Alarm information classification fusion method and device

Abstract

The present disclosure provides an alarm information classification fusion method and device, which classifies alarm information through attribute value parameters, and fuses alarm information according to attribute similarity, effectively reducing the massive redundant information generated by the front-end monitoring device and the false alarm and missed alarm alarm information. The method comprises: obtaining attribute value parameters corresponding to the current alarm information, and determining an alarm cluster in the alarm queue with the same attribute value parameters as the current alarm information as a target alarm cluster; according to the time state parameter of the current alarm information, one or more target alarm information is selected from the target alarm cluster; the alarm attribute similarity between the current alarm information and each target alarm information is generated, and the target alarm information with the highest alarm attribute similarity with the current alarm information is determined as the target alarm information to be fused; the fusion processing is performed on the current alarm information and the target alarm information to be fused, and the corresponding fusion alarm information is generated.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a method and apparatus for classifying and fusing alarm information. Background Technology

[0002] To improve perimeter safety in rail transit, intelligent analysis cameras or integrated radar-visual fusion devices are commonly used as front-end monitoring equipment to monitor intrusion behaviors in real time, such as people crossing tracks, climbing over tracks, or damaging track facilities. After identifying an intrusion, the front-end monitoring equipment generates alarm information according to pre-set alarm strategies and reports it to the monitoring center. The monitoring center analyzes the alarm information and then stops the intrusion through manual or automated procedures.

[0003] However, due to the continuous nature of intrusion, the front-end monitoring equipment generates a massive amount of repetitive alarm information in a short period of time, which reduces the speed at which the monitoring center can analyze and process alarm information. Furthermore, the front-end monitoring equipment is easily affected by external weather factors, which can lead to false alarms and missed alarms, resulting in an increased workload for relevant maintenance personnel. Summary of the Invention

[0004] This disclosure provides a method and apparatus for classifying and fusing alarm information. First, alarm information is classified by attribute value parameters, and then the alarm information is fused according to attribute similarity. This can effectively reduce the massive amount of redundant information generated by front-end monitoring equipment, as well as false alarms and missed alarms, improve the processing speed and accuracy of the monitoring center, and ensure the perimeter safety of rail transit.

[0005] Firstly, this disclosure provides a method for classifying and fusing alarm information, including the following steps:

[0006] Obtain the attribute value parameters corresponding to the alarm information in this round, and determine the alarm clusters in the alarm queue that have the same attribute value parameters as the alarm information in this round as the target alarm clusters; wherein, the alarm queue contains one or more alarm clusters, and each alarm cluster contains one or more alarm information;

[0007] Based on the time status parameters of the current alarm information, one or more target alarm information are selected from the target alarm cluster; wherein, the difference between the time status parameters of the target alarm information and the time status parameters of the current alarm information matches a preset time threshold.

[0008] The alarm attribute similarity between the current round of alarm information and each target alarm information is calculated, and the target alarm information with the highest alarm attribute similarity to the current round of alarm information is identified as the target alarm information to be fused.

[0009] A fusion process is performed on the current alarm information and the target alarm information to be fused to generate corresponding fused alarm information.

[0010] Secondly, this disclosure provides an alarm information classification and fusion device, including:

[0011] The determination module is adapted to obtain the attribute value parameters corresponding to the alarm information in the current round, and determine the alarm clusters in the alarm queue that have the same attribute value parameters as the alarm information in the current round as the target alarm clusters; wherein, the alarm queue contains one or more alarm clusters, and each alarm cluster contains one or more alarm information;

[0012] The filtering module is adapted to filter one or more target alarm messages from the target alarm cluster based on the time status parameters of the current alarm message; wherein the difference between the time status parameters of the target alarm message and the time status parameters of the current alarm message matches a preset time threshold.

[0013] The fusion module is adapted to generate the alarm attribute similarity between the current round of alarm information and each target alarm information, and to determine the target alarm information with the highest alarm attribute similarity to the current round of alarm information as the target alarm information to be fused; and is adapted to perform fusion processing on the current round of alarm information and the target alarm information to be fused to generate corresponding fused alarm information.

[0014] Thirdly, this disclosure provides an electronic device comprising:

[0015] At least one processor; and

[0016] A memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores one or more computer programs that can be executed by the at least one processor, and the one or more computer programs are executed by the at least one processor to enable the at least one processor to perform the above-described method.

[0018] Fourthly, this disclosure provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the above-described method when executed by a processor.

[0019] In the embodiments provided in this disclosure, on the one hand, attribute value parameters corresponding to the current round of alarm information are obtained, and alarm clusters in the alarm queue that have the same attribute value parameters as the current round of alarm information are determined as target alarm clusters; wherein, the alarm queue contains one or more alarm clusters, and each alarm cluster contains one or more alarm information; on the other hand, one or more target alarm information are selected from the target alarm clusters according to the time status parameters of the current round of alarm information; wherein, the difference between the time status parameters of the target alarm information and the time status parameters of the current round of alarm information matches a preset time threshold; alarm attribute similarity between the current round of alarm information and each target alarm information is generated, and the target alarm information with the highest alarm attribute similarity to the current round of alarm information is determined as the target alarm information to be fused; fusion processing is performed on the current round of alarm information and the target alarm information to be fused to generate corresponding fused alarm information. This method utilizes the attribute value parameters of the current round of alarm information to search for target alarm clusters in the alarm queue that share the same attribute value parameters as the current round of alarm information. After finding the target alarm clusters, it then filters out matching target alarm information from the target alarm clusters based on the time status parameters included in the current round of alarm information. Next, it calculates the attribute similarity between the current round of alarm information and each target alarm information to determine the target alarm information to be fused. Finally, it fuses the current round of alarm information with the target alarm information to generate the corresponding fused alarm information. This application, by classifying first and then fusing, integrates newly acquired alarm information with the classified and matched alarm information, which can effectively reduce the massive amount of redundant information generated by front-end monitoring equipment, as well as false alarms and missed alarms, improve the processing speed and accuracy of the monitoring center, and ensure the perimeter safety of rail transit.

[0020] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0021] The accompanying drawings are provided to further illustrate the present disclosure and form part of the specification. They are used together with the embodiments of the present disclosure to explain the disclosure and do not constitute a limitation thereof. The above and other features and advantages will become more apparent to those skilled in the art from the detailed description of exemplary embodiments with reference to the accompanying drawings, in which:

[0022] Figure 1 A flowchart illustrating an alarm information classification and fusion method provided in one embodiment of this disclosure;

[0023] Figure 2 A flowchart illustrating a specific example of the alarm information classification and fusion method of this application is shown;

[0024] Figure 3 A flowchart illustrating yet another specific example of the alarm information classification and fusion method of this application is shown;

[0025] Figure 4 A block diagram of an alarm information classification and fusion device provided in this embodiment of the present disclosure;

[0026] Figure 5 This is a block diagram of an electronic device provided in an embodiment of the present disclosure. Detailed Implementation

[0027] To enable those skilled in the art to better understand the technical solutions of this disclosure, exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments of this disclosure to aid understanding. These should be considered merely exemplary. Therefore, those skilled in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0028] Where there is no conflict, the various embodiments of this disclosure and the features thereof in the embodiments may be combined with each other.

[0029] As used herein, the term “and / or” includes any and all combinations of one or more related enumerated entries.

