Intelligent dialing test alarm method and device based on multi-dimensional data analysis

Abstract

The application relates to an intelligent dialing test alarm method and device based on multidimensional data analysis. The method comprises the following steps: acquiring dialing test alarm data and reference alarm data; the dialing test alarm data comprises a first alarm object, the reference alarm data comprises a second alarm object and an alarm category corresponding to the second alarm object; the dialing test alarm data is generated by a dialing test platform; based on the correlation between the second alarm object and the first alarm object, a main correlation alarm data set and a secondary correlation alarm data set are extracted from the reference alarm data; the main correlation alarm data set and the secondary correlation data set are respectively input into a pre-trained word vector model together with the dialing test alarm data, and an alarm root cause corresponding to the dialing test alarm data is acquired. The method can effectively locate the alarm cause of the dialing test platform.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of probing monitoring, in particular to an intelligent probing alarm method and device based on multi-dimensional data analysis. BACKGROUND

[0002] Probing refers to a monitoring method of simulating terminal users to actively access and test applications to obtain various performance indicators of the applications to monitor the availability of Internet systems.

[0003] However, the existing probing monitoring is usually black-box detection, which can only monitor whether the system service is available or unavailable, and when the probing alarm occurs, the specific cause of the problem cannot be located. SUMMARY

[0004] Therefore, it is necessary to provide an intelligent probing alarm method and device based on multi-dimensional data analysis which can locate the alarm cause of the probing platform to solve the above technical problems.

[0005] In a first aspect, the present application provides an intelligent probing alarm method based on multi-dimensional data analysis, comprising:

[0006] obtaining probing alarm data and reference alarm data; the probing alarm data comprises a first alarm object, the reference alarm data comprises a second alarm object and an alarm category corresponding to the second alarm object; the probing alarm data is generated by a probing platform;

[0007] extracting a primary associated alarm data set and a secondary associated alarm data set from the reference alarm data based on the association between the second alarm object and the first alarm object;

[0008] inputting the primary associated alarm data set and the secondary associated data set into a pre-trained word vector model respectively, and obtaining an alarm root cause corresponding to the probing alarm data.

[0009] In one of the embodiments, obtaining the reference alarm data comprises:

[0010] collecting initial alarm data in real time;

[0011] extracting the initial alarm data generated in a preset time period to obtain the reference alarm data;

[0012] The preset time period is a continuous time period containing the generation time of the probing alarm data.

[0013] In one of the embodiments, extracting the primary associated alarm data set and the secondary associated alarm data set from the reference alarm data based on the association between the second alarm object and the first alarm object comprises:

[0014] extract reference alarm data corresponding to the second alarm object identical to the first alarm object, to form a primary associated alarm data set;

[0015] extract reference alarm data corresponding to the second alarm object having a scene topology relationship with the first alarm object, to form a secondary associated alarm data set.

[0016] In one of the embodiments, the primary associated alarm data set and the secondary associated data set are respectively input into the pre-trained word vector model with the stress test alarm data, and the alarm root cause corresponding to the stress test alarm data includes:

[0017] The primary associated alarm data set and the stress test alarm data are input into the word vector model to obtain similarity scores between each element in the primary associated alarm data set and the stress test alarm data, and the second alarm objects corresponding to each element in the primary associated alarm data set are sorted according to the similarity scores to obtain a primary associated alarm list;

[0018] The secondary associated alarm data set and the stress test alarm data are input into the word vector model to obtain similarity scores between each element in the secondary associated alarm data set and the stress test alarm data, and the second alarm objects corresponding to each element in the secondary associated alarm data set are sorted according to the similarity scores to obtain a secondary associated alarm list;

[0019] The alarm root cause is obtained according to the primary associated alarm list and the secondary associated alarm list.

[0020] In one of the embodiments, the alarm root cause is obtained according to the primary associated alarm list and the secondary associated alarm list, including:

[0021] The alarm categories corresponding to the second alarm objects in the primary associated alarm list are extracted in order from large to small according to the similarity scores, and a primary alarm category is obtained;

[0022] The alarm categories corresponding to the second alarm objects in the secondary associated alarm list are extracted in order from large to small according to the similarity scores, and a secondary alarm category is obtained;

[0023] The alarm root cause is obtained according to the primary alarm category and the secondary alarm category.

