Alarm grade division method, device and equipment

Abstract

The invention discloses an alarm grade division method, device and equipment, and relates to the technical field of intelligent operation and maintenance, and the method comprises the steps: obtaining alarm data; calculating the alarm data through a pre-constructed feature function model to obtain a target feature value; calculating the target characteristic value through a pre-constructed unsupervised model to obtain an alarm grade reference threshold value; and grade identification is carried out based on the target characteristic value and the alarm grade reference threshold value to obtain alarm grade information, and alarm data can be processed in time.

Description

Technical Field

[0001] The present application relates to the field of intelligent operation and maintenance technology, and in particular to an alarm level classification method, device and equipment. Background Art

[0002] The alarm level classification of abnormal time series data is carried out by comprehensively analyzing the data volume, interval range, degree of change and other characteristics of the alarm interval, and then evaluating the severity to achieve alarm classification. When an abnormal indicator occurs, the alarm level classification can assist operation and maintenance personnel to quickly locate and solve more serious problems.

[0003] At present, the alarm level classification is usually based on the pre-defined level rules after manually collecting various monitoring indicator data. However, banking business scenarios are rich, many businesses are complex and dynamically changing, and as business indicators grow, alarm types are diverse, and a large number of alarms are generated every day, making it difficult for operation and maintenance personnel to handle them in a timely manner.

[0004] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of this application is to provide an alarm level classification method, device and equipment, aiming to solve the current technical problem that alarm data cannot be processed in a timely manner by manpower alone.

[0006] To achieve the above objectives, the present application proposes a method for classifying alarm levels, the method comprising:

[0007] Get alarm data;

[0008] Calculating the alarm data through a pre-built characteristic function model to obtain a target characteristic value;

[0009] The target characteristic value is calculated by using a pre-built unsupervised model to obtain a reference threshold value of the alarm level;

[0010] Level identification is performed based on the target characteristic value and the alarm level reference threshold to obtain alarm level information.

[0011] In one embodiment, the characteristic function model includes at least one of a steady-type down-warning characteristic function model, a steady-type up-warning characteristic function model, and a discrete down-warning characteristic function model.

[0012] The alarm data includes an alarm interval feature vector, and the alarm interval feature vector includes the average value of the percentage increase or decrease of abnormal points in the alarm interval.

[0013] When the characteristic function model is the stability degradation alarm characteristic function model, the step of calculating the alarm data by using the pre-constructed characteristic function model to obtain the target characteristic value includes:

[0014] Calculate a first intermediate eigenvalue based on the warning interval eigenvector;

[0015] performing normalization processing on the first intermediate eigenvalue;

[0016] Performing piecewise weighted processing on the average of the percentage of increase or decrease of abnormal points within the alarm interval;

[0017] The target eigenvalue is calculated by combining the normalized first intermediate eigenvalue and the average value of the percentage increase or decrease of abnormal points in the warning interval after the piecewise weighted processing.

[0018] In one embodiment, when the characteristic function model is the steady-type rising alarm characteristic function model, the step of calculating the alarm data using the pre-constructed characteristic function model to obtain the target characteristic value includes:

[0019] Calculating a second intermediate eigenvalue based on the warning interval eigenvector;

[0020] The second intermediate eigenvalue is normalized to obtain the target eigenvalue.

[0021] In one embodiment, when the characteristic function model is the discrete downgrade alarm characteristic function model, the step of calculating the alarm data by using the pre-constructed characteristic function model to obtain the target characteristic value includes:

[0022] Defining a zero-value interval feature in the warning interval feature vector to obtain a new warning interval feature;

[0023] Calculate the discrete degree ratio of the current warning interval relative to the historical performance based on the new warning interval characteristics;

[0024] Scaling the average of the percentage increase or decrease of abnormal points within the alarm interval;

[0025] A third intermediate characteristic value is calculated based on the discrete degree ratio of the current warning interval to the historical performance and the average value of the percentage increase or decrease of the abnormal points in the scaled warning interval;

[0026] The third intermediate eigenvalue is normalized to obtain the target eigenvalue.

[0027] In one embodiment, the step of calculating the target feature value by using a pre-built unsupervised model to obtain the alarm level reference threshold comprises:

[0028] Calculating the target feature value by using a pre-built Gaussian mixture model to obtain a first cluster;

[0029] adding labels to each of the clusters based on the mean of each of the first clusters to obtain first clusters after adding labels;

[0030] Based on a preset interval fine granularity, the boundary values ​​of the means of the first clustering clusters after adding labels are supplemented to obtain an expanded data set;

[0031] Calculating the expanded data set by using the Gaussian mixture model to obtain a second cluster;

[0032] The alarm level reference threshold is calculated based on the second cluster.

[0033] In one embodiment, the step of calculating the alarm level reference threshold based on the second cluster includes:

[0034] Determining whether the alarm level reference threshold reaches a preset alarm level classification standard;

[0035] If not, after retraining the Gaussian mixture model, the step of calculating the target feature value by using a pre-constructed Gaussian mixture model is performed to obtain a first cluster.