[0030] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. As used herein, the singular forms “a” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will also be understood that when the terms “comprising” and / or “made of” are used in this specification, the presence of the stated feature, integral, step, operation, element, and / or component is specified, but the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or groups thereof is not excluded. Words such as “connected” or “linked” are not limited to physical or mechanical connections but can include electrical connections, whether direct or indirect.

[0031] Unless otherwise specified, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and this disclosure, and will not be interpreted as having an idealized or overly formal meaning, unless expressly so defined herein.

[0032] The task scheduling method according to embodiments of this disclosure can be executed by electronic devices such as terminal devices or servers. Terminal devices can be in-vehicle devices, user equipment (UE), mobile devices, user terminals, terminals, cellular phones, cordless phones, personal digital assistants (PDAs), handheld devices, computing devices, in-vehicle devices, wearable devices, etc. The server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. Specifically, the method can be implemented by a processor calling a computer program stored in memory.

[0033] Because intrusions are persistent, front-end monitoring equipment generates a massive amount of repetitive alarm messages within a short period, reducing the speed at which the monitoring center can analyze and process these alarms. Furthermore, front-end monitoring equipment is susceptible to external weather conditions, leading to false alarms and missed alarms, increasing the workload of maintenance personnel. To address these issues, this disclosure provides an alarm message classification and fusion method. First, alarm messages are classified using attribute value parameters, and then fused based on attribute similarity. This effectively reduces the massive amount of redundant information generated by front-end monitoring equipment, as well as false alarms and missed alarms, improving the processing speed and accuracy of the monitoring center and ensuring the perimeter safety of rail transit.

[0034] Figure 1 This is a flowchart of an alarm information classification and fusion method provided as an embodiment of the present disclosure.

[0035] Reference Figure 1 The method includes:

[0036] Step S110: Obtain the attribute value parameters corresponding to the alarm information in this round, and determine the alarm clusters in the alarm queue that have the same attribute value parameters as the alarm information in this round as the target alarm clusters; wherein, the alarm queue contains one or more alarm clusters, and each alarm cluster contains one or more alarm information.

[0037] It should be noted in advance that the alarm information classification and fusion method in this application has multiple rounds. Each round will perform classification and fusion on one alarm information, which is called "the alarm information of this round". After the classification and fusion method for the alarm information of this round is completed, the classification and fusion method will continue to be performed on the next alarm information.

[0038] The alarm information in this round is generated by the front-end monitoring equipment. The front-end monitoring equipment can be an intelligent analysis camera or a radar-visual integrated machine. The intelligent analysis camera and the radar-visual integrated machine use visual signals such as image signals to intelligently analyze whether there is any intrusion behavior in the rail transit. If intrusion behavior occurs, an alarm information is generated and reported to the monitoring center. Intrusion behavior in rail transit refers to personnel illegally crossing or climbing over the tracks and damaging track facilities. Optionally, when the monitoring center receives the alarm information of intrusion behavior, it can assign the nearest track safety administrator to stop and drive away the illegal personnel, or it can issue a warning signal through the loudspeaker facilities around the rail transit perimeter to warn the illegal personnel to immediately stop the intrusion behavior.

[0039] In one optional implementation, the attribute value parameters corresponding to the alarm information in this round include one or more of the following: protocol address parameters, port parameters, and zone coding parameters.

[0040] The protocol address parameter is the logical address of the front-end monitoring device. It is used to distinguish different front-end monitoring devices and to display the topological relationships between them. Due to the complex distribution of rail transit, hundreds or thousands of front-end monitoring devices are needed to form a monitoring network for comprehensive coverage. In one specific implementation, the protocol address parameter can be an IP address. Assigning a fixed IP address to each front-end monitoring device facilitates differentiation, and the monitoring center can quickly determine the rail transit area where the intrusion occurred using the IP address included in the attribute value parameters of the current warning message. Preferably, in addition to the IP address, a MAC address can be added to the protocol address parameter. A MAC address is a hardware identifier used to uniquely identify a front-end monitoring device. Since an IP address is a post-assigned logical address, it may have the possibility of incorrect pointers or resolution failures. A MAC address, on the other hand, is an address pre-programmed into the hardware of the front-end monitoring device before it leaves the factory and cannot be modified, uniquely identifying each device. In this preferred method, if an IP address resolution error occurs, the MAC address can still be used to determine the rail transit area where the intrusion occurred.

[0041] Among them, port parameters are the physical or virtual port addresses of the front-end monitoring devices, used to characterize the type of front-end physical monitoring devices. Different front-end monitoring devices have different hardware and use different monitoring methods, so the type and monitoring method of the front-end monitoring device can be obtained through its port parameters. For example, front-end monitoring devices can use various hardware devices such as electromagnetic waves, ultrasonic waves, and infrared thermal imaging to monitor whether there is unauthorized intrusion at the perimeter of rail transit. Since different hardware devices have different data transmission ports, their port parameters are also different, and thus, the type of device that detected the intrusion can be determined through the port parameters.

[0042] Among them, the zone coding parameter is a manually set code; because the rail transit network is relatively complex, the entire rail transit network is divided into multiple zones, and the location of rail transit intrusion is determined by the zone coding.

[0043] In a specific example, the attribute value parameters corresponding to this round of alarm information include protocol address parameters, port parameters, and zone coding parameters. After receiving this round of alarm information, the monitoring center parses the attribute value parameters. First, it uses the zone coding parameters to locate the approximate area where the track intrusion occurred. Then, it uses the protocol address parameters to specifically locate the front-end monitoring device, thereby obtaining the specific alarm point where the track intrusion occurred. Finally, it uses the port parameters to obtain the hardware device of the front-end monitoring device. The zone coding parameters and protocol address parameters are used together to locate the alarm point where the track intrusion occurred, and they can verify each other to ensure the accuracy of the alarm point location. It should be noted that since different types of front-end monitoring devices have different detection methods and detection accuracies, and this application needs to classify similar alarm information in subsequent steps, the port parameters can easily distinguish signals generated by different hardware devices, and then perform subsequent classification processing on signals of the same type generated by the same hardware device.

[0044] The alarm clusters in the alarm queue that have the same attribute value parameters as the current round of alarm information are then identified as the target alarm clusters, which is achieved in the following way:

[0045] Select one or more potential alarm clusters from the alarm queue that have the same protocol address parameters as the current alarm information, and select alarm clusters from the potential alarm clusters that have the same key value parameters as the current alarm information to determine them as target alarm clusters; wherein, the key value parameters consist of one or more of the following: protocol address parameters, port parameters, and zone coding parameters.

[0046] The alarm queue contains one or more alarm clusters, which are distinguished by protocol address parameters. Each alarm cluster contains one or more alarm messages. As mentioned above, the protocol address parameter is a logical address used to identify different front-end monitoring devices. Therefore, by selecting alarm clusters with the same protocol address parameters as the alarm messages in this round from the alarm queue, alarm messages generated by the same front-end monitoring device can be initially integrated.

[0047] After filtering by protocol address parameters, one or more pre-emptive alarm clusters can be obtained from the alarm queue. It should be noted that although the protocol address parameter is a logical address used to identify different front-end monitoring devices, when the number of front-end monitoring devices is large, multiple front-end monitoring devices monitoring the same section of the rail transit perimeter can be assigned the same protocol address parameter. For example, if the protocol address parameter is the IP address of the front-end monitoring device, multiple front-end monitoring devices can be connected to the same network line during allocation. This eliminates the need to set up separate network lines for each front-end monitoring device, effectively reducing operating costs and saving resources. Furthermore, the protocol address parameter is only one of the attribute values ​​of the front-end monitoring device; it can also be combined with port parameters and zone coding parameters to jointly identify the front-end monitoring device. Therefore, different front-end monitoring devices can share the same protocol address parameter.

