Alarm classification and grading method and device based on large model, medium and equipment

Abstract

The invention provides an alarm classification and grading method and device based on a large model, a medium and equipment. The method comprises the following steps: acquiring alarm data of an alarm event; the alarm data is preprocessed; extracting alarm features from the preprocessed alarm data; wherein the alarm features comprise features related to alarm classification and grading and alarm context features; inputting the alarm features into a pre-trained alarm analysis large model to obtain an analysis result of the alarm event; wherein the analysis result of the alarm event comprises the severity and the influence range of the alarm event; determining the emergency degree of the alarm event according to the severity and the influence range; determining the type of the alarm event according to the characteristics related to alarm classification and grading; and returning the type and the emergency degree of the alarm event to related operation and maintenance personnel. The efficiency and accuracy of operation and maintenance processing are effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of IT operation and maintenance technology, and in particular to a method, device, medium and equipment for classifying and grading alarms based on a large model. Background Art

[0002] With the rapid development of information technology and the increasing dependence of enterprises on IT systems, the importance of the IT operation and maintenance industry has become increasingly prominent. IT operation and maintenance, or IT Operations, refers to a series of activities to manage the operation, maintenance and optimization of enterprise information technology systems to ensure the stability, security and efficiency of the system. In the process of IT operation and maintenance, alarms are a common phenomenon. Alarms refer to alarms issued when an abnormality or failure occurs in a system or application. The purpose of alarms is to promptly notify operation and maintenance personnel of information about system problems so that they can take quick action to solve the problem and reduce business interruptions and losses. However, with the increasing complexity and scale of IT systems, operation and maintenance personnel are faced with an increasing amount of alarm data. These alarm data may include system monitoring data, log files, user feedback and other types. The large amount and high difficulty of processing make traditional alarm processing methods unable to meet the needs of modern IT operation and maintenance.

[0003] Traditional alarm processing methods mainly rely on manual experience, triggering alarms by setting thresholds and rules, and manually screening and classifying them. This method has some problems. First, manual processing is inefficient and cannot quickly respond to a large number of alarm information. Second, manual experience is prone to misjudgment and omission, resulting in important alarms being ignored or minor alarms being over-processed. Summary of the invention

[0004] In response to at least one of the above technical problems, an embodiment of the present invention provides a method, device, medium, and equipment for classifying and grading alarms based on a large model.

[0005] According to the first aspect, the alarm classification and grading method based on the large model provided by the embodiment of the present invention includes:

[0006] Get the alarm data of the alarm event;

[0007] Preprocessing the warning data;

[0008] Extracting alarm features from the preprocessed alarm data; wherein the alarm features include features related to alarm classification and grading and alarm context features;

[0009] Inputting the alarm feature into the pre-trained alarm analysis model to obtain the analysis result of the alarm event; wherein the analysis result of the alarm event includes the severity and impact scope of the alarm event;

[0010] Determine the urgency of the alarm event according to the severity and the impact scope;

[0011] Determining the type of the alarm event according to the features related to the alarm classification and grading;

[0012] The type and urgency of the alarm event are returned to the relevant operation and maintenance personnel.

[0013] In one embodiment, the preprocessing of the alarm data includes:

[0014] Cleaning the alarm data; wherein the cleaning method includes at least one of deduplication, error correction and missing value filling;

[0015] Converting text data in the cleaned alarm data into numerical data, and converting the format of time data in the cleaned alarm data into a unified format;

[0016] Normalize the alarm data after format conversion to a preset range;

[0017] Convert the normalized alarm data into a standard normal distribution form;

[0018] The alarm data converted into the standard normal distribution form is organized into a table or vector.

[0019] In one embodiment, before inputting the alarm feature into the pre-trained alarm analysis model, the method further includes at least one of the following:

[0020] Screening effective features from the alarm features to obtain effective alarm features;

[0021] Using a principal component analysis method or a linear discriminant analysis method to reduce the dimension of the alarm feature to obtain a reduced-dimensional alarm feature;

[0022] Correspondingly, the inputting of the alarm features into the pre-trained alarm analysis large model includes: inputting the effective alarm features or the reduced-dimensional alarm features into the alarm analysis large model.

[0023] In one embodiment, the features related to alarm classification and grading include at least one of the type, occurrence time, duration and alarm source of the alarm event; the alarm context features include at least one of system load, network traffic and user behavior.

[0024] In one embodiment, the alarm analysis model is specifically used for: if the type is a physical machine alarm, then analyzing the physical machine information in the alarm feature, the physical machine information includes hardware status and performance indicators, and outputting the severity and the scope of impact based on the physical machine information; if the type is a virtual machine alarm, then analyzing the virtual machine feature information of the alarm feature, the virtual machine feature information includes resource usage and network connection status in the virtualization environment, and outputting the severity and the scope of impact based on the virtual machine feature information; if the type is a service component alarm, then analyzing the service component feature information of the alarm feature, the service component feature information includes performance indicators and fault status, and outputting the severity and the scope of impact based on the service component feature information; if the type is an application system alarm, then analyzing the application system feature information of the alarm feature, the application system feature information includes business process status and application performance, and outputting the severity and the scope of impact based on the application system feature information.