[0036] In one embodiment, the alarm level reference threshold includes a maximum eigenvalue and a minimum eigenvalue, and the step of performing level identification based on the target eigenvalue and the alarm level reference threshold to obtain alarm level information includes:

[0037] Determine whether the target eigenvalue is greater than the maximum eigenvalue;

[0038] If so, output the severity level information;

[0039] If not, determining whether the target eigenvalue is less than the minimum eigenvalue;

[0040] If yes, then output the level information of the mild level;

[0041] If not, output the level information of the medium level.

[0042] In one embodiment, the alarm data includes alarm history information, and the step of performing level identification based on the target characteristic value and the alarm level reference threshold to obtain the alarm level information further includes:

[0043] Determine whether a continuous alarm level has been marked on the previous day;

[0044] If yes, and an alarm occurs on that day, the previous continuous flag is inherited and the continuous alarm level is marked;

[0045] If yes, and no alarm occurs on that day, the continuous alarm level is lifted, and the continuous flag is set to a non-continuous state value;

[0046] If not, determining whether the alarm history information contains alarm information of a serious level;

[0047] If the alarm history information contains alarm information of a serious level and an alarm occurs on the same day, the continuous flag is set to a serious continuous state value to mark the continuous alarm level;

[0048] If there is no serious alarm information in the alarm history information and an alarm occurs on the current day, the continuous flag is increased by 1. When the continuous flag accumulation is greater than a preset continuous flag threshold, the continuous alarm level is marked.

[0049] In addition, to achieve the above purpose, the present application also proposes an alarm level classification device, the alarm level classification device comprising:

[0050] A data acquisition module, used to acquire alarm data;

[0051] A feature calculation module, used to calculate the alarm data through a pre-built feature function model to obtain a target feature value;

[0052] A threshold calculation module is used to calculate the target feature value through a pre-built unsupervised model to obtain an alarm level reference threshold;

[0053] The level identification module is used to perform level identification based on the target characteristic value and the alarm level reference threshold to obtain alarm level information.

[0054] In addition, to achieve the above-mentioned purpose, the present application also proposes an alarm level classification device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, and the computer program is configured to implement the steps of the alarm level classification method described above.

[0055] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the alarm level classification method described above are implemented.

[0056] One or more technical solutions proposed in this application have at least the following technical effects:

[0057] This application calculates the alarm data through a pre-built characteristic function model to obtain a target characteristic value, calculates the target characteristic value through a pre-built unsupervised model to obtain an alarm level reference threshold, performs level identification based on the target characteristic value and the alarm level reference threshold, obtains alarm level information, and can process and identify alarm data in real time and quickly generate alarm level information. This is particularly important for alarm scenarios that require rapid response and processing, and helps to take timely measures to deal with potential risks and problems. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0059] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0060] Figure 1 A flowchart of the first embodiment of the alarm level classification method of the present application is provided;

[0061] Figure 2 This is a schematic diagram of a stable sequence of the alarm level classification method of this application;

[0062] Figure 3 This is a schematic diagram of the discrete sequence of the alarm level classification method of this application Figure 1 ;

[0063] Figure 4 This is a schematic diagram of the discrete sequence of the alarm level classification method of this application Figure 2 ;

[0064] Figure 5 A flowchart of calculating the reference threshold value of the alarm level according to the alarm level classification method of this application;

[0065] Figure 6 A flowchart of the alarm level classification method for this application;

[0066] Figure 7 This is a schematic diagram of the overall process of the alarm level classification method for this application;

[0067] Figure 8 This is a schematic diagram of the module structure of the alarm level classification device according to an embodiment of the present application;

[0068] Fig. 9Schematic diagram of the device structure of the hardware operating environment involved in the alarm level classification method in the embodiment of the present application.

[0069] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0070] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0071] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0072] The main solution of the embodiment of the present application is: obtaining alarm data; calculating the alarm data through a pre-constructed feature function model to obtain a target feature value; calculating the target feature value through a pre-constructed unsupervised model to obtain an alarm level reference threshold; performing level identification based on the target feature value and the alarm level reference threshold to obtain alarm level information.

[0073] In this embodiment, for the convenience of description, the following description is made with the alarm level classification device as the execution subject.

[0074] Due to the rich business scenarios of current banks, many businesses are complex and dynamically changing. In addition, as business indicators grow, alarm types become diverse, and a large number of alarms are generated every day, making it impossible for operation and maintenance personnel to handle them in a timely manner.

[0075] The present application provides a solution, which calculates the alarm data through a pre-built characteristic function model to obtain a target characteristic value, calculates the target characteristic value through a pre-built unsupervised model to obtain an alarm level reference threshold, performs level identification based on the target characteristic value and the alarm level reference threshold, obtains alarm level information, and can process and identify alarm data in real time, and quickly generate alarm level information. This is particularly important for alarm scenarios that require rapid response and processing, and helps to take timely measures to deal with potential risks and problems.