[0048] After obtaining the candidate alarm clusters, they are then filtered using key-value parameters. Alarm clusters with the same key-value parameters as the current alarm information are identified as target alarm clusters. The key-value parameters consist of one or more of the following: protocol address parameters, port parameters, and zone code parameters. Although multiple candidate alarm clusters may share the same protocol address parameter, a single alarm cluster can still be uniquely identified using port parameters and zone code parameters. In other words, the key-value parameter serves as an identifier to distinguish different alarm clusters; no two alarm clusters in the alarm queue will have the same key-value parameters. In one specific implementation, the key-value parameter is determined as follows: First, the protocol address parameter is converted, for example, the IP address is converted to binary form, and then the number of 0s in the converted binary IP address is obtained. Next, the port parameter and zone code parameter are converted to binary forms, and the number of 0s in each binary form is obtained. Finally, the number of 0s in the binary IP address, the binary port parameter, and the binary zone code parameter are added together to generate a decimal key-value parameter. The port parameter of each pre-alarm cluster is calculated and then compared with the key-value parameter of the current round of alarm information. Pre-alarm clusters with the same key-value parameter are identified as target alarm clusters. Since the protocol address parameter and key-value parameter are the same for both the current round of alarm information and the target alarm cluster, it indicates that all alarm information in the current round and the target alarm cluster originates from the same source, meaning they are alarm information generated by the same front-end monitoring device.

[0049] In one optional implementation, one or more candidate alarm clusters containing the same protocol address parameters as the current round of alarm information are selected from the alarm queue, which is achieved in the following way:

[0050] First, the protocol address parameters contained in the current round of alarm information and the protocol address parameters contained in each alarm cluster in the alarm queue are subjected to radix conversion processing to generate radix address parameters corresponding to the protocol address parameters. Specifically, the radix conversion parameter processing is used to convert the protocol address parameters contained in the current round of alarm information and each alarm cluster in the alarm queue into radix form; preferably, the protocol address parameters are converted into binary form during radix conversion. Since each radix address can uniquely generate a binary value after conversion, and each bit of the binary value can only be 0 or 1, converting to binary values ​​can effectively improve processing efficiency and speed compared to directly comparing each bit of the protocol address parameters to determine equality.

[0051] Then, based on the radix address parameters corresponding to all alarm clusters in the alarm queue, one or more alarm clusters with radix address parameters equal to those of the current round of alarm information are selected and determined as reserve alarm clusters.

[0052] In a specific example, the protocol address parameters of the current round of alarm information are converted into binary values. Then, the radix address parameters of each alarm cluster in the alarm queue are converted into binary values. Next, each bit of the binary value of the current round of alarm information is XORed with each bit of the corresponding binary value of each alarm cluster in the alarm queue. The result of the XOR operation is obtained. If the result of the XOR operation on each bit of the binary value is 0, it means that the value at the corresponding position is the same. If the result of the XOR operation on each bit of the binary value of the current round of alarm information and the binary value of a certain alarm cluster in the alarm queue is 0, it means that the binary values ​​are the same, that is, the radix address parameters are the same. For example, if the protocol address parameter of the current alarm message is 192.168.001.001, and the protocol address parameter of a certain alarm cluster in the alarm queue is also 192.168.001.001, then when comparing whether the protocol address parameter of the current alarm message is the same as that of the alarm cluster, to simplify calculation and improve processing efficiency, the two protocol address parameters are converted into binary form. After conversion, the binary protocol address parameter of the current alarm message is 1100000010. The protocol address parameter of this alarm cluster in binary form is 110000001010101000000000100000001. Since the result of an XOR operation on each bit of these two binary protocol address parameters is 0, it indicates that each bit is identical. This means that the protocol address parameter of this round of alarm information is the same as the protocol address parameter of this alarm cluster, and thus this alarm cluster can be identified as a potential alarm cluster.

[0053] If no alarm cluster with the same radix address parameter as the current alarm information exists in the alarm queue, it indicates that this is the first time the alarm queue has received alarm information from the front-end monitoring device corresponding to this round of alarm information. In this case, a new alarm cluster is created for this round of alarm information, and the alarm information is stored in that cluster. That is, if new alarm information from the front-end monitoring device corresponding to this round of alarm information appears in subsequent rounds, this alarm cluster can be designated as a candidate alarm cluster. When storing the current round of alarm information in the newly created alarm cluster, a key-value parameter corresponding to the current round of alarm information needs to be generated and associated with the new alarm cluster to uniquely identify it. This key-value parameter can be used to determine the target alarm cluster when selecting from multiple candidate alarm clusters in subsequent rounds.

[0054] Step S120: Based on the time status parameters of the current alarm information, select one or more target alarm information from the target alarm cluster; wherein the difference between the time status parameters of the target alarm information and the time status parameters of the current alarm information matches a preset time threshold.

[0055] In one optional implementation, one or more target alarm messages are selected from the target alarm cluster based on the time status parameters of the current alarm information. This can be achieved in the following way:

[0056] First, the time status parameters of each alarm message are obtained from the target alarm cluster, and the alarm occurrence time of each alarm message is obtained from the time status parameters. The target alarm cluster is an alarm cluster selected from the alarm queue that has the same protocol address parameters and key-value parameters as the alarm messages in this round. Since the target alarm cluster contains one or more alarm messages, it is necessary to further filter alarm messages that match the alarm messages in this round based on the time status parameters. The time status parameters include the alarm occurrence time and the alarm end time; the alarm occurrence time is the moment the alarm message begins to trigger, and the alarm end time is the moment the alarm message stops triggering. Since the main purpose of this application is to eliminate the massive amount of duplicate alarm messages generated by front-end monitoring devices in a short period of time, the duplicate alarm messages can be determined based on the alarm occurrence time, and subsequent filtering and fusion steps can be performed.

[0057] Then, the alarm occurrence time included in the time status parameters of the current round of alarm information is obtained, and a preset time threshold is acquired. If the time difference between the alarm occurrence time of the current round of alarm information and the alarm occurrence time of any alarm information in the target alarm cluster is less than the preset time threshold, then that alarm information is identified as the target alarm information. The preset time threshold is a manually set time parameter. If the time difference between the alarm occurrence time in the time status parameters of the current round of alarm information and the alarm occurrence time of any alarm information in the target alarm cluster is less than the preset time threshold, then it can be determined that this alarm information is highly likely to be a repeatedly triggered alarm information. For example, if the preset time threshold is 0.20s, and the alarm occurrence time included in the time status parameters of the current alarm information is +1.70s, and there are four alarm information A, B, C, and D in the target alarm cluster, whose alarm occurrence times included in their time status parameters are +1.60s, +1.42s, +1.67s, and +1.91s respectively, then it can be determined that alarm information A and C meet the preset time threshold. At this time, alarm information A and C are identified as target alarm information.

