A method for automatically identifying alarm categories and alarm convergence rules

Abstract

The present invention provides a method for automatically identifying alarm categories and alarm convergence rules, the method comprising: obtaining batch alarm data; constructing an alarm convergence rule base according to the batch alarm data; processing real-time alarm data based on the alarm convergence rule base, converging alarm information, and pushing the alarm information to operation and maintenance personnel. The present invention has good learning and business adaptability. While achieving effective convergence of synchronous / asynchronous alarm information and reducing the interference of invalid alarms to operation and maintenance personnel, it also reduces the complexity of convergence rule configuration and improves the utilization rate of operation and maintenance resources.

Description

Technical Field

[0001] The invention belongs to the field of alarm information, and in particular relates to a method for realizing automatic identification of alarm categories and alarm convergence rules. Background Art

[0002] As the scale and scope of information system construction continue to expand, the cost of maintaining a safe and reliable system is also increasing. At this time, alarms, as an important monitoring mechanism, are often used to promptly detect anomalies, faults, and potential risks in the system. However, in daily monitoring, operation and maintenance personnel often receive a lot of alarms at once, many of which are non-urgent or unnecessary alarms (such as prompt information, alarms with repeated content, multiple alarms with related content, etc.), which cause great interference to operation and maintenance personnel. Over time, it will cause operation and maintenance personnel to become numb and relax their vigilance when encountering more serious alarms.

[0003] However, the existing technical solutions essentially rely on various manually preset information, including alarm content templates, alarm indicator items, alarm convergence rules and related data, etc. This alarm configuration method has the following problems:

[0004] 1. The configuration process requires understanding the meaning of various complex indicator items and the configuration methods of convergence rules. The configuration is complicated, error-prone, and inefficient.

[0005] 2. With the development of new requirements and the launch of new systems, new alarms and categories cannot be effectively identified, and effective convergence operations cannot be performed for newly emerging alarm categories.

[0006] 3. Due to the need to associate alarm content and extract various indicators, there are many customized agreements. Different business systems need to use this alarm convergence method, which requires targeted customized development and is somewhat invasive to the existing system.

[0007] 4. The convergence capability of alarm correlation is insufficient, that is, the ability to converge different alarms for the same anomaly is weak.

[0008] In order to solve the above problems, the present invention provides a method for automatically identifying alarm categories and alarm convergence rules, which realizes the dynamic identification of new alarm categories. At the same time, it dynamically identifies the correlation between alarm categories according to the association analysis algorithm, extracts a set of highly correlated alarm categories, and then realizes dynamic identification and convergence of alarm categories according to the general rules of the alarm convergence rule library. Summary of the invention

[0009] The present invention provides a method for automatically identifying alarm categories and alarm convergence rules.

[0010] The technical solution of the present invention is as follows:

[0011] A method for automatically identifying alarm categories and alarm convergence rules, the method comprising:

[0012] Get batch alarm data;

[0013] Building an alarm convergence rule base according to the batch alarm data;

[0014] Based on the alarm convergence rule base, real-time alarm data is processed, alarm information is converged, and the alarm information is pushed to operation and maintenance personnel.

[0015] Further, the step of constructing a convergence rule base according to the batch alarm data is specifically as follows:

[0016] Pre-process the alarm data;

[0017] Classify the pre-processed alarm data;

[0018] Filter the classified alarm data;

[0019] Analyze the alarm data after batch filtering, automatically identify and output the correlation convergence rules of alarm categories to build an alarm convergence rule library.

[0020] Furthermore, the preprocessing of the alarm data includes performing text preprocessing on shielded invalid alarms and on non-shielded alarms.

[0021] Furthermore, the classification of the pre-processed alarm data is specifically as follows:

[0022] The classification process mainly involves matching known alarm categories one by one, and finding the category with the highest match and above the matching threshold as the category identifier of the alarm record; if no suitable alarm category is matched, a new alarm category is generated based on the current preprocessed content, and the current alarm record is recorded as the basic information of the new alarm category.

[0023] Furthermore, filtering the classified alarm data is specifically as follows:

[0024] Read filter-related parameters, including but not limited to filter time window, quantity ratio threshold, percentage preset, and reserved keywords;

[0025] Load convergence rules for frequent and repeated alarms;

[0026] Divide the categorized alarms into multiple time slices according to the configured filtering time window size, and generate various statistical information;

[0027] Calculate alarm-related statistics;

[0028] Filter and output filtered alarms.