[0076] It should be noted that the execution subject of this embodiment may be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, an alarm level classification device, etc. The following takes the alarm level classification device as an example to illustrate this embodiment and the following embodiments.

[0077] Based on this, the embodiment of the present application provides a method for classifying alarm levels, referring to Figure 1 , Figure 1A flowchart of the first embodiment of the alarm level classification method of the present application is provided.

[0078] In this embodiment, the alarm level classification method includes steps S10 to S40:

[0079] Step S10, obtaining alarm data;

[0080] It should be noted that alarm data is a detailed record of abnormal system, network, application or device operating status captured and recorded by the monitoring system. It includes but is not limited to the time, location (such as IP address, device number, etc.), type (such as hardware failure, software error, security threat, etc.), severity, related parameters (such as performance indicators, error codes, etc.), and possible solutions or suggestions. In addition, alarm data may also include feature vector data specific to the alarm scenario for further analysis and identification of alarm patterns, as well as historical alarm data for time series analysis, trend prediction, and pattern recognition.

[0081] Alarm data also includes performance indicator alarms, security alarms, log alarms, dependency alarms, custom alarms, correlation alarms, and predictive alarms.

[0082] Step S20, calculating the alarm data using a pre-built characteristic function model to obtain a target characteristic value;

[0083] It should be noted that this embodiment defines multiple function models to adapt to complex time series alarms in rich business scenarios.

[0084] Among them, as an implementation method, multiple pre-built characteristic function models can cope with complex time series alarms generated by rich business scenarios.

[0085] Furthermore, the characteristic function model includes a falling alarm characteristic function model and a rising alarm characteristic function model for processing a stationary sequence, and a falling alarm characteristic function model for a discrete sequence.

[0086] Among them, as another implementation method, based on the warning interval feature vector data, multiple types of algorithms can be integrated to fit the S-type function for mapping processing, which can reduce the vector dimension and the unsupervised model training cost while improving the influence of important features. The alarm level reference threshold output by the function model is subsequently converted by the mapping function in the online level recognition module, and the final level information is output.

[0087] Step S30, calculating the target feature value through a pre-built unsupervised model to obtain an alarm level reference threshold;

[0088] Among them, the unsupervised method does not require manual labeling of training set data, and the data performance characteristics of various types of sequences have been fully considered in the characteristic value calculation stage. During the training and calculation of the alarm level threshold, specific severity alarm data can still be expanded according to actual business needs to fine-tune the threshold distribution and optimize the classification effect. Compared with manual labeling or customized rules, the adaptive division of the alarm level threshold range based on the unsupervised model is more efficient.

[0089] As an implementation method, the clustering clusters obtained through offline module training can be used as a pre-built unsupervised model, and the alarm level reference threshold can be obtained through clustering cluster calculation.

[0090] Step S40: performing level identification based on the target characteristic value and the alarm level reference threshold to obtain alarm level information.

[0091] Among them, real-time level recognition can be performed, continuous level recognition can be performed, and real-time level recognition and continuous level recognition can be combined.

[0092] As an implementation method, the final alarm level identification and score description output can be achieved through the online level identification module combined with the continuous level analysis component.

[0093] This embodiment provides a method for classifying alarm levels. This application calculates the alarm data through a pre-constructed characteristic function model to obtain a target characteristic value, calculates the target characteristic value through a pre-constructed unsupervised model to obtain an alarm level reference threshold, performs level identification based on the target characteristic value and the alarm level reference threshold, obtains alarm level information, and can process and identify alarm data in real time and quickly generate alarm level information. This is particularly important for alarm scenarios that require rapid response and processing, and helps to take timely measures to deal with potential risks and problems.

[0094] In addition, this embodiment summarizes and sorts out the rich time series types and characteristics of banking business scenarios, integrates various characteristics, and designs and implements a universal and adaptive recognition time series alarm level classification method, which can adapt to multiple types of time series such as stable, irregular, and discrete. The level score is fitted by a custom feature function model, and then combined with the unsupervised clustering model training classification, the alarm level information is obtained.

[0095] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the first embodiment can be referred to the above description, and will not be repeated in the following. On this basis, the characteristic function model includes at least one of a steady-type descending alarm characteristic function model, a steady-type rising alarm characteristic function model, and a discrete descending alarm characteristic function model.

[0096] The alarm data includes an alarm interval feature vector, which includes the average percentage of increase or decrease of abnormal points in the alarm interval. The alarm interval feature vector can be expressed as AlarmVec=[num, count, percent], where num is the average statistical value magnitude of the abnormal points in the alarm interval, count is the number of abnormal points in the alarm interval, and percent is the average percentage of increase or decrease of abnormal points in the alarm interval.

[0097] When the characteristic function model is the stability degradation alarm characteristic function model, step S20, calculating the alarm data by using the pre-built characteristic function model to obtain the target characteristic value also includes steps S21 to S24:

[0098] Step S21, calculating a first intermediate eigenvalue based on the warning interval eigenvector;

[0099] It should be noted that the stationary series has continuous values, obvious cycles and trends, relatively small fluctuations, and large overall magnitude. Figure 2 shown.