[0058] Optionally, when selecting one or more target alarm messages from the target alarm cluster based on the time status parameters of the current alarm information, the following method may also be included: First, obtain the time status parameters contained in each alarm message from the target alarm cluster, and obtain the alarm end time of each alarm message from the time status parameters; and obtain the alarm occurrence time contained in the time status parameters of the current alarm information; if the difference between the alarm occurrence time of the current alarm information and the alarm end time of any alarm message in the target alarm cluster is less than the preset maximum time interval, then any alarm message is determined as the target alarm information.

[0059] Step S130: Generate the alarm attribute similarity between the current round of alarm information and each target alarm information, and determine the target alarm information with the highest alarm attribute similarity to the current round of alarm information as the target alarm information to be fused.

[0060] In one optional implementation, the alarm attribute similarity between the generated current-round alarm information and each target alarm information is achieved in the following way:

[0061] First, the alarm occurrence time is obtained from the time status parameters of the current alarm information, and the corresponding historical alarm occurrence data is retrieved from the historical alarm database based on the alarm occurrence time. Based on the historical alarm occurrence data, a trigger confidence score corresponding to the current alarm information is generated. The trigger confidence score characterizes the probability that the current alarm information will be triggered at the alarm occurrence time. The historical alarm database stores a massive amount of historical alarm occurrence data, and each historical alarm occurrence data entry includes time status parameters, such as alarm occurrence time and alarm end time. When retrieving the corresponding historical alarm occurrence data, the alarm occurrence date and time are first determined based on the alarm occurrence time of the current alarm information's time status parameters. Then, historical alarm occurrence data with the corresponding date and time are filtered from the historical alarm database based on the alarm occurrence date and time of the current alarm information. Trigger confidence is used to characterize the probability that the current round of alarm information is actually triggered at the alarm occurrence time. It is a probability value. The higher the probability, the higher the probability that the current round of alarm information is actually triggered at the alarm occurrence time. The trigger confidence is calculated as follows: First, the historical alarm occurrence data for the corresponding date is obtained from the historical alarm database. Then, the historical alarm occurrence data for the corresponding time point is obtained. Finally, the trigger confidence is determined by the ratio of the historical alarm occurrence data for the corresponding time point to the historical alarm occurrence data for the corresponding date. For example, if the occurrence time of this round of alarm information is obtained from the time status parameter of this round of alarm information as 2023 / 9 / 26 / 02:16:21, it means that this round of alarm information was triggered at 2:16:21 AM on September 26, 2023; then, query the same historical time period from the historical alarm database; for example, if the total number of alarms that occurred on September 26, 2022 is denoted as n, and the number of warnings that occurred within the hour from 2:00 AM to 3:00 AM that occurred at 2:16 AM is denoted as m, then the formula for calculating the trigger confidence p represented by the same historical time point is: p = m / n. Preferably, when querying the number of warnings m, the query time period can be set according to different times: for example, the query time period is set to 1 hour from 6:30 am to 5:30 pm every day; and the query time period is set to 2 hours from 5:30 pm to 6:30 am the next day. Since there are more people active during the day, the probability of track intrusion events is much higher than at night. Therefore, setting different query time periods for day and night can obtain the probability of alarm events occurring in historical time periods in a more granular and dynamic way, which makes the obtained trigger confidence value more accurate.It should be noted that when the alarm information classification and fusion method is first running, the calculated trigger confidence score is low because the historical alarm database contains relatively little historical alarm data. However, as the system continues to run and the historical alarm data in the database becomes richer, the calculated trigger confidence score becomes more stable and accurate.

[0062] Then, a difference is calculated between the alarm occurrence time of any target alarm message and the alarm occurrence time of the current round of alarm messages to generate the occurrence time difference between the current round of alarm messages and any target alarm message. A time similarity weight is then generated based on the trigger confidence and the occurrence time difference. The time similarity weight consists of a power exponent and a power base, where the power exponent is determined by the occurrence time difference and the power base is determined by the trigger confidence. In the preceding steps of this embodiment, one or more target alarm messages whose alarm occurrence time is less than a preset time threshold have already been selected. At this point, it is necessary to calculate the occurrence time difference between the current round of alarm messages and any target alarm message, and then calculate the time similarity weight based on the trigger confidence and the occurrence time difference. The time similarity weight S... t (T x ,T y It is generated by calculation as follows:

[0063]

[0064] Among them, T x Indicates the time when the alarm occurred in this round of alarm information; T y This indicates the alarm occurrence time for any target alarm message; β is an adjustment parameter, the value of which is calculated by the trigger confidence level p = m / n, where m is the number of warnings that occurred within the corresponding historical time period, and n is the total number of alarms that occurred on the same day in the historical time period.

[0065] Finally, based on the time similarity weight, the alarm attribute similarity between the current round of alarm information and any target alarm information is determined. Specifically, the time similarity weight S between the current round of alarm information and any target alarm information is determined. t (T x ,T y After that, the similarity of alarm attributes can be adjusted by combining protocol address weights; protocol address weights S IP (IP x IP y The following method is used to determine the protocol address parameter IP of this round of alarm information: First, the IP address parameter of this round of alarm information is used to determine the protocol address parameter IP address of this round of alarm information. x and IP y Convert to binary numerical string IP BX and IP BYThen, targeting the IP address... BX and IP BY Perform an XOR operation on each corresponding binary value. Used to represent the number of zeros after performing an XOR operation; finally, S IP (IP x IP y It is generated in the following way:

[0066]

[0067] Specifically, after performing binary value conversion on the protocol address parameters, each protocol address parameter can generate a binary value string of length 32 characters; for example, if S IP (IP x IP y If ) = 1, then it means IP BX and IP BY If every bit of the binary value is the same, then the protocol address parameters of this round of warning information are exactly the same as those of the target warning information. It should be noted that the protocol address weight S... IP (IP x IP y The value ) indicates the similarity between the protocol address parameters of the target alarm information and the protocol address parameters of the current round of alarm information. Since the target alarm information is a pre-selected alarm information that has the same protocol address parameters as the current round of alarm information, S is calculated accordingly. IP (IP x IP y It takes a fixed value and is a constant.

[0068] Therefore, this application actually provides a method for calculating the alarm attribute similarity S(x,y) of any two alarm messages:

[0069] S(x,y)=S t (T x ,T y )+S IP (IP x IP y )

[0070]

[0071] Among them, S t (T x ,T y S represents the temporal similarity weight between any two alarm messages. IP (IP x IPy ) represents the protocol address weight between any two alarm messages. The derivation of the above formula has been described in detail in this embodiment and will not be repeated here.

[0072] In one optional implementation, after generating the trigger confidence level corresponding to the current round of alarm information based on historical alarm occurrence data, the following method is also included:

[0073] Obtain the illumination duration parameter corresponding to the alarm occurrence time of this round of alarm information, and adjust the trigger confidence based on the illumination duration parameter.

[0074] The sunshine duration parameter is the average sunshine duration of the season corresponding to the alarm occurrence time of this round of alarm information. It should be noted that, because the front-end monitoring equipment is easily affected by external meteorological factors, such as the sunshine duration in different seasons, it can greatly interfere with the monitoring and alarm of intrusion behavior around the rail transit perimeter, affecting the monitoring accuracy of the front-end monitoring equipment; therefore, this application creatively proposes the concept of sunshine duration parameter, which calculates the sunshine duration parameter for each season through the relationship function of sunshine duration with geographical latitude and seasonal variation, and uses it as a correction factor for trigger confidence to correct the trigger confidence.

