Alarm data processing method and device of internet of things communication equipment, equipment and medium

Abstract

The application relates to an alarm data processing method, device and equipment of an Internet of Things communication device and a medium. The method comprises the following steps: obtaining alarm data generated by an Internet of Things communication device during operation, determining an alarm label of the alarm data according to the alarm data, wherein the alarm label comprises at least one of an alarm type, an alarm level and an alarm time corresponding to the alarm data; predicting a data processing duration of the alarm data according to the alarm label; and visually displaying the alarm data and the data processing duration. The method can improve the flexibility of alarm data processing of the Internet of Things communication device.

Description

Technical Field

[0001] This application relates to the field of big data technology, and in particular to a method, apparatus, device and medium for processing alarm data of Internet of Things (IoT) communication devices. Background Technology

[0002] With the rapid development and widespread application of IoT technology, an increasing number of IoT communication devices are being connected to the internet, forming a vast IoT ecosystem. Within this ecosystem, these IoT communication devices continuously monitor and sense their surroundings, generating various data, including a large amount of alarm data.

[0003] In related technologies, a security incident monitoring and analysis system collects a large amount of alarm data generated by IoT communication devices. Security maintenance personnel then analyze the alarm data one by one in chronological order of its generation and manually perform relevant operations to process each alarm data.

[0004] However, the above technologies suffer from poor flexibility in processing alarm data from IoT communication devices. Summary of the Invention

[0005] Therefore, it is necessary to provide an alarm data processing method, apparatus, device, and medium for IoT communication devices that can improve the flexibility of alarm data processing in IoT communication devices, addressing the aforementioned technical problems.

[0006] Firstly, this application provides a method for processing alarm data of an Internet of Things (IoT) communication device, the method comprising:

[0007] Acquire alarm data generated by IoT communication devices during operation, determine alarm tags based on the alarm data, and the alarm tags include at least one of the alarm type, alarm level, and alarm time corresponding to the alarm data;

[0008] Predict the data processing time for alarm data based on alarm tags;

[0009] The alarm data and data processing time are visualized.

[0010] In one embodiment, the number of alarm data is multiple, and the visualization of alarm data and data processing time includes:

[0011] The alarm data and the corresponding data processing time are visualized according to the preset display order.

[0012] The display order is related to at least one of the following: alarm time, data processing time, and processing priority of each alarm data.

[0013] In one embodiment, the data processing time for predicting alarm data based on alarm tags includes:

[0014] Based on the alarm label, determine the target prediction model corresponding to the alarm label;

[0015] Input the alarm label into the target prediction model to obtain the data processing time output by the target prediction model.

[0016] In one embodiment, the above-mentioned determination of the alarm label based on the alarm data includes:

[0017] The alarm data is processed for data identification to obtain at least one alarm field, and different alarm fields correspond to different alarm information;

[0018] Determine the alarm label based on the alarm information corresponding to each alarm field.

[0019] In one embodiment, determining the alarm label based on the alarm information corresponding to each alarm field includes:

[0020] The alarm information corresponding to each alarm field is used as the alarm label.

[0021] In one embodiment, determining the alarm label based on the alarm information corresponding to each alarm field includes:

[0022] The alarm information corresponding to each alarm field is matched in a preset tag database to obtain alarm tags.

[0023] Secondly, this application also provides an alarm data processing device for an Internet of Things (IoT) communication device, the device comprising:

[0024] The acquisition module is used to acquire alarm data generated by IoT communication devices during operation, and determine the alarm tag of the alarm data based on the alarm data. The alarm tag includes at least one of the alarm type, alarm level and alarm time corresponding to the alarm data.

[0025] The prediction module is used to predict the data processing time of alarm data based on alarm tags;

[0026] The display module is used to visualize alarm data and data processing time.

[0027] Thirdly, this application also provides a computer device including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described in the first aspect above.

[0028] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in the first aspect above.

[0029] Fifthly, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the method described in the first aspect above.

[0030] The aforementioned method, apparatus, device, and medium for processing alarm data from IoT communication devices acquire alarm data generated during the operation of the IoT communication devices and determine alarm tags based on the alarm data. The alarm tags include at least one of the following: alarm type, alarm level, and alarm time. After determining the alarm tags, the processing time of the alarm data is predicted based on the alarm tags, and the alarm data and processing time are visualized. In this method, the predicted processing time of the alarm data helps security maintenance personnel adjust the alarm data processing strategy in real time. For example, alarm data with shorter processing times can be processed first. Compared to traditional technologies that process alarm data solely based on the order in which the alarm data is generated, this method allows for flexible adjustment of the alarm data processing strategy based on the processing time, thereby improving the flexibility of alarm data processing. Attached Figure Description

[0031] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 This is an application environment diagram of an alarm data processing method for an IoT communication device in one embodiment.

[0033] Figure 2 This is a flowchart illustrating an alarm data processing method for an IoT communication device in one embodiment.

[0034] Figure 3 This is a flowchart illustrating an alarm data processing method for an IoT communication device in another embodiment.

[0035] Figure 4 This is a flowchart illustrating an alarm data processing method for an IoT communication device in another embodiment.

[0036] Figure 5This is a flowchart illustrating an alarm data processing method for an IoT communication device in another embodiment.

[0037] Figure 6 This is a structural block diagram of an alarm data processing device for an Internet of Things (IoT) communication device in one embodiment.

