personnel without processing, they can only identify false alarms one by one by eye, and the processing efficiency is far lower than the speed of alarm generation, which leads to alarm accumulation and makes it difficult to find and process real alarms. Therefore, it is necessary to merge the security alarm information continuously generated by a single device, so that the same type of alarms from the same device are just several processable alarms for the alarm receiver, which can greatly avoid false alarms covering up real alarms.

[0044] Based on the above content, it can be seen that without reducing the accuracy of sensors or algorithms, false alarms can be prevented, normal alarm reception can be interfered with, and clear alarm information can be provided to security personnel, so as to standardize the management of a large amount of security alarm information.

[0045] Figure 2 The flowchart of the security alarm deduplication method according to the embodiment of the present disclosure is schematically shown.

[0046] like Figure 2 As shown, the security alarm deduplication method of this embodiment includes operations S210 to S230.

[0047] In operation S210, security alarm information is acquired, where the security alarm information includes abnormal device alarm information and normal device alarm information.

[0048] In operation S220, security alarm information is identified and a unique identifier ID is generated.

[0049] In operation S230 , the identifier ID is transmitted to the alarm hotspot area, and the alarm hotspot area is used to store N identifier IDs.

[0050] In operation S240, N identifier IDs in the alarm hot spot area are scanned at a preset time interval, and multiple security alarm information that meet the first preset condition are merged into the same security alarm information as the parent security alarm information.

[0051] In operation S250, N identifier IDs in the alarm hot spot area are continuously scanned at a preset time interval, and multiple security alarm information that meet the second preset condition are used as child security alarm information to establish a parent-child relationship with the parent security alarm information.

[0052] In step S210, the alarm information of abnormal devices and the alarm information of normal devices are obtained, that is, the alarm information of all devices, whether normal or damaged, is obtained.

[0053] In step S220, the security alarm information of all devices is identified, including the alarm information of abnormal devices and the alarm information of normal devices, and a corresponding identifier ID is generated.

[0054] Specifically, N is a constant number of security alarm information.

[0055] According to the above steps, the identifier ID includes the key part ID, equipment number ID, alarm type ID and time ID, which are used to generate unique ID information within the alarm hotspot area and quickly generate corresponding identification results within the alarm hotspot area.

[0056] Exemplarily, the logic of generating the identifier ID is: key part ID + equipment number ID + alarm type ID + time ID. For example, the key part ID is 10000001, the key part is the location information of the key area, the equipment number ID is 101, the alarm type is manual alarm, the manual alarm type ID is 110, and the time ID format is: YYYYMMDDHHMMSS. For example, 20221116105231, then the time ID is 1000000110111020221116105231. The identifier ID generated in this way can ensure uniqueness within the alarm hotspot area. At the same time, in the alarm processing module, each segment of the ID can be quickly judged to improve the alarm judgment speed and effect.

[0057] In step S230, it is also necessary to obtain a list of abnormal devices and add labels to the devices in the abnormal device list to identify the abnormal devices. Identify the list of abnormal devices and establish an association with the device database. The unique identifier ID generated above is transmitted to the alarm hotspot area. The alarm hotspot area is also configured with a list of abnormal devices. The abnormal device list includes abnormal device alarm information generated by abnormal devices. The abnormal devices in the abnormal device list can be manually labeled, for example, to better identify abnormal device alarm information issued by abnormal devices.

[0058] Exemplarily, before obtaining security alarm information, a device database is established to obtain device location information and device number information for each area, and an association is established with the device database based on the segmented recognition results of the identifier ID to obtain the device location information and device number information corresponding to the identifier ID.

[0059] Exemplarily, the device database is mainly used to store relevant information about the equipment, such as the installation location, installation model, and equipment number of each device. The above information is matched with the key part ID and the equipment number ID, and is used to generate the identifier ID of the corresponding device more quickly in the process of creating the identifier ID, thereby improving the efficiency of the deduplication process. At the same time, the device database can also establish a key part list to store relevant equipment information in key security areas. When multiple devices in the key security area are marked as abnormal devices, the area is marked as a high-risk alarm risk, and the high-risk alarm risk is uploaded to the alarm display module to display the high-risk alarm risk for reference and processing by security personnel.

[0060] Specifically, obtaining the identifier ID also includes segmented identification of the identifier ID to obtain segmented identification results, which are respectively key part ID, equipment number ID, alarm type ID and time ID. According to the key part ID and equipment number ID of the segmented identification results, the equipment location corresponding to the key part ID and equipment number ID in the equipment database is obtained to establish an association with the subsequent generation of high-risk alarm risks.

[0061] Figure 3 The following schematically shows a flow chart of determining the deduplication of security alarms according to an embodiment of the present disclosure. Figure 4 The flowchart of security alarm deduplication processing according to an embodiment of the present disclosure is schematically shown.