[0075] Specifically, duration of sunlight exposure Calculated as follows:

[0076]

[0077] in, This represents the geographical latitude of the region where the duration of sunlight exposure needs to be calculated, and δ represents the solar declination angle; the solar declination angle δ is calculated as follows:

[0078]

[0079] Where n is the total number of dates in a year, such as n=1 for January 1st and n=365 for December 21st; for simplicity, the dates for calculating the duration of daylight in each season are taken as March 15th, April 15th, and May 15th for spring; June 15th, July 15th, and August 15th for summer; September 15th, October 15th, and November 15th for autumn; and December 15th, January 15th, and February 15th for winter; therefore, the n values ​​for each season are as follows: Spring (7... 4, 105, 136), Summer (167, 198, 229), Autumn (261, 292, 323), Winter (354, 15, 45); therefore, the solar declination angles corresponding to the four seasons can be further calculated as follows: Spring (-2.82°, 9.42°, 19.03°), Summer (23.35°, 21.18°, 13.12°), Autumn (1.00°, -11.04°, -20.03°), Winter (-23.44°, -21.27°, -13.62°). (Using Beijing's latitude...) For example, the daytime lengths for each season can be calculated as follows: Spring (8.37h, 12.05h, 10.06h), Summer (14.82h, 14.52h, 13.50h), Autumn (12.11h, 10.75h, 9.63h), and Winter (9.17h, 9.47h, 10.44h). Taking the average of three months within each season, the daytime hours in Beijing for each season are calculated to be 10.16h in spring, 14.28h in summer, 11.03h in autumn, and 10.00h in winter. Combining these average daytime hours with the sunrise and sunset times in Beijing, the estimated daylight hours for each season are: Spring 6:30-16:30, Summer 4:30-19:00, Autumn 6:00-17:00, and Winter 7:30-17:30. Therefore, in the following example, the step "When querying the number of warnings m, the query time period can be set according to different times" in the previous embodiment can be updated according to the daylight hours of Beijing in the four seasons: First, obtain the alarm occurrence time of the time status parameter of the current round of alarm information, and then determine the season in which the alarm information occurred based on the alarm occurrence time; for example, if the alarm occurrence time of the current round of alarm information is 2023 / 9 / 26 / 06:21:21, it means that the alarm occurrence season of the current round of alarm information is autumn, and it can be calculated that the daylight hours in autumn are from 6:00 am to 5:00 pm; then, it can be known that the alarm occurrence time of the current round of alarm information is during the daytime, so the query time period is set to 1 hour.

[0080] Step S140: Perform fusion processing on the alarm information in this round and the target alarm information to be fused to generate corresponding fused alarm information.

[0081] In one optional implementation, fusion processing is performed on the current alarm information and the target alarm information to be merged to generate corresponding fused alarm information, which is achieved in the following way:

[0082] First, obtain the first time status parameter and the first attribute value parameter corresponding to the alarm information in this round; and second, obtain the second time status parameter and the second attribute value parameter corresponding to the target alarm information to be merged.

[0083] Then, a comparison process is performed on the first time status parameter and the second time status parameter to determine the fusion start time and fusion end time based on the comparison result. The time status parameters include the alarm occurrence time and the alarm end time; the alarm occurrence time is the moment when the alarm information begins to trigger, and the alarm end time is the moment when the alarm information stops triggering. Specifically, during the comparison process, the first alarm occurrence time in the first time status parameter is first compared with the second alarm occurrence time in the second time status parameter, and the alarm occurrence time indicating the earlier occurrence is determined as the fusion start time; then, the first alarm end time in the first time status parameter is compared with the second alarm end time in the second time status parameter, and the alarm end time indicating the later end is determined as the fusion end time.

[0084] Next, a merging process is performed on the first attribute value parameter and the second attribute value parameter to generate a merged attribute value parameter. Specifically, during the merging process, the following sets are taken: the union of the first protocol address parameter in the first attribute value parameter and the second protocol address parameter in the second attribute value parameter; the union of the first port parameter in the first attribute value parameter and the second port parameter in the second attribute value parameter; and the union of the first zone code parameter in the first attribute value parameter and the second zone code parameter in the second attribute value parameter.

[0085] Finally, based on the fusion start time, fusion end time, and fusion attribute value parameters, fused alarm information corresponding to the current round of alarm information and the target alarm information to be fused is generated.

[0086] Preferably, to improve the flexibility of fusion, before performing fusion processing on the current round of alarm information and the target alarm information to be fused to generate the corresponding fused alarm information, the following steps are also included: First, obtain the fusion count of the target alarm information to be fused. If the fusion count is less than a preset truncation index, perform fusion processing on the current round of alarm information and the target alarm information to be fused to generate the corresponding fused alarm information. If the fusion count is greater than or equal to the preset truncation index, the target alarm information to be fused is removed, and the step of determining the target alarm information with the highest alarm attribute similarity to the current round of alarm information as the target alarm information to be fused is performed again. In other words, before each fusion, the fusion count of the target alarm information to be fused needs to be checked. If it exceeds the truncation index, the fusion process between the target alarm information to be fused and the current round of alarm information is stopped, and a new target alarm information to be fused is selected and fused with the current round of alarm information again. By changing the size of the truncation index, different fusion strengths can be selected, improving the flexibility of fusion.

[0087] For ease of understanding, Figure 2 A flowchart of a specific example is shown, and using this example as a case study, the specific implementation of the classification method in the alarm information classification and fusion method of this application is described in detail:

[0088] like Figure 2 As shown, the alarm information classification method includes the following steps:

[0089] Step S210: Obtain the attribute value parameters corresponding to the alarm information in this round; the attribute value parameters include one or more of the following: protocol address parameters, port parameters, and zone coding parameters.

[0090] Step S220: Perform a base conversion process on the protocol address parameters contained in the alarm information of this round and the protocol address parameters contained in each alarm cluster in the alarm queue to generate base address parameters corresponding to the protocol address parameters.

[0091] Step S230: Based on the radix address parameters corresponding to all alarm clusters in the alarm queue, select one or more alarm clusters that have the same radix address parameters as the alarm information in this round, and determine them as reserve alarm clusters.

[0092] Step S240: Select alarm clusters from the prepared alarm clusters that have the same key value parameters as the alarm information in this round, and determine them as target alarm clusters; wherein, the key value parameters are composed of one or more of the following: protocol address parameters, port parameters, and zone coding parameters.

[0093] Step S250: Obtain the time status parameters contained in each alarm message from the target alarm cluster, and obtain the alarm occurrence time of each alarm message from the time status parameters; obtain the alarm occurrence time contained in the time status parameters of the current round of alarm messages, and obtain a preset time threshold; if the time difference between the alarm occurrence time of the current round of alarm messages and the alarm occurrence time of any alarm message in the target alarm cluster is less than the preset time threshold, then determine any alarm message as the target alarm message; wherein, the difference between the time status parameters of the target alarm message and the time status parameters of the current round of alarm messages matches the preset time threshold.