[0024] In one of the embodiments, the training of the word vector model includes:

[0025] collecting historical alarm data;

[0026] sorting the historical alarm data according to the collection time, and segmenting the historical alarm data in a sliding time window manner to obtain a plurality of alarm sets having time correlation;

[0027] The time sequence features of the alarm set are extracted by using a regression algorithm based on global word frequency statistics, and vector representations of the historical alarm data are obtained.

[0028] The similarity scores between the pairs of historical alarm data are obtained according to the Euclidean distances of the vector representations of the pairs of historical alarm data.

[0029] In a second aspect, the present application provides an intelligent dialing test alarm device based on multi-dimensional data analysis, which comprises:

[0030] A data acquisition module is configured to acquire dialing test alarm data and reference alarm data; the dialing test alarm data comprises a first alarm object, and the reference alarm data comprises a second alarm object and an alarm category corresponding to the second alarm object; the dialing test alarm data is generated by a dialing test platform.

[0031] An associated data extraction module is configured to extract a primary associated alarm data set and a secondary associated alarm data set from the reference alarm data based on the association between the second alarm object and the first alarm object.

[0032] A root cause output module is configured to input the primary associated alarm data set and the secondary associated data set into a word vector model respectively, and obtain an alarm root cause corresponding to the dialing test alarm data.

[0033] In a third aspect, the present application provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0034] The dialing test alarm data and the reference alarm data are acquired; the dialing test alarm data comprises a first alarm object, and the reference alarm data comprises a second alarm object and an alarm category corresponding to the second alarm object; the dialing test alarm data is generated by a dialing test platform.

[0035] The primary associated alarm data set and the secondary associated alarm data set are extracted from the reference alarm data based on the association between the second alarm object and the first alarm object.

[0036] The primary associated alarm data set and the secondary associated data set are input into a pre-trained word vector model respectively, and an alarm root cause corresponding to the dialing test alarm data is obtained.

[0037] In a fourth aspect, the present application provides a computer readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the following steps:

[0038] The dialing test alarm data and the reference alarm data are acquired; the dialing test alarm data comprises a first alarm object, and the reference alarm data comprises a second alarm object and an alarm category corresponding to the second alarm object; the dialing test alarm data is generated by a dialing test platform.

[0039] Based on the correlation between the second alarm object and the first alarm object, the primary related alarm dataset and the secondary related alarm dataset are extracted from the reference alarm data;

[0040] The primary and secondary related alarm datasets are input into a pre-trained word vector model along with the dial-up alarm data to obtain the root causes of the alarms corresponding to the dial-up alarm data.

[0041] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0042] Acquire test alarm data and reference alarm data; test alarm data includes the first alarm object, and reference alarm data includes the second alarm object and the alarm category corresponding to the second alarm object; test alarm data is generated by the test platform.

[0043] Based on the correlation between the second alarm object and the first alarm object, the primary related alarm dataset and the secondary related alarm dataset are extracted from the reference alarm data;

[0044] The primary and secondary related alarm datasets are input into a pre-trained word vector model along with the dial-up alarm data to obtain the root causes of the alarms corresponding to the dial-up alarm data.

[0045] The aforementioned intelligent dial-up alarm method and apparatus based on multi-dimensional data analysis acquires dial-up alarm data and reference alarm data. The dial-up alarm data includes a first alarm object, and the reference alarm data includes a second alarm object and the alarm category corresponding to the second alarm object. The dial-up alarm data is generated by a dial-up platform. Based on the correlation between the second alarm object and the first alarm object, a primary related alarm dataset and a secondary related alarm dataset are extracted from the reference alarm data. The primary related alarm dataset and the secondary related alarm dataset are then input into a pre-trained word vector model along with the dial-up alarm data to obtain the root cause of the alarm corresponding to the dial-up alarm data. This application effectively reduces the difficulty of alarm analysis and quickly locates the root cause of the alarm by performing multi-dimensional analysis and association between dial-up alarm information and reference alarm information, including alarm objects and semantics, and combining the alarm categories in the reference alarm information to predict the root cause of the alarm corresponding to the dial-up alarm data. This helps to shorten the fault recovery time. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1This is an application environment diagram of an intelligent dial-up alarm method based on multi-dimensional data analysis in one embodiment;

[0048] Figure 2 This is a flowchart illustrating an intelligent dialing alarm method based on multi-dimensional data analysis in one embodiment.