[0038] Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0040] With the rapid development and widespread application of IoT technology, an increasing number of IoT communication devices are being connected to the internet, forming a vast IoT ecosystem. Within this ecosystem, these IoT communication devices continuously monitor and sense their surroundings, generating various data, including a large amount of alarm data.

[0041] In related technologies, a large amount of alarm data generated by IoT communication devices is collected through a security incident monitoring and analysis system. Most of the alarm data is duplicate or false alarm data. Security maintenance personnel analyze the alarm data one by one in the order in which the alarm data was generated. Usually, most alarm data has a corresponding emergency handling plan. Security maintenance personnel find the plan and manually perform the corresponding operations, such as confirming the alarm source, analyzing the alarm cause, and locating the fault, in order to process the alarm data.

[0042] However, due to the large volume of alarm data, security personnel analyze each alarm data item in chronological order of its generation, resulting in poor flexibility in alarm data processing.

[0043] Therefore, embodiments of this application provide an alarm data processing method, apparatus, device, and medium for IoT communication devices, which can solve the above-mentioned technical problems.

[0044] The alarm data processing method provided in this application embodiment can be applied to, for example... Figure 1In the implementation environment shown, computer device 102 communicates with IoT communication device 104 via a network. Computer device 102 obtains alarm data generated by IoT communication device 104 during operation by logging into a monitoring system or management platform, and processes the alarm data. The computer device 102 can be a terminal or a server. The terminal can be, but is not limited to, various personal computers, laptops, smartphones, and tablets. The IoT communication device 104 can be various smart grid devices, such as smart sensing devices, execution devices, and smart control devices.

[0045] In one embodiment, such as Figure 2 As shown, an alarm data processing method is provided, which is used for Figure 1 Taking computer device 102 as an example, the method includes the following steps:

[0046] S202, acquire alarm data generated by IoT communication devices during operation, and determine the alarm tag of the alarm data based on the alarm data.

[0047] Among them, IoT communication devices can be various smart grid devices used to monitor and sense the surrounding environment. During operation, IoT communication devices generate a large number of operation logs, from which alarm data can be extracted. Alarm data is used to indicate potential problems, anomalies, or risks that may exist in the operation of IoT communication devices. Alarm data typically includes the operating status of IoT communication devices, event occurrences, or notifications triggered by specific conditions.

[0048] In this embodiment, the computer device can communicate with a monitoring system or management platform, and the monitoring system or management platform is connected to the computer device. Optionally, the monitoring system or management platform can acquire operation logs during the operation of the IoT communication device, extract alarm data from the operation logs, and send the alarm data to the computer device based on the communication connection with the computer device. Alternatively, the monitoring system or management platform can acquire operation logs during the operation of the IoT communication device, send the operation logs to the computer device based on the communication connection with the computer device, and the computer device extracts alarm data from the operation logs.

[0049] After acquiring the alarm data, in order to make the alarm data processing by security maintenance personnel more organized and efficient, computer equipment can determine the alarm label of the alarm data, and organize, analyze and process the alarm data according to different alarm labels.

[0050] Optionally, the aforementioned alarm label includes at least one of the alarm type, alarm level, and alarm time corresponding to the alarm data, and may also include alarm duration and alarm source. That is, the alarm label includes at least one of the alarm type, alarm level, alarm duration, and alarm source. The alarm type corresponding to the alarm data can be categorized according to the cause of the alarm, such as security event alarms, performance alarms, equipment failure alarms, and environmental monitoring alarms. Alarm types can also be categorized according to different levels of system security management, such as network security alarms, host security alarms, data security alarms, and operation and maintenance alarms. The alarm level corresponding to the alarm data may include information level, warning level, general level, critical level, and emergency level. The alarm time corresponding to the alarm data refers to the time when the alarm data was generated, which usually includes a specific timestamp, accurate to the year, month, day, hour, minute, or even second. The alarm duration includes the duration of the continuous alarm event. The alarm source includes the specific source or channel from which the alarm data was generated.

[0051] The following describes possible implementations of a computer device for determining alarm tags based on alarm data.

[0052] In one possible implementation, the computer device can determine the alarm tag of the alarm data based on rule matching. For example, the computer device can pre-store a rule mapping table, which includes alarm data features corresponding to each alarm tag. After the computer device obtains the alarm data generated by the IoT communication device during operation, it extracts the alarm data features corresponding to the alarm data and matches the corresponding alarm tag in the rule mapping table according to the alarm data features corresponding to the alarm data.

[0053] In another possible implementation, the computer device can use a machine learning model to classify alarm data, thereby determining the alarm labels for the alarm data. The machine learning model, trained on a large amount of alarm data with known labels, can learn the characteristics of different alarm types, alarm levels, and alarm times, and can classify the alarm data according to alarm labels to obtain the corresponding alarm labels.

[0054] In this way, computer devices can obtain alarm data and alarm tags corresponding to the alarm data in different ways, thereby increasing the diversity of alarm data and alarm tag acquisition methods.

[0055] S204, predict the data processing time of alarm data based on alarm labels.

[0056] In this embodiment of the application, the computer device predicts the data processing time of alarm data based on alarm tags. This means using the alarm tags of the alarm data (such as alarm type, alarm level, and alarm time) to predict the length of time required to process the alarm data. The granularity of the data processing time can be set by the user during implementation, for example, it can be accurate to the minute.