[0094] In a specific example, when the alarm message Anew arrives in the current round, the attribute values ​​of Anew are first obtained, including the IP address, port address parameter Port, and zone code parameter DAC. Then, the IP address of Anew is converted into binary form and denoted as IPnew; at the same time, the IP addresses of all alarm clusters in the alarm queue As are also converted into binary form; the alarm clusters in the alarm queue As are identified by Ai, and the IP address of the alarm cluster Ai is identified by IPi; an XOR operation is performed between IPnew and each IPi to determine whether IPnew is equal to IPi; since binary only contains 0 and 1, an XOR operation is performed on each bit of IPnew and IPi, and if they are equal, the result is 0 (the IP address has 32 bits after conversion to binary, so the result of the XOR operation can have at most 32 zeros); the Ai corresponding to the IPi whose XOR operation result has 32 zeros is selected, and Ai is recorded as a reserve alarm cluster; there may be multiple reserve alarm clusters Ai in the alarm queue As. Next, a key-value parameter DAA is generated based on Anew's IP address, port address parameter Port, and zone code parameter DAC. This key-value parameter represents the zone warning attribute value. Simultaneously, the key-value parameters DAA of all candidate alarm clusters Ai are obtained and compared with Anew's DAA. If they are the same, the candidate alarm cluster with the same DAA is identified as the target alarm cluster. If no alarm cluster Ai with the same IP address as Anew exists in the alarm queue As, a new alarm cluster Ai is created, and Anew is added to this alarm cluster Ai. After identifying the target alarm cluster, since the target alarm cluster contains one or more alarm messages Dx, the alarm occurrence time of Anew and the alarm occurrence times of all alarm messages Dx in the alarm cluster Ai are obtained and compared. The alarm messages Dx in the alarm cluster Ai with a time difference less than a preset time threshold are identified as the target alarm messages Dxi.

[0095] For ease of understanding, Figure 3 A flowchart of a specific example is also shown, and this example is used to explain in detail the specific implementation of the fusion method in the alarm information classification and fusion method of this application:

[0096] like Figure 3 As shown, the alarm information fusion method includes the following steps:

[0097] S310: Obtain the alarm occurrence time from the time status parameters of the current alarm information, and query the corresponding historical alarm occurrence data from the historical alarm database based on the alarm occurrence time.

[0098] S320: Based on historical alarm occurrence data, generate a trigger confidence level corresponding to the current round of alarm information; wherein, the trigger confidence level is used to characterize the probability that the current round of alarm information will be triggered at the alarm occurrence time.

[0099] S330: Obtain the illumination duration parameter corresponding to the alarm occurrence time of this round of alarm information, and correct the trigger confidence based on the illumination duration parameter.

[0100] S340: Perform a difference operation on the alarm occurrence time of any target alarm information and the alarm occurrence time of the current round of alarm information to generate the occurrence time difference between the current round of alarm information and any target alarm information, and generate a time similarity weight based on the trigger confidence and the occurrence time difference; wherein, the time similarity weight consists of a power exponent and a power base, and the power exponent is determined by the occurrence time difference, and the power base is determined by the trigger confidence.

[0101] S350: Determine the alarm attribute similarity between the current alarm information and any target alarm information based on the time similarity weight.

[0102] S360: The target alarm information with the highest similarity to the alarm attributes of the current alarm information is identified as the target alarm information to be merged.

[0103] S370: Obtain the first time status parameter and the first attribute value parameter corresponding to the alarm information in this round; and obtain the second time status parameter and the second attribute value parameter corresponding to the target alarm information to be merged; perform comparison processing on the first time status parameter and the second time status parameter, and determine the fusion start time and fusion end time according to the comparison result; obtain the time status parameter and the attribute value parameter corresponding to the alarm information in this round and the target alarm information to be merged respectively; perform comparison processing on the time status parameter, determine the earlier start time in the time status parameter as the fusion start time, and determine the later end time in the time status parameter as the fusion end time; perform merging processing on the first attribute value parameter and the second attribute value parameter to generate the fusion attribute value parameter.

[0104] S380: Generate fused alarm information corresponding to the current round of alarm information and the target alarm information to be fused, based on the fusion start time, fusion end time, and fusion attribute value parameters.

[0105] In a specific example, after the target alarm information Dxi is determined, the historical alarm database is queried for historical alarm occurrence data that have the same date and time as Anew. For example, if the alarm Anew occurred at 9:30 AM on September 26, 2023, then the historical alarm database is queried for the number of historical warnings between 8:30 AM and 9:30 AM on September 26, 2022, and then the total number of warnings that occurred throughout the day on September 26, 2022 is obtained. Then, by using the ratio between the number of historical warnings and the total number of warnings, the trigger confidence level for Anew's actual alarm occurrence at 9:30 AM on September 26, 2023 can be calculated. Simultaneously, since calculating the trigger confidence level requires separate judgments for daytime and nighttime, the sunrise and sunset conditions at the time of Anew's trigger are needed to set the granularity of historical warning data within a certain timeframe. Therefore, by combining geographical latitude and solar declination angle, the average sunshine duration in different seasons can be calculated, and then combined with local sunrise and sunset conditions to determine whether there is sunshine at a specified time. If it is daytime with sunshine, the granularity is set to be smaller; if it is nighttime without sunshine, the granularity is set to be larger. This allows for dynamically obtaining the probability of an alarm event occurring within a certain period, making the obtained trigger confidence level value more accurate. Next, after obtaining the trigger confidence level, the alarm attribute similarity between Anew and any DIXi can be calculated. When generating the alarm attribute similarity, it is necessary to obtain the difference between the alarm start time of Anew and any DIXi, the trigger confidence level of Anew, and the IP address similarity between Anew and the DIXi. Finally, the DIXi with the highest calculated alarm similarity is identified as the alarm information to be merged, and Anew is merged with the alarm information to be merged. During merging, it is necessary to obtain the IP address, port address parameter (Port), zone code parameter (DAC), and alarm start and end times of Anew and the alarm information to be merged. When generating the alarm start time, the earlier alarm start time is taken; when generating the alarm end time, the later alarm end time is taken. Then, the IP address, port address parameter (Port), and zone code parameter (DAC) of the two are merged separately to finally generate the merged alarm information.

[0106] In summary, the alarm information classification and fusion method described above first classifies alarm information based on attribute value parameters, and then fuses the alarm information according to attribute similarity. This effectively reduces the massive amount of redundant information generated by front-end monitoring equipment, as well as false alarms and missed alarms, improving the processing speed and accuracy of the monitoring center and ensuring the perimeter safety of rail transit. Specifically, the alarm information classification and fusion method proposed in this invention can effectively fuse alarm information generated by various front-end monitoring devices, reducing the large number of missed alarms and false alarms caused by drastic changes in lighting conditions, as well as false alarms caused by accidental factors such as rain, fog, lightning, and birds. This method enables the perimeter intrusion prevention system to quickly adapt to drastic changes in lighting conditions, reducing false alarms; as the amount of historical alarm data increases, the trigger confidence value of this method becomes more reliable, and the fused alarms become more accurate.

[0107] In the embodiments provided in this disclosure, on the one hand, attribute value parameters corresponding to the current round of alarm information are obtained, and alarm clusters in the alarm queue that have the same attribute value parameters as the current round of alarm information are determined as target alarm clusters; wherein, the alarm queue contains one or more alarm clusters, and each alarm cluster contains one or more alarm information; on the other hand, one or more target alarm information are selected from the target alarm clusters according to the time status parameters of the current round of alarm information; wherein, the difference between the time status parameters of the target alarm information and the time status parameters of the current round of alarm information matches a preset time threshold; alarm attribute similarity between the current round of alarm information and each target alarm information is generated, and the target alarm information with the highest alarm attribute similarity to the current round of alarm information is determined as the target alarm information to be fused; fusion processing is performed on the current round of alarm information and the target alarm information to be fused to generate corresponding fused alarm information. This method utilizes the attribute value parameters of the current round of alarm information to search for target alarm clusters in the alarm queue that share the same attribute value parameters as the current round of alarm information. After finding the target alarm clusters, it then filters out matching target alarm information from the target alarm clusters based on the time status parameters included in the current round of alarm information. Next, it calculates the attribute similarity between the current round of alarm information and each target alarm information to determine the target alarm information to be fused. Finally, it fuses the current round of alarm information with the target alarm information to generate the corresponding fused alarm information. This application, by classifying first and then fusing, integrates newly acquired alarm information with the classified and matched alarm information, which can effectively reduce the massive amount of redundant information generated by front-end monitoring equipment, as well as false alarms and missed alarms, improve the processing speed and accuracy of the monitoring center, and ensure the perimeter safety of rail transit.