[0100] Step S22, normalizing the first intermediate eigenvalue;

[0101] Step S23, performing segmented weighting processing on the average of the percentage of increase or decrease of abnormal points in the alarm interval;

[0102] Step S24, combining the normalized first intermediate eigenvalue and the average value of the percentage increase or decrease of abnormal points in the alarm interval after the piecewise weighted processing, to calculate the target eigenvalue.

[0103] Among them, the steady-state descent alarm characteristic function model can be applied to the characteristic value calculation of the descent alarm interval of the steady-state sequence. The specific steps are as follows:

[0104] (1) Input the alarm interval feature vector AlarmVec = [num, count, percent], and calculate the first intermediate feature value of area according to (Formula 1).

[0105]

[0106] (2) Perform normalization processing and use the MinMaxScalar model trained with the training set to scale the first intermediate eigenvalue to the interval (0, 1) to avoid the problem of value out of bounds.

[0107] (3) According to (Formula 2), the percent value is weighted in sections.

[0108]

[0109] (4) Combine the normalized first intermediate eigenvalue of area and the percent′ value to calculate the target eigenvalue size according to (Formula 3).

[0110] size=percent′×area (formula 3)

[0111] The embodiment of the present application calculates the matching alarm data through a stable decline alarm function model to obtain a target characteristic value, thereby providing a more accurate calculation model and allocating resources reasonably.

[0112] Based on the second embodiment of the present application, in the third embodiment of the present application, the same or similar contents as those in the second embodiment can be referred to the above description, and will not be described in detail later. On this basis, when the characteristic function model is the stable rising alarm characteristic function model, step S20, calculating the alarm data through the pre-constructed characteristic function model, and obtaining the target characteristic value also includes steps S25 to S26:

[0113] Step S25, calculating a second intermediate eigenvalue based on the warning interval eigenvector;

[0114] Step S26, normalizing the second intermediate eigenvalue to obtain the target eigenvalue.

[0115] Among them, the steady rising alarm characteristic function model can be applied to the calculation of the characteristic value of the rising alarm interval of the steady sequence. The steady rising alarm characteristic function model can be understood as the volume size of the fitting alarm interval. The larger the volume, the more serious the corresponding alarm level.

[0116] The specific steps are as follows:

[0117] (1) Input the alarm interval feature vector AlarmVec = [num, count, percent], and calculate the second intermediate feature value size′ according to (Formula 4).

[0118] size′=(0.5×log 100 (min(count,1440)+1)×(log 100 (num+1)) 3 +0.5×log 10 percent) 2 (Formula 4)

[0119] (2) Normalize size′ and use the MinMaxScalar model trained with the training set to scale the second intermediate eigenvalue to the (0,1) interval and output the target eigenvalue of size.

[0120] The embodiment of the present application calculates the matching alarm data through a stable rising alarm function model to obtain the target characteristic value, thereby providing a more accurate calculation model and reasonably allocating resources.

[0121] Based on the second embodiment of the present application, in the fourth embodiment of the present application, the same or similar contents as those in the second embodiment can be referred to the above description, and will not be described in detail later. On this basis, when the characteristic function model is the discrete downgrade alarm characteristic function model, step S20, calculating the alarm data through the pre-constructed characteristic function model, and obtaining the target characteristic value also includes steps S27 to S211:

[0122] Step S27, defining a zero-value interval feature in the warning interval feature vector to obtain a new warning interval feature;

[0123] It should be noted that the discrete sequence is generally distributed discretely, the data has no obvious regularity or cycle, and has strong random volatility. Figure 3 and Figure 4 shown.

[0124] For such sequences, this module customizes the zero value interval feature zero in the warning interval feature vector cur 、zero ref Replace the statistic num in the stationary vector and the number of abnormal points count in the warning interval.

[0125] Among them, zero cur is the actual length of the continuous zero value interval, zero ref is to predict the length of the zero-value interval. The zero-value interval feature can be used to measure and analyze the abnormal state of the discrete sequence's service interruption, failure, and other declining performance. The zero-value interval is the sequence at t i The length of the continuous 0-value area from the time forward, counted in minutes.

[0126] Step S28, calculating the discrete degree ratio of the current warning interval relative to the historical performance based on the new warning interval characteristics;

[0127] Step S29, scaling the average of the percentage increase or decrease of abnormal points in the alarm interval;

[0128] Step S210, calculating a third intermediate characteristic value based on the discrete degree ratio of the current warning interval to the historical performance and the scaled average of the percentage increase or decrease of abnormal points in the warning interval;

[0129] Step S211, normalizing the third intermediate eigenvalue to obtain the target eigenvalue.

[0130] The specific steps are as follows:

[0131] (1) Input discrete sequence alarm interval feature vector AlarmVec = [zero ref ,zero cur ,percent], and calculate the area feature value according to (Formula 5). Area is the ratio of the discrete degree of the current alarm interval to the historical performance.