[0029] Furthermore, the alarm data after batch filtering is analyzed, and the correlation convergence rules of the alarm categories are automatically identified and output to build an alarm convergence rule library, specifically:

[0030] Read relevant analysis parameters, including but not limited to time window parameters, support parameters and confidence parameters of association analysis;

[0031] The alarm data with category information is divided into multiple data buckets in sequence according to the time window size configured in this step.

[0032] Based on the configured support and confidence, the association analysis algorithm is executed on the basis of dividing the batch of alarms into multiple data buckets, and the frequent item sets and association rule sets of the alarm categories are output;

[0033] Merge and regularize frequent items and association rule sets;

[0034] The merged and regularized alarm category frequent items and association rules are stored in the alarm convergence rule base.

[0035] Furthermore, the step of pushing the alarm information to the operation and maintenance personnel is:

[0036] The operation and maintenance personnel can view the alarm through the web alarm management page; or push the alarm information to the operation and maintenance personnel via SMS or email.

[0037] Furthermore, it also includes: experts can make adjustments based on experience or other business and system knowledge to determine whether the frequent items and association rules automatically output by the algorithm are effective alarm convergence rules and how to converge the alarm.

[0038] Furthermore, it also includes: an expert directly inputs alarm convergence rules through a management interface as a supplement to the alarm convergence rule library.

[0039] Furthermore, the alarm convergence rules input by experts mainly include:

[0040] Convergence rules for alarms based on alarm content keywords;

[0041] Converge alarms based on the configured time period.

[0042] Convergence rules for converging alarms according to specific alarm categories;

[0043] Convergence rules for convergence alarms based on the frequency of occurrence of a specific alarm category within an agreed time window.

[0044] Compared with the prior art, the present invention has the following advantages:

[0045] The present invention provides a brand-new method, which can perform self-driven dynamic classification according to alarm information (including classification into historical categories and identification of new categories) and dynamically identify the correlation between alarm categories, and then build an alarm convergence rule base according to the alarm categories and the correlation between alarm categories to support the convergence operation of synchronous / asynchronous alarm information. The dynamic identification of alarm categories and the dynamic generation of convergence rules mentioned here enable the system to have the ability of self-iteration and updating, and has good learning and business adaptability. While achieving effective convergence of synchronous / asynchronous alarm information and reducing the interference of invalid alarms to operation and maintenance personnel, it also reduces the complexity of convergence rule configuration and improves the utilization rate of operation and maintenance resources.

[0046] At the same time, compared with the high degree of customized development of conventional alarm convergence systems, the alarm information collected by this alarm convergence system is more general, and there are no additional special constraints on the alarm content and the collection process. It only requires limited general information such as "alarm time, alarm content, source system name, IP address (optional)", achieving zero intrusion into existing systems, greatly reducing the dependence of the alarm convergence system on the implementation methods of existing systems, and improving the versatility and ease of use of this alarm convergence method and system.

[0047] At the same time, in order to more effectively utilize the existing knowledge of operation and maintenance experts, the present invention provides a management interface so that experts can review and modify the frequent items and association rules automatically regularized by the algorithm and other alarm convergence rules. Experts can also directly input some alarm convergence rules through the management interface as a supplement to the automatically generated rules, so as to better integrate expert experience into the convergence rule library. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The accompanying drawings generally illustrate various embodiments by way of example and not limitation, and together with the description and claims, serve to illustrate the embodiments of the invention. Where appropriate, the same reference numerals are used throughout the drawings to refer to the same or similar parts. Such embodiments are illustrative and are not intended to be exhaustive or exclusive embodiments of the present apparatus or method.