[0049] Figure 3 This is a schematic diagram illustrating the segmentation of historical alarm data into alarm sets in one embodiment;

[0050] Figure 4 This is a flowchart illustrating an intelligent dialing alarm method based on multi-dimensional data analysis in one embodiment.

[0051] Figure 5 This is a structural block diagram of an intelligent dial-up alarm device based on multi-dimensional data analysis in one embodiment;

[0052] Figure 6 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0054] The intelligent dialing alarm method based on multi-dimensional data analysis provided in this application embodiment can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104, or it can be located in the cloud or on other network servers. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, etc. Server 104 can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0055] In one exemplary embodiment, such as Figure 2 As shown, an intelligent dialing alarm method based on multi-dimensional data analysis is provided, which is then applied to... Figure 1 Taking terminal 102 as an example, the explanation includes the following steps 202 to 206. Wherein:

[0056] Step 202: Obtain test alarm data and reference alarm data; the test alarm data includes a first alarm object, and the reference alarm data includes a second alarm object and the alarm category corresponding to the second alarm object; the test alarm data is generated by the test platform.

[0057] The testing platform monitors the monitored objects based on the testing tasks configured by the administrators and obtains testing alarm data. Testing tasks include information such as the monitored object, operational checks, and testing addresses. In addition to testing tasks, administrators also configure scenario topologies on the testing platform. Scenario topologies include the upstream and downstream relationships between the monitored objects of different testing tasks; for example, the caller is the downstream, and the callee is the upstream.

[0058] The reference alarm data refers to alarm-related data obtained in real time from various monitoring platforms. Common monitoring platforms include test platforms, Prometheus, and Zabbix.

[0059] Both test alarm data and reference alarm data are collections of several independent alarm events. Each alarm event includes detailed data information such as the alarm object and alarm channel. For ease of distinction, the alarm objects involved in the test alarm data are referred to as the first alarm object, and the alarm objects involved in the reference alarm data are referred to as the second alarm object. One difference between reference alarm data and test alarm data is that reference alarm data also includes the alarm category corresponding to the alarm event, which can reflect the cause of the fault to some extent; while the test platform can hardly locate a definite cause of the fault, that is, the test alarm data directly collected from the test platform does not include alarm categories.

[0060] Alarm categories can include network performance, application status, and infrastructure. Network performance includes response time and connectivity; application status includes service interfaces and logs; and infrastructure includes virtual machines, containers, databases, and operating systems.

[0061] Step 204: Based on the correlation between the second alarm object and the first alarm object, extract the primary related alarm dataset and the secondary related alarm dataset from the reference alarm data.

[0062] By referencing the scenario topology configured by administrators on the testing platform, alarm objects with topological relationships to the first alarm object can be matched with the second alarm object to determine the correlation strength between the second and first alarm objects. Based on the correlation strength, reference alarm data corresponding to several second alarm objects with strong correlation are selected to form the primary correlated alarm dataset; reference alarm data corresponding to several second alarm objects with weak correlation are selected to form the secondary correlated alarm dataset; the remaining second alarm objects are unrelated to the first alarm object, and their corresponding reference alarm data form the uncorrelated alarm dataset.

[0063] The ultimate goal of segmenting the reference alarm data is to remove reference alarm data that is irrelevant to the test alarm data and to obtain reference alarm data that may be strongly correlated with the test alarm data and reference alarm data that may be weakly correlated with the test alarm data. These are the primary related alarm dataset and the secondary related alarm dataset, which facilitate subsequent targeted processing to achieve more accurate root cause analysis.

[0064] Step 206: Input the main associated alarm dataset and the secondary associated alarm dataset, along with the dial-up alarm data, into the pre-trained word vector model to obtain the alarm root causes corresponding to the dial-up alarm data.