[0132]

[0133] (2) Further scaling of percent and zero ref Numerical value, input (Formula 6) to calculate and generate percent′.

[0134]

[0135] (3) The third intermediate eigenvalue size′ is calculated and generated according to (Formula 7).

[0136] size′=(0.8×area+0.2×percent′) 2 (Formula 7)

[0137] (4) Normalize the third intermediate eigenvalue size′, use the MinMaxScalar model trained with the training set, scale the third intermediate eigenvalue to the interval (0,1), and output the target eigenvalue size.

[0138] The embodiment of the present application proposes a level division solution based on a small-scale strategy to address the pain point sequence in the irregular and discrete alarm level division problem.

[0139] Based on the first embodiment of the present application, in the fifth embodiment of the present application, the same or similar contents as those in the first embodiment can be referred to the above description, and will not be repeated in the following. On this basis, step S30, calculating the target feature value through a pre-built unsupervised model to obtain the reference threshold of the alarm level also includes steps S31 to S35:

[0140] Step S31, calculating the target feature value by using a pre-built Gaussian mixture model to obtain a first cluster;

[0141] Among them, this embodiment uses a Gaussian mixture model (GMM) to perform offline, unsupervised clustering processing on the target characteristic values ​​of various alarm intervals, and then uses the boundaries of each cluster cluster to calculate the alarm level reference threshold to provide a judgment basis for the online alarm level identification module.

[0142] It should be noted that the Gaussian mixture model can accurately quantify things with a Gaussian density function, decompose an thing into several sub-distributions based on Gaussian probability density functions, and has good mathematical properties and good computing performance.

[0143] Before using the Gaussian mixture model to calculate the target eigenvalue, it is necessary to train a Gaussian mixture model GmmModel, wherein the initialization parameters of the Gaussian mixture model are generated based on the K-means algorithm, which converges faster and has better effects than the original randomization method.

[0144] Step S32, adding labels to each of the clusters based on the mean of each of the first clusters, to obtain first clusters after adding labels;

[0145] Step S33, supplementing the boundary values ​​of the means of the first clustering clusters after adding labels based on a preset interval fine granularity to obtain an expanded data set;

[0146] Step S34, calculating the expanded data set by using the Gaussian mixture model to obtain a second cluster;

[0147] Step S35: Calculate the alarm level reference threshold based on the second cluster.

[0148] The algorithm flow steps for using the Gaussian mixture model to train and calculate the alarm level threshold range are as follows:

[0149] (1) Compare the mean values ​​of each cluster, add labels to each cluster data set in order from small to large, and then output each cluster set, that is, the first cluster: C light , C medium , C serious . And extract the mean of each of the first clusters: mean light 、mean medium 、mean serious .

[0150] (2) According to (Formula 8) to (Formula 10), the values ​​between the mean boundaries of the first cluster are expanded. Where interval = 0.001, and the data is supplemented at intervals to calculate a more accurate level threshold.

[0151] S light =np.arange(mean light ,mean medium ,int erval) (Formula 8)

[0152] S serious =np.arange(mean medium ,meanserious ,int erval) (Formula 9)

[0153] S extend =S+S light +S serious (Formula 10)

[0154] (3) Expand the dataset S extend Input the GmmModel model again and calculate the second cluster: C′ light , C′ medium , C′ serious .

[0155] (4) Based on the second cluster, calculate the output alarm level threshold range levelThreshold according to (Formula 11), that is, C′ medium The maximum and minimum size values ​​in the collection.

[0156] levelThreshold = [C′ medium .size.min,C′ medium .size.max](Formula 11)

[0157] The embodiment of the present application calculates the target characteristic value through a Gaussian mixture model to obtain an alarm level reference threshold. Since the Gaussian mixture model can accurately quantify things with a Gaussian density function, decompose an object into several sub-distributions based on a Gaussian probability density function, and has good mathematical properties and good computing performance, it can improve the accuracy of the alarm level reference threshold.

[0158] Based on the fifth embodiment of the present application, in the sixth embodiment of the present application, the same or similar contents as those in the fifth embodiment can be referred to the above description, and will not be described in detail later. On this basis, step S35, after calculating the reference threshold of the alarm level based on the second cluster cluster, also includes steps S36 to S37:

[0159] Step S36, determining whether the alarm level reference threshold reaches a preset alarm level classification standard;

[0160] Step S37, if not, after retraining the Gaussian mixture model, execute the step of calculating the target feature value through the pre-constructed Gaussian mixture model to obtain a first cluster.

[0161] Among them, verify whether the alarm level reference threshold levelThreshold meets the preset alarm level classification standard. If it meets the requirements, apply the alarm level reference threshold to the online level classification module; otherwise, expand the sample data according to actual business needs, retrain the Gaussian mixture model, and then execute step S31 based on the retrained Gaussian mixture model to fine-tune the level threshold classification effect.

[0162] To help understand the fifth and sixth embodiments of the present application, please refer to Figure 5 , Figure 5 A flowchart of the alarm level classification method for calculating the alarm level reference threshold.