[0049] Figure 1 The overall framework schematic diagram of the present invention is shown;

[0050] Figure 2 A schematic diagram of the process of dynamically building an alarm convergence rule base according to the present invention is shown;

[0051] Figure 3 A schematic diagram of the alarm category identification process of the present invention is shown;

[0052] Figure 4 A schematic diagram of the alarm filtering process of the present invention is shown;

[0053] Figure 5 A schematic diagram of the alarm correlation analysis process of the present invention is shown;

[0054] Figure 6 A schematic diagram of the real-time alarm information processing flow of the present invention is shown. DETAILED DESCRIPTION

[0055] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0056] The present invention is characterized in that it provides a brand-new method to dynamically classify alarm information (including historical classification and identification of new classification) and dynamically identify the relevance of alarm categories, and then build an alarm receiving rule library according to the alarm category and alarm relevance to support the convergence operation of synchronous / asynchronous alarm information in real time. At the same time, this alarm convergence system can collect text alarm information from existing business systems or alarm systems. There are no additional information and format constraints on the alarm content and the collection process, which achieves zero intrusion into the existing system, greatly reduces the dependence of the alarm convergence system on the existing system implementation method, and improves the versatility and ease of use of this alarm convergence method and system.

[0057] The following describes the implementation principle of the present invention from three aspects: the overall framework of dynamic alarm identification and convergence, dynamic identification of alarm classification and construction of convergence rule base, and real-time convergence alarm information:

[0058] Overall framework for dynamic alarm identification and convergence

[0059] The overall framework of dynamic alarm identification and convergence in the present invention is as follows Figure 1 As shown in the figure, the overall framework of dynamic alarm identification and convergence is mainly divided into two parts: the first is the upper part in the figure, which dynamically generates and maintains the alarm convergence rule base according to batch alarm information. The second is the lower part in the figure, which matches the rules in the alarm convergence rule base for the real-time alarm information to complete the alarm convergence. Among them, the convergence rules in the alarm convergence rule base come from two parts: the most important part of the rules is the convergence rules that are automatically identified, automatically generated and automatically updated based on the content of batch alarms; the other part of the rules comes from the input of business operation and maintenance experts and the correction and improvement of the automatically generated convergence rules, so as to better integrate the expert experience into the convergence rule base and provide better alarm convergence effect.

[0060] Dynamically identify alarm classification and build a convergence rule base

[0061] The specific process of dynamically identifying alarm classification and building a convergent knowledge base is as follows: Figure 2 As shown:

[0062] Dynamically identifying alarm classification and building a convergent knowledge base is the focus of the present invention. The principles of different parts are described as follows:

[0063] Batch alarm data

[0064] Batch alarm data is the main input data for generating alarm convergence rules. Its main sources are two parts: one is the historical alarm data in the existing business or alarm system; the other is the continuous collection and accumulation of new alarm data continuously generated by the current system; the amount of data loaded in batches can be configured through parameters such as time period or batch.

[0065] For batch analysis of historical alarm data, the initial rule set of the alarm convergence rule base can be generated; for batch analysis of newly generated alarm data, the convergence rules in the alarm convergence rule base can be continuously enriched and updated, so that the alarm convergence rule base has the characteristics of self-dynamic real-time update, so as to automatically adapt to the scenarios where new alarms continue to emerge due to the emergence of new systems and new demands, and form a self-driven closed-loop update management of the alarm convergence rule base.

[0066] Alarm preprocessing

[0067] Alarm preprocessing mainly preprocesses the collected initial alarms to facilitate the subsequent identification of alarm categories and the generation of convergence rules. All operations that are beneficial to the identification of alarm categories and the generation of convergence rules are completed here.

[0068] Alarm preprocessing operations mainly include shielding invalid alarms and performing text preprocessing on non-shielded alarms. Invalid alarms are identified based on the rules in the alarm convergence rule base, such as source shielding, content keyword shielding, time shielding, etc.; while text preprocessing for non-shielded alarms includes but is not limited to splicing alarm source system information, removing numbers, etc.

[0069] Preprocessed alarm text = Remove the numbers [source alarm content + source alarm system information......]

[0070] Here, splicing the alarm source system information into the alarm content is mainly used to distinguish alarms from different sources; the numbers in the alarm content are removed because the numbers in the alarm content are often time, statistical information related to various alarm thresholds, different IPs in the same application, etc. Although this information is very important for a specific alarm content itself, it will have a negative effect on the identification of the alarm category.

[0071] Dynamic alarm classification

[0072] It has two main goals:

[0073] Assign the newly collected alarm content to a known alarm category

[0074] Alternatively, a new alarm category is generated according to the newly collected alarm content, and the content of the new alarm category is the currently pre-processed alarm content.