[0057] In one possible implementation, taking an alarm label that includes alarm type, alarm level, and alarm time as an example, the computer device can establish a rule engine. This rule engine can set different processing durations based on different alarm types, alarm levels, and alarm times. Using this rule engine, the computer device can determine the corresponding data processing duration based on the alarm type, alarm level, and alarm time included in the alarm label.

[0058] In another possible implementation, the computer device can use a supervised learning model, inputting alarm tags as input features into the supervised learning model, and the supervised learning model outputs the data processing time.

[0059] S206 provides a visual representation of alarm data and data processing time.

[0060] In this embodiment of the application, the computer device visualizes alarm data and data processing time by displaying alarm data and its corresponding data processing time in the alarm list through charts, statistical graphs or other visualization methods.

[0061] In addition to visualizing alarm data and processing time, the above-mentioned visualizations can also visualize at least one of the following: alarm tags, alarm organizations, and associated objects. The alarm organization refers to the specific unit or organization to which the IoT communication device generating the alarm data belongs, and the associated object refers to the device, object, or system associated with the alarm data. By displaying alarm tags, security personnel can adopt different alarm data processing strategies based on multiple dimensions of information such as alarm type, alarm level, and alarm time, making alarm data processing more flexible.

[0062] In this embodiment of the application, when the computer device visualizes alarm data and data processing time, the alarm data, data processing time, alarm tags, alarm agencies, and associated objects can be displayed together.

[0063] The following describes possible implementations for visualizing alarm data and data processing time.

[0064] In one possible implementation, alarm data and data processing time are displayed in the alarm list in the visual interface of the computer device. When security maintenance personnel view the alarm data, the alarm data and data processing time can be displayed in a pop-up window.

[0065] In another possible implementation, alarm data and data processing time can be directly displayed as text in the alarm list within the visual interface of the computer device.

[0066] This allows security maintenance personnel to intuitively understand alarm data and data processing time in a visual interface, thereby adjusting alarm data processing strategies based on data processing time and improving the flexibility of alarm data processing.

[0067] In the aforementioned method for processing alarm data from IoT communication devices, alarm data generated during the operation of the IoT communication devices is acquired, and alarm tags are determined based on the alarm data. The alarm tags include at least one of the following: alarm type, alarm level, and alarm time. After determining the alarm tags, the data processing time of the alarm data is predicted based on the alarm tags, and the alarm data and data processing time are visualized. In this method, the predicted data processing time of the alarm data helps security maintenance personnel adjust the alarm data processing strategy in real time. For example, alarm data with shorter processing times can be processed first. Compared to traditional technologies that process alarm data solely based on the order in which the alarm data is generated, this method allows for flexible adjustment of the alarm data processing strategy based on the data processing time, thereby improving the flexibility of alarm data processing.

[0068] The above embodiments mentioned the visualization of alarm data and data processing time. Below, we will describe one implementation method for visualizing alarm data and data processing time when there are multiple alarm data points.

[0069] based on Figure 2 In the embodiment shown, S206 may include the following steps:

[0070] Step A1: Visualize each alarm data and the corresponding data processing time according to the preset display order.

[0071] In this embodiment, since IoT communication devices may generate a large amount of alarm data during operation, the corresponding data processing time can be obtained for each alarm data using the above-described S202 and S204 steps. Thus, when there are multiple alarm data points, each alarm data point and its corresponding data processing time can be visualized according to a preset display order.

[0072] The preset display order is related to at least one of the following: alarm time, data processing time, and processing priority of each alarm data.

[0073] The following describes possible implementations of step A1 in several possible scenarios.

[0074] 1) The computer equipment determines the display order based on the data processing time corresponding to each alarm data, and displays each alarm data and its corresponding data processing time in a visual manner according to the display order.

[0075] In this embodiment, the data processing time for different alarm data may vary. Optionally, the display order can be from shortest to longest data processing time for each alarm data. For example, if the data processing time for alarm data 1 is 5 minutes, the data processing time for alarm data 2 is 15 minutes, and the data processing time for alarm data 3 is 8 minutes, then the display order would be alarm data 1, alarm data 3, and alarm data 2. By visually displaying each alarm data and its corresponding data processing time in ascending order of processing time, security personnel can process the alarm data according to the order of processing time. Timely processing of alarm data with shorter processing times can effectively reduce the scope of the problem and prevent the fault from escalating to more serious consequences.

[0076] Optionally, the display order can also be the order of data processing time for each alarm data from longest to shortest. For example, if the data processing time for alarm data 1 is 5 minutes, the data processing time for alarm data 2 is 15 minutes, and the data processing time for alarm data 3 is 8 minutes, then the display order would be alarm data 2, alarm data 3, and alarm data 1. In this way, by visually displaying each alarm data and its corresponding data processing time in descending order of processing time, security personnel can process the alarm data according to the order of processing time. Alarm data with longer processing times often represent potentially important issues; prioritizing the processing of alarm data with longer processing times can prevent missed alarms or critical system anomalies, thus helping to ensure system security and stability.

[0077] 2) The computer equipment determines the display order based on the processing priority of each alarm data, and displays each alarm data and the corresponding data processing time in a visual manner according to the display order.