[0065] Word vector modeling is a natural language processing technique that converts text into vector representations, aiming to capture the semantic relationship between text and its context.

[0066] By processing the primary associated alarm dataset and the dial-up alarm data using a word vector model, the relationship between them can be obtained. Similarly, by processing the secondary associated alarm dataset and the dial-up alarm data using a word vector model, the relationship between them can be obtained. Finally, by combining these two relationships, as well as the alarm categories contained in the primary and secondary associated alarm datasets, the root cause of the alarms corresponding to the dial-up alarm data can be determined.

[0067] This embodiment analyzes and associates test alarm information with reference alarm information in multiple dimensions, including alarm objects and semantics. By combining the alarm categories in the reference alarm information, it predicts the root cause of the alarm corresponding to the test alarm data, effectively reducing the difficulty of alarm analysis and quickly locating the root cause of the alarm, which helps to shorten the fault recovery time.

[0068] In one embodiment, step 202, obtaining reference alarm data includes: real-time acquisition of initial alarm data; extraction of initial alarm data generated within a preset time period to obtain reference alarm data; wherein, the preset time period is a continuous time period including the generation time of the dial-up alarm data.

[0069] Real-time collection of alarm data generated by alarm sources from various monitoring platforms to obtain initial alarm data. Assuming the generation time of the alarm data is T, the initial alarm data generated within a preset time period from (Ta) to (T+b) is extracted to obtain reference alarm data. Here, a and b are both positive numbers, and their settings can be adjusted according to the actual business scenario. The preset time period determined by a and b is adjusted accordingly.

[0070] The initial alarm data is extracted using the generation time of the dial-up alarm data. The initial alarm data within a preset time period of the dial-up alarm data is retained to form reference alarm data. This establishes a temporal correlation between the reference alarm data and the dial-up alarm data, further accelerating the root cause analysis and improving its accuracy.

[0071] After obtaining reference alarm data, it can be filtered. Reference alarm data consists of information from several alarm events, each of which may include the alarm object, alarm channel, alarm metric, alarm level, and alarm details. Data filtering can eliminate duplicate alarm events of the same type; duplicate alarm events are considered to have the same alarm object, alarm channel, alarm metric, alarm level, and alarm details. Data filtering reduces noise and improves data validity.

[0072] In one embodiment, step 204 includes: extracting reference alarm data corresponding to a second alarm object that is the same as the first alarm object, and forming a primary associated alarm dataset; extracting reference alarm data corresponding to a second alarm object that has a scene topology relationship with the first alarm object, and forming a secondary associated alarm dataset.

[0073] If the second alarm object of a certain alarm event in the reference alarm data is the same as the first alarm object, then the reference alarm data is added to the main associated alarm data set.

[0074] When the second alarm object of a certain alarm event in the reference alarm data has a scene topology relationship with the first alarm object, that is, when the first alarm object and the second alarm object have an upstream and downstream relationship, the reference alarm data is added to the secondary related alarm data set.

[0075] After the above operations, the reference alarm data is reclassified into primary related alarm datasets, secondary related alarm datasets, and unrelated alarm datasets.

[0076] This embodiment can correlate alarm data from the test with reference alarm data in terms of scene topology, thereby accelerating the root cause analysis and improving its accuracy.

[0077] In one embodiment, step 206 includes: inputting the primary associated alarm dataset and the dial-up alarm data into a word vector model, obtaining a similarity score between each element in the primary associated alarm dataset and the dial-up alarm data, sorting the second alarm objects corresponding to each element in the primary associated alarm dataset according to the similarity score, and obtaining a primary associated alarm list; inputting the secondary associated alarm dataset and the dial-up alarm data into a word vector model, obtaining a similarity score between each element in the secondary associated alarm dataset and the dial-up alarm data, sorting the second alarm objects corresponding to each element in the secondary associated alarm dataset according to the similarity score, and obtaining a secondary associated alarm list; and obtaining the alarm root cause based on the primary associated alarm list and the secondary associated alarm list.