[0075] This method can realize the dynamic discovery and addition of alarm categories, so that they can adapt to various business scenarios without any preset restrictions. The specific implementation process is as follows: Figure 3 As shown:

[0076] For a business system or alarm system, the length and pattern of its alarm content are controllable, because the content pattern of an alarm type is relatively fixed after it is generated. Although the alarm content generated can be infinite over time, the number of alarm categories is not fixed but must be countable (although it may be large and may continue to increase). Therefore, a better classification effect can be achieved by using a text similarity algorithm, such as the Levenshtein similarity algorithm based on edit distance.

[0077] The alarm category identification process is as follows: if the current alarm can match the content of a known alarm category, the current alarm will be marked as this alarm category; if it fails to match the known alarm category, a new alarm category will be generated based on the current alarm. The content of the new alarm category is the preprocessed text content of the current alarm content. The new alarm category can be used for subsequent alarm content to match the alarm category.

[0078] Alarm filtering

[0079] Alarm filtering mainly implements filtering based on the statistical values ​​of the number and proportion of alarms and alarm categories and the configured alarm convergence rules for frequent and repeated alarms to avoid repeated generation of convergence rules for alarm correlation. The main logic is as follows Figure 4 As shown:

[0080] The specific instructions for alarm filtering are as follows:

[0081] Read filter-related parameters, including but not limited to filter time window, quantity ratio threshold, percentage preset, reserved keywords, and other filter operation-related parameters.

[0082] Load convergence rules for frequent and repeated alarms to filter out alarms that meet known convergence rules and avoid repeated generation of related alarm convergence rules.

[0083] Divide the categorized alarms into multiple time slices according to the configured filtering time window size to generate various statistical information

[0084] Calculate alarm-related statistics, mainly including but not limited to the total number of records of batch alarms participating in this filtering step, the total number of time slices, the number of time slices spanned by each alarm category, and the number of records of each alarm category, and then calculate the category time slice ratio of each alarm category, and the category record ratio of the number of records of each alarm category to the total number of alarm records. Similarly, the number of alarm records in each event slice and the number of alarm categories and related ratios in the time slice can also be further calculated. Here, only the statistics of batch alarms participating in this filtering step are used as an example for explanation.

[0085] Category time slice ratio = number of time slices spanned by the alarm category / total number of time slices

[0086] Category record ratio = number of records in each alarm category / total number of alarm records

[0087] Filter and output the filtered alarms. Alarm filtering is mainly based on conditions such as category time slice ratio, category record ratio, and reserved keywords. That is, the filtered alarms must meet the following conditions:

[0088] (Category time slice ratio < configured category time slice ratio threshold and Category record ratio < configured category record ratio threshold) or the alarm content contains reserved keywords

[0089] Alarm correlation analysis

[0090] Alarm correlation analysis aims to automatically identify and output the correlation convergence rules of alarm categories by analyzing the alarm contents in batches. The main logic is as follows: Figure 5 As shown:

[0091] The specific process of alarm correlation analysis is as follows:

[0092] Read relevant analysis parameters, including but not limited to time window parameters, support parameters and confidence parameters of association analysis, and other parameters required for subsequent analysis.

[0093] Divide the data buckets and divide the alarm data with category information into multiple data buckets in sequence according to the time window size configured in this step.

[0094] Execute the association analysis algorithm, and execute the association analysis algorithm (such as fp-growth, apriori, etc.) on the basis of dividing the batch of alarms into multiple data buckets according to the configured parameters such as support and confidence, and output the frequent item sets and association rule sets of the alarm categories.

[0095] Note: If alarm categories A and B often appear together and meet the algorithm support threshold, they are recorded as frequent items (A, B); if alarm categories A and B appear, then alarm categories C and D will also appear with a high probability and meet the algorithm confidence threshold, which is recorded as association rule (A, B) -> (C, D).