[0078] In this context, processing priority refers to the urgency of alarm data requiring immediate processing, typically determined by the alarm level; higher alarm levels correspond to higher processing priorities. In this embodiment, optionally, the display order can be a descending order of processing priorities for each alarm data point. For example, if alarm data 1 has a processing priority of level 2, alarm data 2 has a processing priority of level 5, and alarm data 3 has a processing priority of level 1, then the display order would be alarm data 5, alarm data 1, and alarm data 3. This visual display of each alarm data point and its corresponding processing time, arranged in descending order of processing priority, allows security personnel to prioritize and process alarm data with higher processing priorities, ensuring that critical issues are addressed promptly.

[0079] 3) The computer equipment determines the display order by combining the alarm time and the processing priority of each alarm data, and then visualizes each alarm data and the corresponding data processing time according to the display order.

[0080] For example, computer devices can configure corresponding weights for alarm time and processing priority. Different weights are used to quantify the degree of influence of different factors on the display order, so as to comprehensively consider their roles in the display order. Weights can be divided into alarm time weights and processing priority weights. Alarm time reflects the point in time when the problem occurs; generally, earlier alarm data needs to be processed faster. The alarm time weight can be set according to specific needs; for example, if a rapid response to earlier alarm data is required, the alarm time weight can be assigned a higher value. Processing priority reflects the urgency and importance of alarm data; generally, alarm data with high processing priority needs to be processed faster. The processing priority weight can be set according to factors such as the severity and scope of the alarm; higher priority alarms can be assigned a higher weight.

[0081] After determining the alarm time weight and processing priority weight, the alarm time and processing priority of the alarm data are quantified to obtain the quantified alarm time and processing priority. The quantified alarm time and processing priority are then weighted and averaged using the alarm time weight and processing priority weight to obtain the comprehensive ranking value.

[0082] Optionally, the display order can be based on the overall ranking value from high to low. For example, if the alarm time weight is 0.7, the processing priority weight is 0.3, the overall ranking value of alarm data 1 is 8, the overall ranking value of alarm data 2 is 4, and the overall ranking value of alarm data 3 is 10, then the display order is alarm data 3, alarm data 1, and alarm data 2. In this way, by displaying alarm data in descending order of their corresponding overall ranking values, the processing time of each alarm data and its corresponding data is visualized. The weights can be flexibly set as needed to ensure that alarm data with earlier alarm times and higher processing priorities are processed first, thereby improving overall processing efficiency.

[0083] 4) The computer equipment determines the display order by combining the data processing time of each alarm data and the processing priority of each alarm data, and then visualizes each alarm data and its corresponding data processing time according to the display order.

[0084] For example, a computer device can configure corresponding weights for data processing time and processing priority. In this embodiment, the weights can be divided into processing time weights and processing priority weights. The data processing time reflects the length of time required to process alarm data. Generally, alarm data with shorter processing times can be processed first, and a higher weight can be assigned to shorter processing times. After determining the time length weights and processing priority weights, the data processing time and processing priority of the alarm data are quantified. When quantifying the data processing time, the reciprocal of the data processing time can be taken before quantization to obtain the quantified data processing time and processing priority. The quantified data processing time and processing priority are then weighted and averaged using the processing time weights and processing priority weights to obtain a comprehensive ranking value.

[0085] Optionally, the display order can be based on the overall ranking value from high to low. For example, if the processing time weight is 0.2, the processing priority weight is 0.8, the overall ranking value of alarm data 1 is 9, the overall ranking value of alarm data 2 is 5, and the overall ranking value of alarm data 3 is 2, then the display order is alarm data 1, alarm data 2, and alarm data 3. In this way, by displaying alarm data in descending order of their overall ranking value, the processing time of each alarm data is visualized. The weights can be flexibly set as needed to prioritize alarm data with shorter processing times and higher processing priority, thereby improving overall processing efficiency.

[0086] 5) The computer equipment determines the display order by combining the alarm time and the corresponding data processing time of each alarm data, and then visualizes each alarm data and its corresponding data processing time according to the display order.

[0087] For example, a computer device can configure response weights for alarm time and data processing time. In this embodiment, the weights can be divided into alarm time weight and processing time weight. After determining the alarm time weight and processing time weight, the alarm time and data processing time of the alarm data are quantized. When quantifying the data processing time, the reciprocal of the data processing time can be taken before quantization to obtain the quantized alarm time and data processing time. The quantized alarm time and data processing time are then weighted and averaged using the alarm time weight and processing time weight to obtain a comprehensive ranking value.

[0088] Optionally, the display order can be based on the overall ranking value from high to low. For example, if the processing time weight is 0.4, the alarm time weight is 0.6, the overall ranking value of alarm data 1 is 8, the overall ranking value of alarm data 2 is 7.5, and the overall ranking value of alarm data 3 is 8.5, then the display order would be alarm data 3, alarm data 1, and alarm data 2. In this way, by displaying alarm data in descending order of their corresponding overall ranking values, the data processing time of each alarm data is visualized. Weights can be flexibly set as needed to prioritize alarm data with earlier alarm times and shorter processing times, thereby improving overall processing efficiency.

[0089] 6) The computer equipment determines the display order by combining the alarm time, processing priority and data processing time of each alarm data, and displays each alarm data and its corresponding data processing time in a visual manner according to the display order.