[0062] like Figure 3-Figure 4 As shown, in step S240, the preset time may be, for example, 2s, 3s or 5s, which is subject to actual application and is not specifically limited in the present disclosure.

[0063] When scanning the identifier ID of the alarm hotspot area, it is also necessary to determine whether the device that issued the security alarm information exists in the abnormal device list. If it exists in the abnormal device list, it is abnormal device alarm information and the abnormal device alarm information will be discarded; if it does not exist in the abnormal device list, it is normal device alarm information, which is used to establish a parent-child relationship. The following establishment of parent-child relationships is all normal device alarm information. For ease of understanding, it is uniformly expressed as security alarm information.

[0064] Specifically, abnormal device alarm information is discarded to improve the efficiency of the deduplication process. At the same time, the abnormal device list interacts with the database. When the abnormal device list contains devices in multiple security key areas, the above-mentioned high-risk alarm risk is generated accordingly.

[0065] Furthermore, when security alarm information that can establish a parent-child relationship is obtained, it is determined whether multiple security alarm information meet the first preset condition, and the multiple security alarm information that meet the first preset condition are merged into the same security alarm information. Specifically, the first preset condition is: when it is less than the preset time and has the same key part ID, equipment number ID and alarm type ID, it is determined to be a duplicate alarm, merged into the same security alarm information, and used as the parent security alarm information.

[0066] In step S250, it is further necessary to determine whether the second preset condition is met, and multiple security alarm information that meet the second preset condition will be used as sub-security alarm information. The second preset condition can be, for example: when the time is less than the preset time and has the same key part ID, equipment number ID and alarm type ID, but the time ID of the second preset condition is greater than the time ID of the first preset condition, it is judged as sub-security alarm information and used as sub-security alarm information of the parent security alarm information to establish a parent-child relationship.

[0067] Specifically, the method for judging whether it is less than the preset time is: if the absolute value of the difference between the two time IDs is less than the preset time, it is determined to be less than the preset time.

[0068] Exemplarily, the multiple security alarm messages that meet the second preset condition may be, for example, alarm messages that are generated continuously and uninterruptedly. When the existence of a parent security alarm message is detected, the subsequently generated alarm messages that meet the second preset condition will be automatically subordinated to the child security alarm message under the parent security alarm message, forming a parent-child relationship.

[0069] In an embodiment of the present disclosure, a parent-child relationship queue is obtained and displayed; an abnormal device list is obtained, the devices in the abnormal device list are marked, and stored in an alarm hotspot area.

[0070] Exemplarily, the acquired parent-child relationship queue is transmitted to the alarm display module, and the parent-child relationship is displayed in parallel on the alarm display module.

[0071] In order to further illustrate that when there are multiple security alarm information to establish multiple parent-child relationships, the following embodiments are provided for further elaboration.

[0072] Figure 5 The following schematically shows a flow chart of determining the deduplication of security alarms according to an embodiment of the present disclosure.

[0073] like Figure 5 As shown, this embodiment includes the following steps S510-S550.

[0074] In operation S510, a plurality of security alarm information is acquired.

[0075] In operation S520, a plurality of security alarm information is identified, and a plurality of unique identifiers ID are generated.

[0076] In operation S530, multiple identifiers IDs are transmitted to the alarm hotspot area.

[0077] In operation S540, multiple identifier IDs in the alarm hotspot area are scanned at preset time intervals, multiple security alarm information that meet the first preset condition are merged into the same security alarm information, and multiple different parent security alarm information are generated respectively.

[0078] In operation S550, multiple identifier IDs in the alarm hotspot area are continuously scanned at preset time intervals, multiple security alarm information that meet the second preset condition are used as sub-security alarm information, and multiple different parent security alarm information and multiple different sub-security alarm information are respectively established with corresponding multiple different parent security alarm information.

[0079] In an embodiment of the present disclosure, a plurality of different parent-child relationships are obtained, and the plurality of different parent-child relationships are respectively formed into parallel queues for display.

[0080] Embodiment 1

[0081] Obtain security alarm information, and generate corresponding identifier ID according to the security alarm information. The identifier ID generation logic is key part ID, equipment number ID, alarm type ID and time ID. Take the identifier ID 1000000110111020221118105231 as an example. The identifier ID 1000000110111020221118105231 enters the alarm hotspot area, identifies the identifier ID, and obtains the identification result, that is, key part ID: 10000001, newly added equipment number ID under this area: 101, newly added alarm type ID under equipment ID: 110, time ID: 20221118105231. Continue to obtain new security alarm information, and perform the above steps to obtain the corresponding identification result. Taking the preset time of 5s as an example, the alarm hotspot area is scanned continuously at intervals of 5s, and the identifier IDs whose absolute value of the time ID difference is less than 5s and other ID information is the same as the above-mentioned key part ID: 10000001, equipment number ID: 101, and alarm type ID: 110 are judged as duplicate alarms, and are merged into the same security alarm information as the parent security alarm information.