[0096] Among them, support represents the probability of frequent item set {A, B} appearing in the total frequent item set, and the formula is:

[0097] Support(A->B)=P(A,B) / P(I)=N(A,B) / N(I)

[0098] Confidence indicates the probability of inferring B from the association rule "A->B" when the prerequisite A occurs. The formula is:

[0099] Confidence(A->B)=P(B|A)=P(A,B) / P(A)=N(A,B) / N(A)

[0100] Here, I represents the total frequent itemsets, P() represents the probability of a specific itemset appearing in the frequent itemsets, N() represents the number of times a specific itemset appears in the frequent itemsets, P(A,B) represents the probability of A and B appearing at the same time, and P(B|A) represents the probability of B appearing when A appears.

[0101] Merging and regularizing frequent items and association rules mainly aims at merging frequent items and association rules that contain each other.

[0102] For example, if there are five alarm categories, A, B, C, D, and E, and if (A, B) and (A, B, C) are both frequent items, (A, B) will be deleted because it is included in (A, B, C). Similarly, if there are two association rules, (A, B)->(C, D) and (A, B)->(C, D, E), (A, B)->(C, D) will be deleted because it is included in (A, B)->(C, D, E).

[0103] Output correlation alarm convergence rules, responsible for storing the merged and regularized alarm category frequent items and association rules as initial rules into the alarm convergence rule base.

[0104] Alarm convergence rule base

[0105] The main source of convergence rules stored in the alarm convergence rule library is the correlation convergence rules automatically and dynamically constructed in the above process. For this part of the automatically generated alarm convergence rules, experts can conduct necessary review and corrections through the management page / interface to improve the effect of alarm convergence. The expert review and correction here means that experts can make appropriate manual adjustments to the frequent items and association rules output by the algorithm based on experience or other business and system knowledge to determine whether they are valid alarm convergence rules and how to converge alarms to achieve better alarm convergence effects.

[0106] The default rules for using the correlation convergence rules output by the algorithm are as follows:

[0107] Assume that the algorithm automatically and dynamically identifies five types of alarms, A, B, C, D, and E, and outputs frequent items (A, B, C, D) and association rules (A, B) -> (C, D). When processing real-time alarm data, it is found that the categories corresponding to the alarms are (A, B, C, D). In this case, the alarms can be merged into (A, B) and then pushed.

[0108] In addition, a small number of rules in the convergence rule base are directly input by experts, so as to better integrate expert experience into the convergence rule base and provide better alarm convergence effect. The alarm convergence rules input by experts mainly include the following categories:

[0109] Convergence rules for alarms based on alarm content keywords

[0110] Convergence rules for convergence alarms based on the configured time period

[0111] Convergence rules for converging alarms based on specific alarm categories

[0112] Converge alarm information in real time according to the convergence rules of the convergence alarms of the frequency of occurrence of specific alarm categories within the agreed time window

[0113] The process of real-time convergence alarm information is as follows Figure 6 As shown:

[0114] Real-time convergence alarm information mainly uses the alarm convergence rule base to perform convergence operations on the alarms collected in real time. The following is an explanation of the principles of different parts:

[0115] Real-time alarm data refers to alarm data collected in real time, which can be collected in streaming data or in small batches. In addition to being used for alarm convergence and push, the alarm data collected in real time can also be stored for the regular execution of "dynamic identification of alarm classification and building of convergence knowledge base" to automatically and dynamically update and iterate the convergence rules, so as to better adapt to the new alarm data generated by the continuous iteration of the system and business.

[0116] Alarm preprocessing has the same logic as the "alarm preprocessing" in "dynamic identification of alarm classification and building convergence rule base", and its main operations include shielding invalid alarms and text preprocessing of non-shielded alarms. Among them, shielding invalid alarms refers to the convergence operation based on the specific content and frequency of the alarm itself in the alarm convergence rule base, such as converging alarms based on content keywords, cold alarms based on time periods, and converging alarms based on alarm occurrence frequency, etc.; while text preprocessing of non-shielded alarms includes but is not limited to splicing alarm source system information, removing numbers, etc.

[0117] The classification method used by dynamic alarm classification is the same as the logic of "dynamic alarm classification" in "dynamic identification of alarm classification and construction of convergence rule base". It mainly matches the real-time alarm content with the known alarm category through the similarity algorithm. If it can match the same alarm category, it is marked as a known alarm category. If it cannot match the known alarm category, the current alarm is identified as a new alarm category, and the content of the new alarm category is the current pre-processed alarm content.