[0090] For example, a computer device can configure corresponding weights for alarm time, processing priority, and data processing duration. In this embodiment, the weights can be divided into alarm time weight, processing priority weight, and processing duration weight. After determining the alarm time weight, processing priority weight, and processing duration weight, the alarm time, processing priority, and data processing duration of the alarm data are quantified. When quantifying the data processing duration, the reciprocal of the data processing duration can be taken before quantization to obtain the quantified alarm time, processing priority, and data processing duration. The quantified alarm time, processing priority, and data processing duration are then weighted and averaged using the alarm time weight, processing priority weight, and processing duration weight to obtain a comprehensive ranking value.

[0091] Optionally, the display order can be based on the overall ranking value from high to low. For example, if the processing time weight is 0.4, the processing priority weight is 0.3, and the alarm time weight is 0.3, and the overall ranking value of alarm data 1 is 8, the overall ranking value of alarm data 2 is 7, and the overall ranking value of alarm data 3 is 9, then the display order would be alarm data 3, alarm data 2, and alarm data 1. In this way, by displaying alarm data in descending order of their overall ranking value, the processing time of each alarm data and its corresponding data is visualized. Weights can be flexibly set as needed to prioritize alarm data with higher overall ranking values, thereby improving overall processing efficiency.

[0092] This allows security personnel to process alarm data in descending order of priority, ensuring that high-priority alarms are processed first and that critical issues are addressed promptly.

[0093] In this embodiment, when visualizing each alarm data and its corresponding data duration according to a preset display order, in addition to displaying it according to the preset display order, different display methods can also be used to visualize each alarm data and its corresponding data processing duration. While visualizing the alarm data and its corresponding data processing duration, the processing priority of the alarm data can also be visualized along with the alarm data. Different display methods refer to displaying the data according to different display fields, such as displaying by alarm organization, displaying by alarm time range, and displaying by alarm type.

[0094] In one possible implementation, the alarm list is organized by alarm authority, and multiple alarm data from the same authority are displayed in a preset display order, with each alarm data from the same authority and the corresponding data duration being visualized.

[0095] In this way, through the above-mentioned visualization method, security maintenance personnel can more intuitively understand the processing priority and data processing time of each alarm data, and thus adjust the alarm data processing strategy in real time according to the display order of alarm data and data processing time, so as to improve the flexibility of alarm data processing.

[0096] The above embodiments mentioned the data processing time for predicting alarm data based on alarm tags. Below, one implementation of the data processing time prediction of alarm data based on alarm tags for electronic computer device 102 will be described.

[0097] based on Figure 2 The illustrated embodiment can be found in [reference]. Figure 3The above S204 may include the following steps:

[0098] S302, Based on the alarm label, determine the target prediction model corresponding to the alarm label.

[0099] Among them, the target prediction model refers to the duration prediction model corresponding to the alarm label. The duration prediction model can be a linear regression model or a decision tree model, which is trained by a large amount of historical alarm data and the actual processing time of each alarm data.

[0100] In this embodiment of the application, taking a linear regression model as an example, the training of the duration prediction model can be achieved through the following steps:

[0101] Step B1: Extract data features from historical alarm data and determine the historical alarm tags corresponding to the historical alarm data, including at least one of alarm type, alarm level, alarm time, alarm duration, and alarm source.

[0102] Step B2: Initialize the duration prediction model. Train a linear regression model using historical alarm data with the same alarm label and the corresponding historical alarm labels to obtain regression coefficients. Correspondingly, train separate linear regression models for historical alarm data with different alarm labels and the corresponding historical alarm labels to obtain the corresponding regression coefficients.

[0103] The above linear regression model corresponds to the historical alarm labels of the historical alarm data. That is, one type of historical alarm label corresponds to one linear regression model and regression coefficient. For example, for historical alarm labels that are alarm type, alarm level and alarm duration, the linear regression model and regression coefficient are trained from historical alarm data with historical alarm labels that are alarm type, alarm level and alarm duration.

[0104] Since historical alarm tags include at least one of alarm type, alarm level, alarm time, alarm duration, and alarm source, and since linear regression models correspond to historical alarm tags, computer equipment can match alarm tags with historical alarm tags corresponding to linear regression models based on the alarm tags in the alarm data. This allows for the determination of a target prediction model from multiple linear regression models, and the acquisition of the regression coefficients corresponding to the target prediction model. The historical alarm tags corresponding to the target prediction model have the same tag content as the alarm tags in the alarm data.

[0105] In this way, target prediction models with the same label content can be accurately obtained based on the alarm label.

[0106] S304. Input the alarm tag into the target prediction model to obtain the data processing time output by the target prediction model.

[0107] In this embodiment of the application, since the target prediction model is trained based on historical alarm data and corresponding historical alarm tags, when using the target prediction model to predict the data processing time of alarm data, the alarm tags can be input into the target prediction model, and the target prediction model can output the data processing time.

[0108] For example, taking the target prediction model as a linear regression model, assuming that the formula of the linear regression model is as shown in formula (1), formula (1) can accurately predict the data processing time corresponding to the alarm data.

[0109] Formula (1)

[0110] in, For data processing time, For alarm labels, such as Alarm level, For alarm types, etc. Input the regression coefficients obtained from the linear regression model into the historical alarm data. This is a deviation.

[0111] Assume the historical alarm data is as follows:

[0112] historical_data=[{'id':1,'type':'CPUHigh','level':3,'duration':10,'time_to_resolve':120},{'id':2,'type':'MemoryLow', 'level':2,'duration':5,'time_to_resolve':60},{'id':3,'type':'DiskFull','level':1,'duration':3,'time_to_resolve':30}]

[0113] Here, 'level' represents the alarm level (1 being the lowest and 5 the highest), 'duration' represents the alarm duration, and 'time_to_resolve' represents the processing time. Based on this data, a linear regression model can be trained to predict the data processing time. For the current alarm data, assuming an alarm level of 2 and an alarm duration of 4, we can use... To predict the data processing time.