[0078] The word vector model can convert the main associated alarm dataset and the call alarm data into vectors. By using Euclidean distance to score the similarity of the vectors, the similarity between each element of the main associated alarm dataset and the call alarm data in terms of alarm events can be obtained. Then, the main associated alarm list can be obtained by sorting the data according to the similarity.

[0079] Similarly, word vector models can convert the textual descriptions of secondary related alarm datasets and dial-up alarm data into vectors. By using Euclidean distance to score the similarity of the vectors, the similarity between each element of the secondary related alarm dataset and the dial-up alarm data in terms of alarm events can be obtained. Then, by sorting according to the similarity, a list representing secondary related alarms can be obtained.

[0080] By using primary and secondary related alarm lists, we can further explore the correlation between reference alarm data and test alarm data to locate alarm problems.

[0081] In one embodiment, obtaining the root cause of an alarm based on the primary associated alarm list and the secondary associated alarm list includes: extracting alarm categories corresponding to second alarm objects in descending order of similarity scores from the primary associated alarm list to obtain the primary alarm category; extracting alarm categories corresponding to second alarm objects in descending order of similarity scores from the secondary associated alarm list to obtain the secondary alarm category; and obtaining the root cause of the alarm based on the primary alarm category and the secondary alarm category.

[0082] Based on the similarity scores from largest to smallest, extract alarm events from the main associated alarm list with a quantity equal to the first threshold, and then extract the second alarm object and alarm category corresponding to each alarm event to form the main alarm category.

[0083] Similarly, based on the similarity scores from largest to smallest, alarm events of the second threshold quantity are extracted from the secondary associated alarm list. Then, the secondary alarm object and alarm category corresponding to each alarm event are extracted to form a secondary alarm category.

[0084] For example, if both the first and second thresholds are 3, then the top three alarm events with the highest similarity scores and their corresponding alarm categories are extracted from the primary associated alarm list to form the primary alarm categories; similarly, the top three alarm events with the highest similarity scores and their corresponding alarm categories are extracted from the secondary associated alarm list to form the secondary alarm categories. It should be noted that the number of primary alarm categories may be equal to or less than the first threshold, because the alarm events extracted based on similarity scores may be of the same type. Similarly, the number of secondary alarm categories may be equal to or less than the second threshold.

[0085] After obtaining the primary and secondary alarm categories, the primary and secondary alarm categories are integrated into a root cause alarm notification and pushed to the administrator. The administrator then analyzes and processes the alarm cause and resolves the fault based on the root cause alarm notification.

[0086] In one embodiment, training the word vector model includes: collecting historical alarm data; sorting the historical alarm data according to the collection time, segmenting the historical alarm data using a sliding time window to obtain several alarm sets with time correlation; extracting the temporal features of the alarm sets using a regression algorithm based on global word frequency statistics to obtain the vector representation of each historical alarm data; and obtaining the similarity score between pairs of historical alarm data based on the Euclidean distance between the corresponding vector representations of each pair of historical alarm data.

[0087] Among them, the global word frequency statistical regression algorithm, also known as GloVe, is an algorithm used to learn word vector representations. It primarily learns the semantic relationships between words by analyzing the global word co-occurrence matrix. The GloVe algorithm considers the co-occurrence probability of a word with other words, thus obtaining richer semantic information. It also takes into account the information of context words when generating word vectors, resulting in more semantically informative word vector representations.

[0088] This embodiment discloses the training steps for a word vector model, specifically including:

[0089] 1. Collect historical alarm data generated by various monitoring platforms (including testing platforms, Prometheus, Zabbix, etc.).

[0090] 2. Using historical alarm data generated by each monitoring platform as the alarm source, historical alarm data for each monitoring platform is extracted on an annual basis. Historical alarm data consists of several alarm events, each containing alarm time, alarm object, alarm channel (the monitoring platform that generated the alarm), alarm metric, alarm level, and alarm details. In this embodiment, historical alarm data is divided into segments based on alarm events, obtaining several slices of historical alarm data.

[0091] 3. Classify the historical alarm data extracted in step 2. Based on the alarm channel and alarm index, divide the alarm data into three major alarm categories: network performance, application status, and basic environment, which are the three root causes of alarms.