[0108] Figure 4 A block diagram of an alarm information classification and fusion apparatus provided in an embodiment of this disclosure is shown.

[0109] Reference Figure 4 This disclosure provides an alarm information classification and fusion device 40, comprising:

[0110] The determination module 41 is adapted to obtain the attribute value parameters corresponding to the alarm information in the current round, and determine the alarm clusters in the alarm queue that have the same attribute value parameters as the alarm information in the current round as the target alarm clusters; wherein, the alarm queue contains one or more alarm clusters, and each alarm cluster contains one or more alarm information;

[0111] The filtering module 42 is adapted to filter one or more target alarm messages from the target alarm cluster based on the time status parameters of the current alarm information; wherein the difference between the time status parameters of the target alarm information and the time status parameters of the current alarm information matches a preset time threshold.

[0112] The fusion module 43 is adapted to generate the alarm attribute similarity between the current round of alarm information and each target alarm information, and to determine the target alarm information with the highest alarm attribute similarity to the current round of alarm information as the target alarm information to be fused; and is adapted to perform fusion processing on the current round of alarm information and the target alarm information to be fused to generate corresponding fused alarm information.

[0113] In one optional implementation, the attribute value parameters corresponding to the alarm information in this round include one or more of the following: protocol address parameters, port parameters, and zone coding parameters.

[0114] Then module 41 is also suitable for:

[0115] Select one or more potential alarm clusters from the alarm queue that have the same protocol address parameters as the current alarm information, and select alarm clusters from the potential alarm clusters that have the same key value parameters as the current alarm information to determine them as target alarm clusters; wherein, the key value parameters consist of one or more of the following: protocol address parameters, port parameters, and zone coding parameters.

[0116] In one alternative implementation, module 41 is also adapted to:

[0117] Perform a base conversion process on the protocol address parameters contained in the current alarm information and the protocol address parameters contained in each alarm cluster in the alarm queue to generate base address parameters corresponding to the protocol address parameters;

[0118] Based on the radix address parameters corresponding to all alarm clusters in the alarm queue, select one or more alarm clusters with radix address parameters equal to those of the current round of alarm information and determine them as reserve alarm clusters;

[0119] If there is no alarm cluster in the alarm queue that matches the radix address parameter of the current alarm information, a new alarm cluster is created for the current alarm information; a key-value parameter corresponding to the current alarm information is generated and associated with the new alarm cluster.

[0120] In one alternative implementation, the filtering module 42 is also adapted to:

[0121] Obtain the time status parameters contained in each alarm message from the target alarm cluster, and obtain the alarm occurrence time of each alarm message from the time status parameters;

[0122] Obtain the alarm occurrence time from the time status parameters of this round of alarm information, and obtain the preset time threshold;

[0123] If the time difference between the alarm occurrence time of the current alarm information and the alarm occurrence time of any alarm information in the target alarm cluster is less than the preset window time, then any alarm information will be identified as the target alarm information.

[0124] In one alternative implementation, the fusion module 43 is also adapted to:

[0125] The alarm occurrence time is obtained from the time status parameters of the current alarm information, and the corresponding historical alarm occurrence data is retrieved from the historical alarm database based on the alarm occurrence time; based on the historical alarm occurrence data, a trigger confidence level corresponding to the current alarm information is generated; wherein, the trigger confidence level is used to characterize the probability that the current alarm information is triggered at the alarm occurrence time;

[0126] For any target alarm message, the alarm occurrence time is calculated by subtracting the alarm occurrence time from the alarm occurrence time of the current alarm message to generate the occurrence time difference between the current alarm message and any target alarm message. Then, a time similarity weight is generated based on the trigger confidence and the occurrence time difference. The time similarity weight consists of a power exponent and a power base, where the power exponent is determined by the occurrence time difference and the power base is determined by the trigger confidence.

[0127] Based on the time similarity weight, the alarm attribute similarity between the current alarm information and any target alarm information is determined.

[0128] In one alternative implementation, the fusion module 43 is also adapted to:

[0129] Obtain the illumination duration parameter corresponding to the alarm occurrence time of this round of alarm information, and adjust the trigger confidence based on the illumination duration parameter.

[0130] In one alternative implementation, the fusion module 43 is also adapted to:

[0131] Obtain the first time status parameter and the first attribute value parameter corresponding to the alarm information in this round; and obtain the second time status parameter and the second attribute value parameter corresponding to the target alarm information to be merged.

[0132] A comparison process is performed on the first time state parameter and the second time state parameter, and the fusion start time and fusion end time are determined based on the comparison result; the time state parameter and attribute value parameter corresponding to the alarm information in this round and the target alarm information to be merged are obtained respectively.

[0133] A comparison process is performed on the time status parameters, and the earlier start time in the time status parameters is determined as the fusion start time, and the later end time in the time status parameters is determined as the fusion end time.

[0134] Perform a merging process on the first attribute value parameter and the second attribute value parameter to generate a merged attribute value parameter;

[0135] Based on the fusion start time, fusion end time, and fusion attribute value parameters, generate fused alarm information corresponding to the current round of alarm information and the target alarm information to be fused.

[0136] Figure 5 This is a block diagram of an electronic device provided in an embodiment of the present disclosure.

[0137] Reference Figure 5 This disclosure provides an electronic device, which includes: at least one processor 501; at least one memory 502; and one or more I / O interfaces 503 connected between the processor 501 and the memory 502; wherein the memory 502 stores one or more computer programs that can be executed by the at least one processor 501, and the one or more computer programs are executed by the at least one processor 501 to perform the alarm information classification and fusion method described above.

[0138] This disclosure also provides a computer-readable storage medium storing a computer program thereon, wherein the computer program, when executed by a processor / processor core, implements the alarm information classification and fusion method described above. The computer-readable storage medium may be volatile or non-volatile.

[0139] This disclosure also provides a computer program product, including computer-readable code, or a non-volatile computer-readable storage medium carrying computer-readable code. When the computer-readable code is run in the processor of an electronic device, the processor in the electronic device executes the above-described alarm information classification and fusion method.

[0140] Those skilled in the art will understand that all or some of the steps, systems, and apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software can be distributed on a computer-readable storage medium, which may include computer storage media (or non-transitory media) and communication media (or transient media).