[0114] In this way, the data processing time of alarm data can be accurately predicted based on alarm tags and target prediction models. The data processing time output by the target prediction model can be used to better plan and optimize resource allocation.

[0115] The above embodiments mentioned the determination of alarm tags based on alarm data. Below, one implementation of the computer device 102 for determining alarm tags based on alarm data will be described.

[0116] based on Figure 2 The illustrated embodiment can be found in [reference]. Figure 4 The above S202 may include the following steps:

[0117] S402, perform data identification processing on the alarm data to obtain at least one alarm field.

[0118] In this embodiment, the computer device performs data identification processing on alarm data, which means that the computer device performs data identification processing on all data fields in the alarm data to obtain at least one alarm field. An alarm field refers to an alarm field associated with an alarm label, such as "level" associated with an alarm level. Each alarm field represents a different meaning. For example, the alarm field "level" represents an alarm level, alarm grade, or alarm urgency. The meaning of each alarm field can be obtained from the corresponding dictionary. The obtained field meaning is used as the alarm information for the alarm field. In addition, the alarm information also includes the meaning of the field values ​​corresponding to each alarm field. For example, the field value of the alarm field "level" is 5, which corresponds to an urgency level. The meaning of the field value can also be obtained from the corresponding dictionary. Different alarm fields correspond to different alarm information.

[0119] The above process performs data identification processing on all data fields in the alarm data to obtain at least one alarm field. Regular expressions can be used to identify field information in specific formats in the alarm data, such as date and time, keywords, etc., which can effectively extract the required alarm fields from the alarm data.

[0120] S404, determine the alarm label based on the alarm information corresponding to each alarm field.

[0121] The alarm information includes the meaning of each alarm field and the meaning of its value. Determining the alarm label based on the alarm information corresponding to each alarm field means determining the alarm label based on the meaning of the field value within the alarm information for each alarm field.

[0122] In one possible implementation, the computer device extracts keywords from the meanings of the field values ​​in the alarm information to obtain multiple keywords in the alarm information corresponding to each alarm field, and determines the keywords as alarm tags.

[0123] In another possible implementation, if the meaning of the field value in the alarm information corresponds to the label content of the alarm label, that is, the meaning of the field value is the corresponding label content, then as an optional embodiment, the alarm information corresponding to each alarm field is used as the alarm label.

[0124] In this way, alarm tags can be accurately determined from the alarm information corresponding to multiple alarm fields. Accurate alarm tags can help the operation and maintenance team allocate resources more effectively and prioritize the handling of important alarm events, thereby improving the flexibility of alarm data processing.

[0125] The above embodiments mentioned determining alarm tags based on the alarm information corresponding to each alarm field. Below, one implementation method for determining alarm tags by the computer device 102 will be described.

[0126] based on Figure 4 In the embodiment shown, S404 may include the following steps:

[0127] Step C1: Using the alarm information corresponding to each alarm field, perform matching processing in the preset tag database to obtain alarm tags.

[0128] The preset tag database includes multiple predefined standardized alarm tags. The standardized alarm tags can include alarm level, alarm type, alarm time, alarm duration, and alarm source. Specifically, alarm level can be divided into information level, warning level, general level, critical level, and emergency level; alarm type can be divided into network security alarm, host security alarm, data security alarm, and operation and maintenance alarm; alarm time can be divided into peak time and off-peak time; and alarm duration can be divided into short, general, long, and very long.

[0129] In this embodiment of the application, matching processing in the preset tag database refers to using the alarm information corresponding to each alarm field to obtain the meaning of the field value corresponding to the alarm field from the alarm information, and matching the meaning of the field value in the preset tag database to obtain the alarm tag.

[0130] After obtaining the meanings of the field values ​​corresponding to the alarm fields from the alarm information, an empty dictionary is created to store the matched alarm tags. Then, a boolean variable "matched" is set for each standardized alarm tag, with the initial value of all boolean variables corresponding to standardized alarm tags being "False". When matching the meanings of the field values ​​against the preset tag database, it can be determined whether the meanings of each field value match the standardized alarm tags in the tag data. The standardized alarm tag with the highest match degree among all standardized alarm tags is taken as the final alarm tag. For example, it checks whether the meaning of the field value corresponding to the alarm type matches multiple alarm types in the standardized tags. If a match is found, the boolean variable "matched" corresponding to that standardized alarm tag is set to "True", and the standardized tag with the highest match degree is taken as the alarm type in the alarm tags and stored in the empty dictionary. Correspondingly, the meanings of the field values ​​in the alarm information corresponding to different alarm fields in the alarm data are matched to obtain the standardized alarm tags with the highest match degree for each field value meaning. Multiple standardized alarm tags are taken as the alarm tags of the alarm data.

[0131] In this way, alarm labels in alarm data can have a unified label format, and the label content in alarm labels can also have a unified format, which can effectively improve the accuracy and reliability of alarm labels.