[0163] Step S311, obtaining a Size eigenvalue training data set (i.e., a training data set of intermediate eigenvalues);

[0164] Step S312: input the Size feature value training data set into the GMM model based on the initial parameters of the K-means algorithm to train the GMM model.

[0165] Step S313, the target eigenvalue is calculated by the trained GMM model, and the level threshold range (i.e., the alarm level reference threshold) is calculated based on the cluster boundary value set. At this time, the sample proportion of the training data set of the intermediate eigenvalue can be adjusted according to actual business needs, so that the GMM model can be retrained to fine-tune the level threshold distribution through the GMM model.

[0166] Step S314, verifying whether the alarm level reference threshold reaches a reasonable alarm level classification standard, and if so, outputting the alarm level threshold range (ie, the alarm level reference threshold).

[0167] Step S315: if not, readjust the training data set of the intermediate eigenvalues, and then execute step S311.

[0168] In the embodiment of the present application, after calculating the alarm level reference threshold, it is determined whether the alarm level reference threshold reaches a preset alarm level classification standard, thereby improving the accuracy of the alarm level reference threshold.

[0169] Based on the first embodiment of the present application, in the seventh embodiment of the present application, the same or similar contents as those in the first embodiment can be referred to the above description, and will not be described in detail later. On this basis, the alarm level reference threshold includes the maximum characteristic value + and the minimum characteristic value, and step S40, based on the target characteristic value and the alarm level reference threshold, the level identification is performed, and the alarm level information is obtained, which also includes steps S41 to S45:

[0170] Step S41, determining whether the target eigenvalue is greater than the maximum eigenvalue;

[0171] Step S42, if yes, output the severity level information;

[0172] Step S43, if not, determining whether the target eigenvalue is less than the minimum eigenvalue;

[0173] Step S44, if yes, output the level information of the mild level;

[0174] Step S45: if not, output the level information of the medium level.

[0175] Among them, after the time series data anomaly detection triggers an alarm in real time, the alarm interval feature vector is extracted, and the target feature value is calculated by adapting to the corresponding feature function model according to the sequence type performance.

[0176] The target characteristic value is calculated through a pre-built unsupervised model to obtain an alarm level reference threshold.

[0177] Then, based on the alarm level reference threshold, the interval level is compared and identified, and the level description and level score are output. The specific calculation process is as follows: Figure 6 As shown:

[0178] Step S411, obtaining the alarm interval feature vector AlamVec.

[0179] Step S412, calculating the size eigenvalue (ie, target eigenvalue) based on the warning interval eigenvector.

[0180] Step S413, calculating the target feature value through a pre-built unsupervised model to obtain an alarm level reference threshold, including a maximum value C.size.max and a minimum value C.size.min.

[0181] Step S414, determine whether the target feature value size is greater than C.size.max.

[0182] Step S415: If yes, output (severity level, size).

[0183] Step S416: If not, determine whether the target eigenvalue size is less than C.size.min.

[0184] Step S417: If yes, output (mild level, size).

[0185] Step S418, if not, output (medium level, size).

[0186] The embodiment of the present application compares the identification interval level based on the alarm level reference threshold, outputs the level description and the level score, thereby completing a simple and efficient online alarm level identification.

[0187] Based on the seventh embodiment of the present application, in the eighth embodiment of the present application, the same or similar contents as those in the seventh embodiment can be referred to the above description, and will not be described in detail later. On this basis, the alarm data includes alarm history information, and step S40, after the step of performing level identification based on the target characteristic value and the alarm level reference threshold, obtaining the alarm level information, also includes steps S50 to S100:

[0188] Step S50, determining whether a continuous alarm level has been marked on the previous day;

[0189] Among them, Example 8 of the present application describes the steps of performing continuous level identification. Continuous level identification performs time series continuity analysis based on the historical level of the sequence to identify the frequently fluctuating alarm intervals. This level indicates that the sequence has frequently had abnormal alarms in the recent period rather than new ones, which can reduce the degree of concern.

[0190] Specifically, the persistence level analysis determines whether the current alarm interval belongs to a long-term continuous alarm type according to the alarm history information. The persistence level is the level that identifies the duration of the alarm.

[0191] Furthermore, the continuous level analysis determines whether the current alarm interval belongs to the long-term continuous alarm type based on the alarm history information of the previous day.

[0192] Step S60, if yes, and an alarm occurs on that day, the previous continuous flag is inherited and the continuous alarm level is marked;

[0193] Among them, if the continuous alarm level is currently marked and an alarm has occurred on the same day, the sequence history continuous flag bit is inherited and continues to be marked as the continuous alarm level.

[0194] Step S70, if yes, and no alarm occurs on that day, then the continuous alarm level is lifted, and the continuous flag is set to a non-continuous state value;

[0195] If the continuous alarm level is currently marked and no alarm occurs on that day, the continuous alarm level is released and the continuous flag is set to a non-continuous state value, such as 0, so that the current alarm situation can be known based on the continuous flag.