[0092] 4. Sort the historical alarm data with alarm categories obtained in step 3 by time, and segment the historical alarm data using a sliding time window method, dividing the historical alarm data into n alarm sets with time correlation. The principle of the time sliding window is as follows: Figure 3 As shown.

[0093] 5. Use GloVe to extract the time-series features from the n sets of alarms, convert each historical alarm data into a vector representation, and calculate the vector similarity between pairs of vectors, i.e., calculate the Euclidean distance between the vectors, to obtain the correlation score between any two historical alarm data. If there are m historical alarm data, there are [m×(m-1) / 2] correlation scores.

[0094] This embodiment pre-trains the word vector model, enabling the alarm root cause analysis results to be closer to the actual situation and achieving more efficient root cause analysis.

[0095] In one embodiment, such as Figure 4 As shown, an intelligent dialing alarm method based on multi-dimensional data analysis is provided. The method steps are as follows:

[0096] 1. Administrators configure testing tasks and scenario topology on the testing platform and then distribute the task configuration to the testing execution terminal for execution.

[0097] 2. Obtain test alarm data. Test alarm data is generated by the test platform and collected in real time through monitoring tools. Test alarm data includes the first alarm object.

[0098] 3. Obtain reference alarm data. Reference alarm data includes the second alarm object and the alarm category corresponding to the second alarm object. Obtaining reference alarm data requires real-time collection of alarm data from various monitoring platforms using monitoring tools, aggregation to obtain initial alarm data, and then extraction of the initial alarm data generated within a preset time period to obtain reference alarm data. The preset time period is a continuous period including the generation time of the test alarm data.

[0099] 4. Perform automatic noise reduction on the reference alarm data and eliminate duplicate alarms.

[0100] 5. Extract reference alarm data corresponding to the second alarm object that is the same as the first alarm object, and form a main associated alarm dataset; extract reference alarm data corresponding to the second alarm object that has a scene topology relationship with the first alarm object, and form a secondary associated alarm dataset.

[0101] 6. Input the primary related alarm dataset and the dial-up alarm data into the word vector model, obtain the similarity score between each element in the primary related alarm dataset and the dial-up alarm data, sort the second alarm objects corresponding to each element in the primary related alarm dataset according to the similarity score, and obtain the primary related alarm list; input the secondary related alarm dataset and the dial-up alarm data into the word vector model, obtain the similarity score between each element in the secondary related alarm dataset and the dial-up alarm data, sort the second alarm objects corresponding to each element in the secondary related alarm dataset according to the similarity score, and obtain the secondary related alarm list.

[0102] 7. Based on the similarity scores from largest to smallest, extract the alarm categories corresponding to the second alarm objects with a quantity equal to the first threshold from the primary associated alarm list to obtain the primary alarm category; based on the similarity scores from largest to smallest, extract the alarm categories corresponding to the second alarm objects with a quantity equal to the second threshold from the secondary associated alarm list to obtain the secondary alarm category; based on the primary alarm category and the secondary alarm category, obtain the root cause of the alarm to achieve root cause localization.

[0103] 8. The estimated root causes of alarms are pushed to the system administrators of the systems monitored by the testing platform in the form of alarm notifications. The system administrators will then further analyze and process the alarm causes and resolve the faults based on the root cause alarm notifications.

[0104] In step 6 above, the word vector model is pre-trained. The training process has been described in detail in the previous embodiments and will not be repeated here.

[0105] When using dial-up testing technology for system monitoring, relying solely on alarm data from dial-up testing makes it difficult to pinpoint the cause of system failures. Furthermore, there are numerous existing system monitoring platforms, each typically configuring its own alarm policies and notification mechanisms. This results in alarm messages being scattered across various platforms, making it difficult to quickly extract key information when dealing with large volumes of alarm data.

[0106] This application provides intelligent fault root cause localization capabilities by performing multi-dimensional analysis and correlation of alarms from dial-up testing and alarms from other channels, based on whether the monitoring service is normal.