[0141] As is known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable program instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), static random access memory (SRAM), flash memory or other memory technologies, portable compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, it is known to those skilled in the art that communication media typically contain computer-readable program instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0142] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0143] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0144] The computer program product described herein can be implemented specifically through hardware, software, or a combination thereof. In one alternative embodiment, the computer program product is specifically embodied in a computer storage medium; in another alternative embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0145] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0146] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0147] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0148] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0149] Example embodiments have been disclosed herein, and while specific terminology has been used, it is for illustrative purposes only and should be construed as such, and is not intended to be limiting. In some instances, it will be apparent to those skilled in the art that features, characteristics, and / or elements described in connection with particular embodiments may be used alone, or in combination with features, characteristics, and / or elements described in connection with other embodiments, unless otherwise expressly indicated. Therefore, those skilled in the art will understand that various changes in form and detail may be made without departing from the scope of this disclosure as set forth by the appended claims.

Claims

1. A method for classifying and fusing alarm information, characterized in that, include: Obtain the attribute value parameters corresponding to the alarm information in this round, and determine the alarm clusters in the alarm queue that have the same attribute value parameters as the alarm information in this round as the target alarm clusters; wherein, the alarm queue contains one or more alarm clusters, and each alarm cluster contains one or more alarm information; Based on the time status parameters of the current alarm information, one or more target alarm information are selected from the target alarm cluster; wherein, the difference between the time status parameters of the target alarm information and the time status parameters of the current alarm information matches a preset time threshold. The alarm attribute similarity between the current round of alarm information and each target alarm information is calculated, and the target alarm information with the highest alarm attribute similarity to the current round of alarm information is identified as the target alarm information to be fused. Perform fusion processing on the current alarm information and the target alarm information to be fused to generate corresponding fused alarm information; The alarm attribute similarity between the generated alarm information and each target alarm information includes: The alarm occurrence time is obtained from the time status parameters of the current alarm information, and the corresponding historical alarm occurrence data is queried from the historical alarm database according to the alarm occurrence time; based on the historical alarm occurrence data, a trigger confidence level corresponding to the current alarm information is generated; wherein, the trigger confidence level is used to characterize the probability that the current alarm information is triggered at the alarm occurrence time; For any target alarm message, the alarm occurrence time is subtracted from the alarm occurrence time of the current round of alarm messages to generate the occurrence time difference between the current round of alarm messages and the target alarm message. A time similarity weight is generated based on the trigger confidence and the occurrence time difference. The time similarity weight consists of a power exponent and a power base, where the power exponent is determined by the occurrence time difference and the power base is determined by the trigger confidence. Based on the time similarity weight, the alarm attribute similarity between the current alarm information and any target alarm information is determined.

2. The method according to claim 1, characterized in that, The attribute value parameters corresponding to the alarm information in this round include one or more of the following: protocol address parameters, port parameters, and zone coding parameters. The step of determining the alarm clusters in the alarm queue that have the same attribute value parameters as the alarm information in the current round as the target alarm cluster includes: One or more candidate alarm clusters containing the same protocol address parameters as the current alarm information are selected from the alarm queue, and alarm clusters with the same key value parameters as the current alarm information are selected from the candidate alarm clusters and determined as target alarm clusters. The key-value parameter is composed of one or more of the following: protocol address parameter, port parameter, and zone coding parameter.

3. The method according to claim 2, characterized in that, The step of selecting one or more preliminary alarm clusters from the alarm queue that contain the same protocol address parameters as the current round of alarm information includes: Perform a base conversion process on the protocol address parameters contained in the alarm information of this round and the protocol address parameters contained in each alarm cluster in the alarm queue to generate base address parameters corresponding to the protocol address parameters; Based on the radix address parameters corresponding to all alarm clusters in the alarm queue, one or more alarm clusters with radix address parameters equal to those of the current round of alarm information are selected and determined as reserve alarm clusters. If there is no alarm cluster in the alarm queue that has the same radix address parameter as the alarm information in this round, then a new alarm cluster is created for the alarm information in this round; a key-value parameter corresponding to the alarm information in this round is generated and associated with the new alarm cluster.

4. The method according to claim 3, characterized in that, The step of selecting one or more target alarm messages from the target alarm cluster based on the time status parameters of the current round of alarm information includes: Obtain the time status parameters contained in each alarm message from the target alarm cluster, and obtain the alarm occurrence time of each alarm message from the time status parameters; Obtain the alarm occurrence time from the time status parameters of this round of alarm information, and obtain the preset time threshold; If the time difference between the alarm occurrence time of the current alarm information and the alarm occurrence time of any alarm information in the target alarm cluster is less than the preset window time, then the alarm information is determined as the target alarm information.

5. The method according to claim 4, characterized in that, The step involves performing fusion processing on the current round of alarm information and the target alarm information to be fused, generating corresponding fused alarm information, including: Obtain the first time status parameter and the first attribute value parameter corresponding to the alarm information in this round; and obtain the second time status parameter and the second attribute value parameter corresponding to the target alarm information to be merged. A comparison process is performed on the first time state parameter and the second time state parameter, and the fusion start time and fusion end time are determined based on the comparison result. A merging process is performed on the first attribute value parameter and the second attribute value parameter to generate a merged attribute value parameter; Based on the fusion start time, fusion end time, and fusion attribute value parameters, fusion alarm information corresponding to the current round alarm information and the target alarm information to be fused is generated.

6. The method according to claim 5, characterized in that, After generating the trigger confidence level corresponding to the current round of alarm information based on the historical alarm occurrence data, the method further includes: Obtain the illumination duration parameter corresponding to the alarm occurrence time of this round of alarm information, and correct the trigger confidence based on the illumination duration parameter.

7. An alarm information classification and fusion device, characterized in that, include: The determination module is adapted to obtain the attribute value parameters corresponding to the alarm information in the current round, and determine the alarm clusters in the alarm queue that have the same attribute value parameters as the alarm information in the current round as the target alarm clusters; wherein, the alarm queue contains one or more alarm clusters, and each alarm cluster contains one or more alarm information; The filtering module is adapted to filter one or more target alarm messages from the target alarm cluster based on the time status parameters of the current alarm message; wherein the difference between the time status parameters of the target alarm message and the time status parameters of the current alarm message matches a preset time threshold. The fusion module is adapted to generate the alarm attribute similarity between the current round of alarm information and each target alarm information, and to determine the target alarm information with the highest alarm attribute similarity to the current round of alarm information as the target alarm information to be fused; and is adapted to perform fusion processing on the current round of alarm information and the target alarm information to be fused to generate corresponding fused alarm information; The alarm attribute similarity between the generated alarm information and each target alarm information includes: The alarm occurrence time is obtained from the time status parameters of the current alarm information, and the corresponding historical alarm occurrence data is queried from the historical alarm database according to the alarm occurrence time; based on the historical alarm occurrence data, a trigger confidence level corresponding to the current alarm information is generated; wherein, the trigger confidence level is used to characterize the probability that the current alarm information is triggered at the alarm occurrence time; For any target alarm message, the alarm occurrence time is subtracted from the alarm occurrence time of the current round of alarm messages to generate the occurrence time difference between the current round of alarm messages and the target alarm message. A time similarity weight is generated based on the trigger confidence and the occurrence time difference. The time similarity weight consists of a power exponent and a power base, where the power exponent is determined by the occurrence time difference and the power base is determined by the trigger confidence. Based on the time similarity weight, the alarm attribute similarity between the current alarm information and any target alarm information is determined.

8. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores one or more computer programs that can be executed by the at least one processor, the one or more computer programs being executed by the at least one processor to enable the at least one processor to perform the method as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, The computer program, when executed by a processor, implements the method as described in any one of claims 1-6.

Images