[0196] Step S80: If not, determine whether the alarm history information contains alarm information of a serious level;

[0197] Step S90, if the alarm history information contains alarm information of a serious level and an alarm occurs on the same day, the continuous flag is set to a serious continuous state value to mark the continuous alarm level;

[0198] Among them, the value of severe persistent state can be 5.

[0199] Step S100: If there is no serious alarm information in the alarm history information and an alarm occurs on the current day, the continuous flag is increased by 1. When the continuous flag accumulation is greater than a preset continuous flag threshold, the continuous alarm level is marked.

[0200] For example, when the accumulation of the continuous flag is greater than the preset continuous flag threshold 3, the continuous alarm level is marked.

[0201] The embodiment of the present application designs a continuous level classification scheme in the time dimension, which can identify continuous alarms that do not require special attention due to frequent fluctuations.

[0202] For example, to help understand the implementation process of the alarm level classification method obtained by combining this embodiment with the above-mentioned embodiment 1, please refer to 7, Figure 7 A complete flowchart of the alarm level classification method is provided

[0203] Among them, the alarm level classification method includes modules such as customized multi-category feature function model, offline clustering model training, online real-time score conversion and level recognition, and continuous level analysis.

[0204] Specifically, the complete process of alarm level classification includes the following steps:

[0205] Step S101, obtaining alarm data through a data interface, the alarm data including an alarm feature vector and historical alarm information.

[0206] Step S102, based on the alarm feature vector adapted to the corresponding feature function model to calculate the target feature value. The corresponding feature function model includes a steady-type down-warning Size function model (i.e., a steady-type down-warning feature function model), a steady-type up-warning Size function model (i.e., a steady-type up-warning feature function model), and a discrete-type down-warning Size function model (i.e., a discrete-type down-warning feature function model).

[0207] Step S103, calculating the target feature value through an offline unsupervised level classification module to obtain an alarm level reference threshold.

[0208] Step S104, the target characteristic value and the alarm level reference threshold are calculated by the online level identification module, and the alarm level, level score, and level description are output. Among them, the online level identification module includes online real-time score conversion and level identification, and continuous level analysis. Among them, the alarm level includes severe level, moderate level, mild level, and continuous level.

[0209] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the alarm level classification method of the present application. More simple transformations based on this technical concept are all within the protection scope of the present application.

[0210] This application also provides an alarm level classification device, please refer to Figure 8 , the alarm level classification device comprises:

[0211] A data acquisition module 10 is used to acquire alarm data;

[0212] A feature calculation module 20 is used to calculate the alarm data through a pre-built feature function model to obtain a target feature value;

[0213] A threshold calculation module 30 is used to calculate the target feature value through a pre-built unsupervised model to obtain an alarm level reference threshold;

[0214] The level identification module 40 is used to perform level identification based on the target characteristic value and the alarm level reference threshold to obtain alarm level information.

[0215] The alarm level classification device provided by the present application adopts the alarm level classification method in the above embodiment, which can solve the technical problem that the alarm cannot be processed in time by manpower alone. Compared with the prior art, the beneficial effects of the alarm level classification device provided by the present application are the same as the beneficial effects of the alarm level classification method provided by the above embodiment, and the other technical features in the alarm level classification device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0216] The present application provides an alarm level classification device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the alarm level classification method in the above-mentioned embodiment one.

[0217] Reference below Fig. 9, which shows a schematic diagram of the structure of the alarm level classification device suitable for implementing the embodiment of the present application. The alarm level classification device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig. 9 The alarm level classification device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0218] like Fig. 9 As shown, the alarm level classification device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the alarm level classification device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the alarm level classification device to communicate wirelessly or wired with other devices to exchange data. Although the alarm level classification device with various systems is shown in the figure, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0219] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0220] The alarm level classification device provided by the present application adopts the alarm level classification method in the above embodiment, which can solve the technical problem that the alarm cannot be processed in time by manpower alone. Compared with the prior art, the beneficial effects of the alarm level classification device provided by the present application are the same as the beneficial effects of the alarm level classification method provided by the above embodiment, and the other technical features in the alarm level classification device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0221] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0222] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0223] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the alarm level classification method in the above-mentioned embodiment.

[0224] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0225] The computer-readable storage medium may be included in the alarm level classification device; or may exist independently without being assembled into the alarm level classification device.

[0226] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the alarm level classification device, the alarm level classification device: obtains alarm data; calculates the alarm data through a pre-constructed feature function model to obtain a target feature value; calculates the target feature value through a pre-constructed unsupervised model to obtain an alarm level reference threshold; performs level identification based on the target feature value and the alarm level reference threshold to obtain alarm level information.

[0227] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0228] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0229] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0230] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned alarm level classification method, and can solve the technical problem that alarms cannot be processed in time by manpower alone. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the alarm level classification method provided by the above-mentioned embodiment, and will not be repeated here.

[0231] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A method for classifying alarm levels, characterized in that: The method comprises: Get alarm data; Calculating the alarm data through a pre-built characteristic function model to obtain a target characteristic value; The target characteristic value is calculated by a pre-built unsupervised model to obtain a reference threshold value of the alarm level; Level identification is performed based on the target characteristic value and the alarm level reference threshold to obtain alarm level information.