[0118] Alarm convergence is to converge alarm information according to the convergence rules in the alarm rule library.

[0119] Alarm push is to push alarm information to operation and maintenance personnel. There are many forms of push: display the converged alarm information through the web alarm management page, and click the converged alarm information to drill down to display the converged alarm information; push the converged content to the operation and maintenance personnel through SMS; send the converged information to the operation and maintenance personnel through email, etc.

[0120] The present invention proposes a method and system for automatically identifying alarm categories and alarm convergence rules, which is mainly divided into two parts: "dynamically identifying alarm categories and building a convergence knowledge base" and "real-time convergence alarm information". The specific implementation steps are as follows:

[0121] Step 1: Collect historical alarm data in batches

[0122] Batch collect historical alarm data as input data for generating alarm convergence rule base. The format of the collected original alarm data is as follows:

[0123] Alarm time, alarm content, alarm system name, IP address (optional)

[0124] The content involved in the above alarm format has a certain universality, and the information can be collected without requiring business transformation of the source business system, which can reduce the invasive transformation of the source business system, improve the scope of application of the alarm subsystem, and make the alarm convergence subsystem have a certain degree of independence.

[0125] After the collected alarm information is stored in the alarm convergence subsystem, a unique alarm identifier will be generated.

[0126] Step 2: Alarm preprocessing

[0127] Filter and format the alarm content, and directly filter out some invalid alarms based on content keywords, time periods, etc. At the same time, perform necessary content formatting on valid alarms to facilitate the subsequent steps of alarm category identification and alarm convergence rule generation.

[0128] If the warning message is:

[0129]

[0130]

[0131] The content after preprocessing is:

[0132]

[0133] Step 3: Dynamic alarm classification

[0134] Based on the preprocessed content in the previous step, the alarm is classified. The classification process mainly matches the known alarm categories one by one, and finds the category with the highest matching degree and higher than the matching degree threshold as the category identifier of the alarm record. If no suitable alarm category is matched, a new alarm category is generated based on the current preprocessed content, and the current alarm record is recorded as the base information of the new alarm category.

[0135] If the warning information is as follows:

[0136]

[0137] The alarm categories are as follows:

[0138]

[0139]

[0140] The alarm content after processing in this step is:

[0141]

[0142] Alarm category:

[0143] Category Identification Category Name Alarm content 1 Category 1 Memory usage exceeds the set threshold, value:, threshold: [] 2 Category 2 Order system, CPU usage exceeds the set threshold, value: Threshold: []

[0144] Step 4: Alarm filtering

[0145] It mainly targets various statistical information of alarms and alarm categories, and filters out alarm categories and related alarm information that meet the characteristics of frequent and repeated alarms.

[0146] Step 5: Alarm correlation analysis

[0147] The batch data is divided into multiple data buckets according to the configured time window parameters, and the association analysis algorithm (such as fp-growth, apriori, etc.) is executed to output the initial data set of frequent items and association rules of the alarm category.

[0148] For the initial data set, the relevant frequent item sets and association rule sets are merged according to the "inclusion" rule to form a preliminary alarm convergence rule base.

[0149] Step 6: Expert Review and Revision

[0150] This step is optional. Experts can make appropriate manual adjustments to the frequent items and association rules automatically output by the algorithm based on experience or other business and system knowledge to determine whether they are effective alarm convergence rules and how to converge alarms in order to achieve better alarm convergence results.

[0151] For example, for frequent items (A, B, C, D) and association rules (A, B)->(C, D), experts can set them as invalid rules through the management interface, or adjust frequent items (A, B, C, D) and association rules (A, B)->(C, D) to (A, C, D) and (A)->(C, D) to make the convergence rules more targeted.

[0152] In addition, operation and maintenance experts can also directly input some alarm convergence rules through the management interface as a supplement to the automatically generated rules, so as to better integrate expert experience into the convergence rule base.

[0153] Step 7: Process real-time alarm data and converge alarm information

[0154] Real-time convergence alarm information mainly uses the alarm convergence rule base to perform convergence operations on the alarms collected in real time. When processing real-time alarm data, it is also necessary to perform migration operations similar to the "alarm preprocessing" and "alarm dynamic classification" in the process of batch processing alarm data to form the alarm convergence rule base, and then match the rules in the alarm convergence rule base according to the processed alarm content and alarm category to perform alarm convergence operations.