[0132] In one embodiment, an alarm data processing method for an Internet of Things (IoT) communication device is provided, for use in computer device 102, see [link / reference]. Figure 5 The method includes the following steps:

[0133] S501, acquire alarm data generated by IoT communication devices during operation;

[0134] S502, perform data identification processing on the alarm data to obtain at least one alarm field, and different alarm fields correspond to different alarm information;

[0135] S503, use the alarm information corresponding to each alarm field as alarm tags, or use the alarm information corresponding to each alarm field to perform matching processing in a preset tag database to obtain alarm tags;

[0136] S504, Based on the alarm label, determine the target prediction model corresponding to the alarm label;

[0137] S505, input the alarm tag into the target prediction model to obtain the data processing time output by the target prediction model;

[0138] S506 When there are multiple alarm data, each alarm data and its corresponding data processing time are visualized according to a preset display order.

[0139] The following is an exemplary description of the implementation of the alarm data processing method for the IoT communication device in the above embodiments.

[0140] like Figure 5 As shown, alarm data generated by IoT communication devices during operation is acquired, and the alarm data is processed for data identification to obtain at least one alarm field. Different alarm fields correspond to different alarm information. The alarm information corresponding to each alarm field is used as an alarm tag. Alternatively, the alarm information corresponding to each alarm field is matched in a preset tag database to obtain alarm tags. After obtaining the alarm tags corresponding to the alarm data, the target prediction model corresponding to the alarm tag is determined based on the alarm tag, and the alarm tag is input into the target prediction model to obtain the data processing time output by the target prediction model. When there are multiple alarm data, each alarm data and its corresponding data processing time are visualized according to a preset display order.

[0141] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0142] Based on the same inventive concept, this application also provides an alarm data processing apparatus for an IoT communication device to implement the alarm data processing method for the IoT communication device described above. The solution provided by this apparatus is similar to the implementation described in the above method. Therefore, the specific limitations in one or more embodiments of the alarm data processing apparatus for IoT communication devices provided below can be found in the limitations of the alarm data processing method for IoT communication devices described above, and will not be repeated here.

[0143] In one embodiment, such as Figure 6 As shown, an alarm data processing device for an Internet of Things (IoT) communication device is provided, comprising: an acquisition module 601, a prediction module 602, and a display module 603, wherein:

[0144] The acquisition module 601 is used to acquire alarm data generated by IoT communication devices during operation, and determine the alarm tag of the alarm data based on the alarm data. The alarm tag includes at least one of the alarm type, alarm level and alarm time corresponding to the alarm data.

[0145] Prediction module 602 is used to predict the data processing time of alarm data based on alarm tags;

[0146] The display module 603 is used to visualize alarm data and data processing time.

[0147] In another embodiment, an alarm data processing device for another IoT communication device is provided. Based on the above embodiment, the number of alarm data is multiple, and the display module 603 includes a display unit, wherein:

[0148] The display unit is used to visualize each alarm data and the corresponding data processing time of each alarm data according to a preset display order; wherein, the display order is related to at least one of the alarm time included in each alarm data, the corresponding data processing time of each alarm data, and the processing priority of each alarm data.

[0149] In another embodiment, an alarm data processing device for another IoT communication device is provided. Based on the above embodiment, the prediction module 602 includes a model determination unit and a prediction unit, wherein:

[0150] The model determination unit is used to determine the target prediction model corresponding to the alarm label based on the alarm label.

[0151] The prediction unit is used to input alarm tags into the target prediction model and obtain the data processing time output by the target prediction model.

[0152] In another embodiment, an alarm data processing apparatus for another IoT communication device is provided. Based on the above embodiments, the acquisition module 601 includes an identification unit and a determination unit, wherein:

[0153] The identification unit is used to perform data identification processing on alarm data to obtain at least one alarm field, and different alarm fields correspond to different alarm information;

[0154] The determination unit is used to determine the alarm label based on the alarm information corresponding to each alarm field.

[0155] Optionally, the aforementioned determining unit is specifically used to: use the alarm information corresponding to each alarm field as alarm labels.

[0156] Optionally, the aforementioned determining unit is specifically used to: use the alarm information corresponding to each alarm field to perform matching processing in a preset tag database to obtain alarm tags.

[0157] Each module in the alarm data processing device of the aforementioned IoT communication equipment can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0158] In one exemplary embodiment, a computer device is provided, which can be a terminal or a server. Taking a terminal as an example, its internal structure diagram can be as follows: Figure 7 As shown, the computer device includes a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements an alarm data processing method for an Internet of Things (IoT) communication device. The display screen can be an LCD screen or an e-ink display screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0159] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0160] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0161] Acquire alarm data generated by IoT communication devices during operation, determine alarm tags based on the alarm data, and the alarm tags include at least one of the alarm type, alarm level, and alarm time corresponding to the alarm data; predict the data processing time of the alarm data based on the alarm tags; and visualize the alarm data and data processing time.

[0162] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0163] The alarm data and the corresponding data processing time are visualized according to the preset display order; the display order is related to at least one of the following: alarm time, data processing time, and processing priority of each alarm data.

[0164] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0165] Based on the alarm label, determine the target prediction model corresponding to the alarm label; input the alarm label into the target prediction model to obtain the data processing time output by the target prediction model.

[0166] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0167] The alarm data is processed for data identification to obtain at least one alarm field. Different alarm fields correspond to different alarm information. The alarm label is determined based on the alarm information corresponding to each alarm field.

[0168] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0169] The alarm information corresponding to each alarm field is used as the alarm label.