[0082] Continuous scanning, when the absolute value of the time ID difference is greater than the preset time 5s and the ID information is the same as the above-mentioned key part ID: 10000001, equipment number ID: 101, alarm type ID: 110, it will be identified as a child security alarm information and merged into its corresponding parent security alarm information, suggesting a parent-child relationship.

[0083] For example, there are the following structures in various parent-child relationships: In the alarm structure, there will be a parent-child relationship: Alarm identifier ID: 1000000110111020221118105231, including various alarm details and sub-alarm lists.

[0084] When the identifier ID recognition result is different from one of the ID information of the key part ID, equipment number ID, alarm type ID and time ID in the alarm hotspot area, a new parent-child relationship is established based on the continuously incoming security alarm information.

[0085] Based on the above security alarm deduplication method, the present disclosure also provides a security alarm deduplication device. Figure 6 The device is described in detail.

[0086] Figure 6 The structural block diagram of the security alarm deduplication device according to an embodiment of the present disclosure is schematically shown.

[0087] like Figure 6 As shown, the security alarm deduplication device 600 of this embodiment includes an alarm receiving module 610 , an alarm processing module 620 , an alarm merging module 630 and an alarm display module 640 .

[0088] The alarm receiving module 610 is used to receive the alarm information of the device and generate an identifier ID. In one embodiment, the alarm receiving module 610 can be used to perform the operation S210 described above, which will not be repeated here.

[0089] The alarm processing module 620 is also provided with an alarm hotspot area for receiving and storing an identifier ID. In one embodiment, the operations S220-S230 described above are all performed in the alarm processing module 620, and will not be described in detail here.

[0090] The alarm merging module 630 is used to scan the identifier ID and merge multiple security alarm information to establish a parent-child relationship. In one embodiment, the alarm merging module 630 can be used to perform the operations S240-S250 described above, which will not be repeated here.

[0091] The alarm or display module 640 is used to display the above-mentioned multiple different parent-child relationships in parallel, and at the same time display the above-mentioned high-risk alarm.

[0092] According to an embodiment of the present disclosure, any multiple modules of the alarm receiving module 610, the alarm processing module 620, the alarm merging module 630, and the alarm display module 640 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the alarm receiving module 610, the alarm processing module 620, the alarm merging module 630, and the alarm display module 640 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in an appropriate combination of any of them. Alternatively, at least one of the alarm receiving module 610, the alarm processing module 620, the alarm merging module 630 and the alarm display module 640 may be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function may be executed.

[0093] Figure 7 A block diagram of an electronic device suitable for implementing a security alarm deduplication method according to an embodiment of the present disclosure is schematically shown.

[0094] like Figure 7 As shown, the electronic device 700 according to an embodiment of the present disclosure includes a processor 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage part 708 into a random access memory (RAM) 703. The processor 701 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 701 may also include an onboard memory for caching purposes. The processor 701 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0095] In RAM 703, various programs and data required for the operation of electronic device 700 are stored. Processor 701, ROM 702 and RAM 703 are connected to each other via bus 704. Processor 701 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 702 and / or RAM 703. It should be noted that the program can also be stored in one or more memories other than ROM 702 and RAM 703. Processor 701 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0096] According to an embodiment of the present disclosure, the electronic device 700 may further include an input / output (I / O) interface 705, which is also connected to the bus 704. The electronic device 700 may further include one or more of the following components connected to the I / O interface 705: an input portion 706 including a keyboard, a mouse, etc.; an output portion 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 708 including a hard disk, etc.; and a communication portion 709 including a network interface card such as a LAN card, a modem, etc. The communication portion 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed, so that a computer program read therefrom is installed into the storage portion 708 as needed.

[0097] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0098] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 702 and / or RAM 703 described above and / or one or more memories other than ROM 702 and RAM 703.

[0099] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0100] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A security alarm deduplication method, characterized in that: include: Acquiring security alarm information, wherein the security alarm information includes abnormal device alarm information and normal device alarm information; Identify the security alarm information and generate a unique identifier ID; Transmitting the identifier ID to an alarm hotspot area, where the alarm hotspot area is used to store N of the identifier IDs; Scan the N identifiers IDs in the alarm hotspot area at a preset time interval, and merge the multiple security alarm information that meet the first preset condition into the same security alarm information as the parent security alarm information; Continuously scanning the N identifier IDs in the alarm hotspot area at a preset time interval, and taking the plurality of security alarm information satisfying the second preset condition as child security alarm information, and establishing a parent-child relationship with the parent security alarm information; The identifier ID includes: key part ID, equipment number ID, alarm type ID and time ID, which are used to synthesize a unique identifier ID; Merging the plurality of security alarm information satisfying the first preset condition into the same security alarm information further comprises: when the absolute value of the time ID difference is less than the preset time and the plurality of security alarm information have the same key part ID, device number ID and alarm type ID, determining the alarm to be a duplicate alarm, merging the plurality of security alarm information into the same security alarm information and serving the plurality of security alarm information as the parent security alarm information; Taking the multiple security alarm information that meet the second preset condition as sub-security alarm information also includes: when the absolute value of the time ID difference is greater than the preset time and also has the same key part ID, equipment number ID and alarm type ID, it is judged as sub-security alarm information and used as sub-security alarm information of the parent security alarm information to establish a parent-child relationship.