[0107] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0108] Based on the same inventive concept, this application also provides an intelligent dialing alarm device based on multi-dimensional data analysis for implementing the intelligent dialing alarm method based on multi-dimensional data analysis described above. The solution provided by this device is similar to the solution described in the above method. Therefore, the specific limitations of one or more embodiments of the intelligent dialing alarm device based on multi-dimensional data analysis provided below can be found in the limitations of the intelligent dialing alarm method based on multi-dimensional data analysis described above, and will not be repeated here.

[0109] In one exemplary embodiment, such as Figure 5 As shown, an intelligent dialing alarm device based on multi-dimensional data analysis is provided, including: a data acquisition module 502, a correlation data extraction module 504, and a root cause output module 506, wherein:

[0110] The data acquisition module 502 is used to acquire dial-up test alarm data and reference alarm data; the dial-up test alarm data includes a first alarm object, and the reference alarm data includes a second alarm object and the alarm category corresponding to the second alarm object; the dial-up test alarm data is generated by the dial-up test platform.

[0111] The associated data extraction module 504 is used to extract the main associated alarm dataset and the secondary associated alarm dataset from the reference alarm data based on the correlation between the second alarm object and the first alarm object.

[0112] The root cause output module 506 is used to input the main associated alarm dataset and the secondary associated alarm dataset, along with the dial-up alarm data, into the word vector model to obtain the alarm root cause corresponding to the dial-up alarm data.

[0113] In one embodiment, the data acquisition module 502 is further configured to collect initial alarm data in real time; extract initial alarm data generated within a preset time period, and obtain reference alarm data; wherein, the preset time period is a continuous time period including the generation time of the dial-up alarm data.

[0114] In one embodiment, the associated data extraction module 504 is further configured to extract reference alarm data corresponding to a second alarm object that is the same as the first alarm object, forming a main associated alarm dataset; and extract reference alarm data corresponding to a second alarm object that has a scene topology relationship with the first alarm object, forming a secondary associated alarm dataset.

[0115] In one embodiment, the root cause output module 506 is further configured to input the primary associated alarm dataset and the dial-up alarm data into a word vector model, obtain a similarity score between each element in the primary associated alarm dataset and the dial-up alarm data, sort the second alarm objects corresponding to each element in the primary associated alarm dataset according to the similarity score, and obtain a primary associated alarm list; input the secondary associated alarm dataset and the dial-up alarm data into a word vector model, obtain a similarity score between each element in the secondary associated alarm dataset and the dial-up alarm data, sort the second alarm objects corresponding to each element in the secondary associated alarm dataset according to the similarity score, and obtain a secondary associated alarm list; and obtain the alarm root cause based on the primary associated alarm list and the secondary associated alarm list.

[0116] In one embodiment, the root cause output module 506 is further configured to extract, in descending order of similarity score, the alarm categories corresponding to the second alarm objects in the primary associated alarm list, with a quantity equal to a first threshold, to obtain the primary alarm category; extract, in descending order of similarity score, the alarm categories corresponding to the second alarm objects in the secondary associated alarm list, with a quantity equal to a second threshold, to obtain the secondary alarm category; and obtain the alarm root cause based on the primary alarm category and the secondary alarm category.

[0117] In one embodiment, the intelligent dialing alarm device based on multi-dimensional data analysis further includes a model training module for training a word vector model.

[0118] The model training module is also used to collect historical alarm data; sort the historical alarm data according to the collection time, segment the historical alarm data using a sliding time window method, and obtain several alarm sets with time correlation; use a regression algorithm based on global word frequency statistics to extract the temporal features of the alarm sets and obtain the vector representation of each historical alarm data; and obtain the similarity score between pairs of historical alarm data based on the Euclidean distance between the corresponding vector representations of each pair of historical alarm data.

[0119] The modules in the aforementioned intelligent dial-up alarm device based on multi-dimensional data analysis can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0120] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 6As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network. When the computer program is executed by the processor, it implements an intelligent alarm detection method based on multi-dimensional data analysis.

[0121] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0122] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement all the steps in the above-described method embodiments.

[0123] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements all the steps in the above method embodiments.

[0124] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements all the steps in the above method embodiments.