[0170] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0171] The alarm information corresponding to each alarm field is matched in a preset tag database to obtain alarm tags.

[0172] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0173] Acquire alarm data generated by IoT communication devices during operation, determine alarm tags based on the alarm data, and the alarm tags include at least one of the alarm type, alarm level, and alarm time corresponding to the alarm data; predict the data processing time of the alarm data based on the alarm tags; and visualize the alarm data and data processing time.

[0174] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0175] The alarm data and the corresponding data processing time are visualized according to the preset display order; the display order is related to at least one of the following: alarm time, data processing time, and processing priority of each alarm data.

[0176] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0177] Based on the alarm label, determine the target prediction model corresponding to the alarm label; input the alarm label into the target prediction model to obtain the data processing time output by the target prediction model.

[0178] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0179] The alarm data is processed for data identification to obtain at least one alarm field. Different alarm fields correspond to different alarm information. The alarm label is determined based on the alarm information corresponding to each alarm field.

[0180] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0181] The alarm information corresponding to each alarm field is used as the alarm label.

[0182] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0183] The alarm information corresponding to each alarm field is matched in a preset tag database to obtain alarm tags.

[0184] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0185] Acquire alarm data generated by IoT communication devices during operation, determine alarm tags based on the alarm data, and the alarm tags include at least one of the alarm type, alarm level, and alarm time corresponding to the alarm data; predict the data processing time of the alarm data based on the alarm tags; and visualize the alarm data and data processing time.

[0186] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0187] The alarm data and the corresponding data processing time are visualized according to the preset display order; the display order is related to at least one of the following: alarm time, data processing time, and processing priority of each alarm data.

[0188] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0189] Based on the alarm label, determine the target prediction model corresponding to the alarm label; input the alarm label into the target prediction model to obtain the data processing time output by the target prediction model.

[0190] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0191] The alarm data is processed for data identification to obtain at least one alarm field. Different alarm fields correspond to different alarm information. The alarm label is determined based on the alarm information corresponding to each alarm field.

[0192] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0193] The alarm information corresponding to each alarm field is used as the alarm label.

[0194] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0195] The alarm information corresponding to each alarm field is matched in a preset tag database to obtain alarm tags.

[0196] It should be noted that the data involved in this application (including but not limited to data used for analysis, data stored, data displayed, etc.) are all data that have been fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0197] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0198] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0199] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for processing alarm data of an Internet of Things (IoT) communication device, characterized in that, The method includes: The system acquires alarm data generated by IoT communication devices during operation, and determines alarm tags based on the alarm data. Each alarm tag includes at least one of the following: alarm type, alarm level, and alarm time. The alarm types are categorized according to the triggering cause into security event alarms, performance alarms, device failure alarms, and environmental monitoring alarms. Furthermore, the alarm types are categorized according to different levels of system security management into network security alarms, host security alarms, data security alarms, and operation and maintenance alarms. Predict the data processing time of the alarm data based on the alarm label; The alarm data and the data processing time are visualized. The step of predicting the data processing time of the alarm data based on the alarm label includes: Based on the alarm label, determine the target prediction model corresponding to the alarm label; the target prediction model is... Where y is the data processing time, For the alarm label, For regression coefficients, For deviation; The alarm tag is input into the target prediction model to obtain the data processing time output by the target prediction model.

2. The method according to claim 1, characterized in that, The number of alarm data is multiple, and the visualization of the alarm data and the data processing time includes: According to the preset display order, the alarm data and the corresponding data processing time of each alarm data are visualized. The display order is related to at least one of the following: the alarm time included in each alarm data, the data processing time corresponding to each alarm data, and the processing priority of each alarm data.

3. The method according to claim 1, characterized in that, Determining the alarm tag of the alarm data based on the alarm data includes: The alarm data is processed by data identification to obtain at least one alarm field, and different alarm fields correspond to different alarm information; The alarm label is determined based on the alarm information corresponding to each of the alarm fields.

4. The method according to claim 3, characterized in that, The step of determining the alarm tag based on the alarm information corresponding to each of the alarm fields includes: The alarm information corresponding to each of the alarm fields is used as the alarm label.

5. The method according to claim 3, characterized in that, The step of determining the alarm tag based on the alarm information corresponding to each of the alarm fields includes: The alarm information corresponding to each of the alarm fields is used to perform matching processing in a preset tag database to obtain the alarm tag.

6. An alarm data processing device for an Internet of Things (IoT) communication device, characterized in that, The device includes: The acquisition module is used to acquire alarm data generated by IoT communication devices during operation, and determine the alarm tag of the alarm data based on the alarm data. The alarm tag includes at least one of the alarm type, alarm level, and alarm time corresponding to the alarm data. The alarm types are classified according to the cause of the alarm as security event alarms, performance alarms, device failure alarms, and environmental monitoring alarms. The alarm types are also classified according to different levels of system security management as network security alarms, host security alarms, data security alarms, and operation and maintenance alarms. The prediction module is used to predict the data processing time of the alarm data based on the alarm label; The display module is used to visually display the alarm data and the data processing time; The prediction module is specifically used to determine the target prediction model corresponding to the alarm tag based on the alarm tag; the target prediction model is... Where y is the data processing time, For the alarm label, For regression coefficients, For deviation; The alarm tag is input into the target prediction model to obtain the data processing time output by the target prediction model.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images