2. The method according to claim 1, characterized in that The characteristic function model includes at least one of a steady-type down-warning characteristic function model, a steady-type up-warning characteristic function model, and a discrete down-warning characteristic function model. The alarm data includes an alarm interval feature vector, and the alarm interval feature vector includes the average value of the percentage increase or decrease of abnormal points in the alarm interval. When the characteristic function model is the stability degradation alarm characteristic function model, the step of calculating the alarm data by using the pre-constructed characteristic function model to obtain the target characteristic value includes: Calculate a first intermediate eigenvalue based on the warning interval eigenvector; performing normalization processing on the first intermediate eigenvalue; Performing piecewise weighted processing on the average of the percentage of increase or decrease of abnormal points within the alarm interval; The target eigenvalue is calculated by combining the normalized first intermediate eigenvalue and the average value of the percentage increase or decrease of abnormal points in the warning interval after the piecewise weighted processing.

3. The method according to claim 2, characterized in that When the characteristic function model is the steady-type rising alarm characteristic function model, the step of calculating the alarm data by using the pre-constructed characteristic function model to obtain the target characteristic value includes: Calculating a second intermediate eigenvalue based on the warning interval eigenvector; The second intermediate eigenvalue is normalized to obtain the target eigenvalue.

4. The method according to claim 2, characterized in that When the characteristic function model is the discrete downgrade alarm characteristic function model, the step of calculating the alarm data by using the pre-constructed characteristic function model to obtain the target characteristic value includes: Defining a zero-value interval feature in the warning interval feature vector to obtain a new warning interval feature; Calculate the discrete degree ratio of the current warning interval relative to the historical performance based on the new warning interval characteristics; Scaling the average of the percentage increase or decrease of abnormal points within the alarm interval; A third intermediate characteristic value is calculated based on the discrete degree ratio of the current warning interval to the historical performance and the average value of the percentage increase or decrease of the abnormal points in the scaled warning interval; The third intermediate eigenvalue is normalized to obtain the target eigenvalue.

5. The method according to claim 1, characterized in that The step of calculating the target characteristic value by using a pre-built unsupervised model to obtain a reference threshold value of the alarm level includes: Calculating the target feature value by using a pre-built Gaussian mixture model to obtain a first cluster; adding labels to each of the clusters based on the mean of each of the first clusters to obtain first clusters after adding labels; Based on a preset interval fine granularity, the boundary values ​​of the means of the first clustering clusters after adding labels are supplemented to obtain an expanded data set; Calculating the expanded data set by using the Gaussian mixture model to obtain a second cluster; The alarm level reference threshold is calculated based on the second cluster.

6. The method according to claim 5, characterized in that After the step of calculating the reference threshold value of the alarm level based on the second cluster, the following steps are included: Determining whether the alarm level reference threshold reaches a preset alarm level classification standard; If not, after retraining the Gaussian mixture model, the step of calculating the target feature value by using a pre-constructed Gaussian mixture model is performed to obtain a first cluster.

7. The method according to claim 1, characterized in that The alarm level reference threshold includes a maximum eigenvalue and a minimum eigenvalue, and the step of performing level identification based on the target eigenvalue and the alarm level reference threshold to obtain alarm level information includes: Determine whether the target eigenvalue is greater than the maximum eigenvalue; If so, output the severity level information; If not, determining whether the target eigenvalue is less than the minimum eigenvalue; If yes, then output the level information of the mild level; If not, output the level information of the medium level.

8. The method according to claim 7, characterized in that The alarm data includes alarm history information, and the step of performing level identification based on the target characteristic value and the alarm level reference threshold to obtain the alarm level information further includes: Determine whether a continuous alarm level has been marked on the previous day; If yes, and an alarm occurs on that day, the previous continuous flag is inherited and the continuous alarm level is marked; If yes, and no alarm occurs on that day, the continuous alarm level is lifted, and the continuous flag is set to a non-continuous state value; If not, determining whether the alarm history information contains alarm information of a serious level; If the alarm history information contains alarm information of a serious level and an alarm occurs on the same day, the continuous flag is set to a serious continuous state value to mark the continuous alarm level; If there is no serious alarm information in the alarm history information and an alarm occurs on the current day, the continuous flag is increased by 1. When the continuous flag accumulation is greater than a preset continuous flag threshold, the continuous alarm level is marked.

9. An alarm level classification device, characterized in that: The device comprises: A data acquisition module, used to acquire alarm data; A feature calculation module, used to calculate the alarm data through a pre-built feature function model to obtain a target feature value; A threshold calculation module is used to calculate the target feature value through a pre-built unsupervised model to obtain an alarm level reference threshold; The level identification module is used to perform level identification based on the target characteristic value and the alarm level reference threshold to obtain alarm level information.

10. An alarm level classification device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the alarm level classification method according to any one of claims 1 to 8.

Images