[0155] Step 8: Pushing alarm convergence information

[0156] The converged alarm information can be viewed through the web alarm management page. Clicking on the converged alarm information can drill down to display the converged alarm information. The converged content can also be pushed to the operation and maintenance personnel via SMS or email.

[0157] In summary, the method and system for intelligent alarm convergence provided by the present invention can improve the efficiency and quality of operation and maintenance alarms, reduce the interference of invalid information on operation and maintenance personnel by intelligently converging alarm information, and improve the work efficiency of operation and maintenance and the utilization efficiency of operation and maintenance resources.

[0158] It should be understood that the above-mentioned figures are only schematic illustrations of the processes included in the method according to the exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes, and at the same time, these processes can be performed synchronously or asynchronously in multiple modules.

[0159] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A method for automatically identifying alarm categories and alarm convergence rules, characterized in that: The method comprises: Get batch alarm data; Building an alarm convergence rule base according to the batch alarm data; Processing real-time alarm data based on the alarm convergence rule base, converging alarm information, and pushing the alarm information to operation and maintenance personnel; The specific steps of constructing a convergence rule base according to the batch alarm data are as follows: Preprocess the alarm data; Classify the pre-processed alarm data; Filter the classified alarm data; Analyze the alarm data after batch filtering, automatically identify and output the correlation convergence rules of alarm categories to build an alarm convergence rule library; The classification of the pre-processed alarm data is specifically as follows: The classification process mainly involves matching known alarm categories one by one, and finding the category with the highest matching degree and higher than the matching degree threshold as the category identifier of the alarm record; if no suitable alarm category is matched, a new alarm category is generated based on the current preprocessed content, and the current alarm record is recorded as the basic information of the new alarm category; The filtering of the classified alarm data is specifically as follows: Read filter-related parameters, including but not limited to filter time window, quantity ratio threshold, percentage ratio threshold, and reserved keywords; Load convergence rules for frequent and repeated alarms; Divide the categorized alarms into multiple time slices according to the configured filtering time window size, and generate various statistical information; Calculate alarm-related statistics; Filter and output filtered alarms; Analyze the alarm data after batch filtering, automatically identify and output the correlation convergence rules of the alarm categories to build the alarm convergence rule library, specifically: Read relevant analysis parameters, including but not limited to time window parameters, support parameters and confidence parameters of association analysis; Divide the alarm data with category information into multiple data buckets in sequence according to the time window size configured in this step; Based on the configured support and confidence, the association analysis algorithm is executed on the basis of dividing the batch of alarms into multiple data buckets, and the frequent item sets and association rule sets of the alarm categories are output; Merge and regularize frequent items and association rule sets; The merged and regularized alarm category frequent items and association rules are stored in the alarm convergence rule base.

2. The method for realizing automatic identification of alarm categories and alarm convergence rules according to claim 1, characterized in that: The preprocessing of the alarm data includes text preprocessing of shielded invalid alarms and non-shielded alarms.

3. The method for automatically identifying alarm categories and alarm convergence rules according to claim 1, characterized in that: The method of pushing the alarm information to the operation and maintenance personnel is as follows: The operation and maintenance personnel can view the alarm through the web alarm management page; or push the alarm information to the operation and maintenance personnel via SMS or email.

4. The method for realizing automatic identification of alarm categories and alarm convergence rules according to claim 1, characterized in that: Also includes: Experts can make adjustments based on experience or other business and system knowledge to determine whether the frequent items and association rules automatically output by the algorithm are effective alarm convergence rules and how to converge alarms.

5. The method for realizing automatic identification of alarm categories and alarm convergence rules according to claim 1, characterized in that: Also includes: Experts directly input alarm convergence rules through the management interface as a supplement to the alarm convergence rule library.

6. The method for realizing automatic identification of alarm categories and alarm convergence rules according to claim 5, characterized in that: The alarm convergence rules input by experts mainly include: Convergence rules for alarms based on alarm content keywords; Converge alarms based on the configured time period. Convergence rules for converging alarms according to specific alarm categories; Convergence rules for convergence alarms based on the frequency of occurrence of a specific alarm category within an agreed time window.

Images