2. The security alarm deduplication method according to claim 1, characterized in that: An abnormal device list is configured in the alarm hotspot area, and the abnormal device list includes the abnormal device alarm information generated by the abnormal device.

3. The security alarm deduplication method according to claim 2, characterized in that: Scanning the N identifiers IDs in the alarm hotspot area at a preset time interval includes: Determine whether the device that issues the security alarm information exists in the abnormal device list. If it exists in the abnormal device list, it is abnormal device alarm information and the abnormal device alarm information is discarded; if it does not exist in the abnormal device list, it is normal device alarm information and is used to establish the parent-child relationship.

4. The security alarm deduplication method according to claim 1, characterized in that: Scanning the N identifiers IDs in the alarm hotspot area at a preset time interval also includes: Obtaining the abnormal device list, and adding annotations to the devices in the abnormal device list to identify the abnormal devices; The abnormal device list is identified and associated with a device database.

5. The security alarm deduplication method according to claim 1, characterized in that: The method further comprises: Obtain a parent-child relationship queue, and display the parent-child relationship queue; Obtain a list of abnormal devices, mark the devices in the list of abnormal devices, and store them in the alarm hotspot area.

6. The security alarm deduplication method according to claim 5, characterized in that: Before obtaining security alarm information, it also includes: The device location information and device number information of each area are obtained, a device database is established, and an association is established with the device database based on the identifier ID to obtain the device location information and device number information corresponding to the identifier ID.

7. The security alarm deduplication method according to claim 6, characterized in that: Scanning the N identifiers IDs in the alarm hotspot area at a preset time interval also includes: Obtaining the identifier ID, segmenting and identifying the identifier ID, and obtaining segmented identification results, which are respectively the key part ID, the equipment number ID, the alarm type ID, and the time ID; According to the key part ID and equipment number ID of the segmented recognition result, the equipment position corresponding to the key part ID and equipment number ID in the database is obtained to determine the high-risk information.

8. The security alarm deduplication method according to any one of claims 1 to 7, characterized in that: include: Get multiple security alarm information; Identify a plurality of the security alarm information and generate a plurality of unique identifiers ID; Transmitting a plurality of said identifiers IDs to an alarm hotspot area; Scanning the multiple identifiers IDs in the alarm hotspot area at a preset time interval, merging the multiple security alarm information that meet the first preset condition into the same security alarm information, and generating multiple different parent security alarm information respectively; The multiple identifier IDs in the alarm hotspot area are continuously scanned at preset time intervals, the multiple security alarm information that meet the second preset condition are used as sub-security alarm information, and corresponding multiple different parent security alarm information and multiple different sub-security alarm information are respectively established with multiple different parent security alarm information.

9. The security alarm deduplication method according to claim 8, characterized in that: A plurality of different parent-child relationships are obtained, and the plurality of different parent-child relationships are respectively formed into parallel queues for display.

10. A security alarm deduplication device, comprising: An alarm receiving module is used to receive the alarm information of the device and generate an identifier ID; An alarm processing module is provided with an alarm hotspot area for receiving and storing the identifier ID; Alarm merging module, used to scan the identifier ID and merge multiple security alarm information to establish parent-child relationship; as well as Alarm display module, used to display multiple different parent-child relationships in parallel; The identifier ID includes: key part ID, equipment number ID, alarm type ID and time ID, which are used to synthesize a unique identifier ID; Merging the plurality of security alarm information satisfying the first preset condition into the same security alarm information further comprises: when the absolute value of the time ID difference is less than the preset time and the plurality of security alarm information have the same key part ID, device number ID and alarm type ID, determining the alarm to be a duplicate alarm, merging the plurality of security alarm information into the same security alarm information and serving the plurality of security alarm information as the parent security alarm information; Taking the multiple security alarm information that meet the second preset condition as sub-security alarm information also includes: when the absolute value of the time ID difference is greater than the preset time and also has the same key part ID, equipment number ID and alarm type ID, it is judged as sub-security alarm information and used as sub-security alarm information of the parent security alarm information to establish a parent-child relationship.

11. An electronic device, comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors execute the method according to any one of claims 1 to 9.

12. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method according to any one of claims 1 to 9.

Images