[0125] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0126] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0127] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0128] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. An intelligent dialing alarm method based on multi-dimensional data analysis, characterized in that, The method includes: Acquire test alarm data and reference alarm data; the test alarm data includes a first alarm object, and the reference alarm data includes a second alarm object and the alarm category corresponding to the second alarm object; the test alarm data is generated by the test platform. Extract the reference alarm data corresponding to the second alarm object that is the same as the first alarm object, and form a main associated alarm dataset; Extract the reference alarm data corresponding to the second alarm object that has a scene topology relationship with the first alarm object, and form a secondary associated alarm dataset; The primary associated alarm dataset and the secondary associated alarm dataset are respectively input into the pre-trained word vector model along with the dial-up alarm data to obtain the alarm root cause corresponding to the dial-up alarm data.

2. The method according to claim 1, characterized in that, The reference alarm data to be obtained includes: Real-time collection of initial alarm data; Extract the initial alarm data generated within a preset time period to obtain the reference alarm data; The preset time period is a continuous time period that includes the time when the alarm data is generated.

3. The method according to claim 1, characterized in that, The step of inputting the primary associated alarm dataset and the secondary associated alarm dataset, along with the dial-up alarm data, into a pre-trained word vector model to obtain the alarm root cause corresponding to the dial-up alarm data includes: The main associated alarm dataset and the dial-up alarm data are input into the word vector model to obtain the similarity score between each element in the main associated alarm dataset and the dial-up alarm data. The second alarm objects corresponding to each element in the main associated alarm dataset are sorted according to the similarity score to obtain the main associated alarm list. The secondary associated alarm dataset and the dial-up alarm data are input into the word vector model to obtain the similarity score between each element in the secondary associated alarm dataset and the dial-up alarm data. The second alarm objects corresponding to each element in the secondary associated alarm dataset are sorted according to the similarity score to obtain the secondary associated alarm list. The root cause of the alarm is obtained based on the primary associated alarm list and the secondary associated alarm list.

4. The method according to claim 3, characterized in that, The step of obtaining the alarm root cause based on the primary associated alarm list and the secondary associated alarm list includes: Based on the similarity scores in descending order, extract the second alarm objects corresponding to the alarm categories in the main associated alarm list in quantities equal to the first threshold, and obtain the main alarm category; Based on the similarity scores in descending order, extract the second alarm objects corresponding to the alarm categories from the secondary associated alarm list in quantities equal to the second threshold, and obtain the secondary alarm categories; The root cause of the alarm is obtained based on the primary alarm category and the secondary alarm category.

5. The method according to claim 1, characterized in that, The training of the word vector model includes: Collect historical alarm data; The historical alarm data is sorted according to the collection time, and the historical alarm data is segmented using a sliding time window method to obtain several alarm sets with time correlation. A regression algorithm based on global word frequency statistics is used to extract the temporal features of the alarm set and obtain the vector representation of each historical alarm data. Based on the Euclidean distance between the vector representations corresponding to each pair of historical alarm data, a similarity score is obtained between each pair of historical alarm data.

6. An intelligent dialing alarm device based on multi-dimensional data analysis, characterized in that, The device includes: The data acquisition module is used to acquire dial-up test alarm data and reference alarm data; the dial-up test alarm data includes a first alarm object, and the reference alarm data includes a second alarm object and the alarm category corresponding to the second alarm object; the dial-up test alarm data is generated by the dial-up test platform. The associated data extraction module is used to extract the reference alarm data corresponding to the second alarm object that is the same as the first alarm object, and form a main associated alarm dataset; and to extract the reference alarm data corresponding to the second alarm object that has a scene topology relationship with the first alarm object, and form a secondary associated alarm dataset. The root cause output module is used to input the main associated alarm dataset and the secondary associated alarm dataset, along with the dial-up alarm data, into a word vector model to obtain the alarm root cause corresponding to the dial-up alarm data.

7. The apparatus according to claim 6, characterized in that, The device includes: The data acquisition module is also used to collect initial alarm data in real time; The data acquisition module is further configured to extract the initial alarm data generated within a preset time period and obtain the reference alarm data; wherein, the preset time period is a continuous time period including the generation time of the dial-up alarm data.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images