[0025] In one embodiment, the training process of the alarm analysis large model includes:

[0026] Collect historical alarm data of various types of alarm events from multiple data sources;

[0027] Preprocessing the historical alarm data;

[0028] Extracting historical alarm features from the pre-processed historical alarm data;

[0029] Label the historical alarm features of each alarm event to obtain a training sample; the label content is the severity and impact scope of the alarm event;

[0030] Divide multiple training samples into training sets and test sets;

[0031] Select the matching model algorithm based on the characteristics of the alarm event;

[0032] Using the training set, model training is performed on the basis of the model algorithm to obtain a converged large alarm analysis model;

[0033] The test set is used to perform a performance evaluation on the alarm analysis large model, and the alarm analysis large model is optimized according to the performance evaluation result to obtain the optimized alarm analysis large model.

[0034] In one embodiment, the alarm analysis large model is a large model formed by fusing multiple sub-models, and the model algorithms of the sub-models include at least two of a decision tree algorithm, a support vector machine algorithm, a random forest algorithm, and a neural network algorithm.

[0035] According to the second aspect, the alarm classification and grading device based on the large model provided by the embodiment of the present invention includes:

[0036] A data acquisition module, used to acquire alarm data of alarm events;

[0037] A preprocessing module, used for preprocessing the alarm data;

[0038] A feature extraction module, used to extract alarm features from the preprocessed alarm data; wherein the alarm features include features related to alarm classification and grading and alarm context features;

[0039] A model analysis module, used for inputting the alarm feature into a pre-trained alarm analysis model to obtain an analysis result of the alarm event; wherein the analysis result of the alarm event includes the severity and impact scope of the alarm event;

[0040] A classification determination module, used to determine the urgency of the alarm event according to the severity and the impact scope;

[0041] A type determination module, used to determine the type of the alarm event according to the features related to the alarm classification and grading;

[0042] The result push module is used to return the type and urgency of the alarm event to the relevant operation and maintenance personnel.

[0043] According to a third aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, enables the computer to execute the method provided in the first aspect.

[0044] According to a fourth aspect, an embodiment of the present invention provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method provided in the first aspect is implemented.

[0045] The alarm classification and grading method, device, medium, and equipment based on a large model provided in an embodiment of the present invention obtain alarm data of an alarm event, pre-process the alarm data, extract alarm features from the pre-processed alarm data, and then input the alarm features into the alarm analysis large model to obtain the analysis result of the alarm event, determine the urgency of the alarm event according to the severity and the impact range in the analysis result; learn the type of the alarm event from the features related to the alarm classification and grading, and finally return the type and urgency of the alarm event to the relevant operation and maintenance personnel. Since the alarm analysis large model can automatically process a large amount of data, the operation and maintenance team can reduce the manual analysis of the alarm data, reduce the workload of manual intervention, and improve the efficiency of alarm processing. Alarm grading based on the output information of the large model can more accurately judge the urgency of the alarm event, avoid the occurrence of missed reports and false reports, and greatly improve the accuracy of operation and maintenance processing. Since the alarm analysis large model is obtained based on a large amount of data training, it can better capture the complex relationships and potential laws in the alarm data, thereby improving the accuracy of alarm classification and grading. In summary, the embodiments of the present invention take advantage of the advantages of artificial intelligence technology, extract and analyze alarm data, and introduce large model technology to achieve rapid classification of alarms, thereby effectively improving the efficiency and accuracy of operation and maintenance processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a flowchart of a method for classifying and grading alarms based on a large model in one embodiment of the present invention;

[0047] Figure 2 It is a structural block diagram of an alarm classification and grading device based on a large model in one embodiment of the present invention. DETAILED DESCRIPTION

[0048] In a first aspect, an embodiment of the present invention provides a method for classifying and grading alarms based on a large model, see Figure 1 The method comprises the following steps S110 to S170:

[0049] S110, obtaining alarm data of the alarm event;

[0050] Among them, alarm data refers to various data related to alarm events.

[0051] S120, preprocessing the alarm data;

[0052] In one embodiment, the preprocessing of the alarm data in S120 may include the following steps S121 to S125:

[0053] S121, cleaning the alarm data; wherein the cleaning method includes at least one of deduplication, error correction and missing value filling;

[0054] S122, converting text data in the cleaned alarm data into numerical data, and converting the format of time data in the cleaned alarm data into a unified format;

[0055] S123, normalizing the alarm data after format conversion to a preset range;

[0056] S124, converting the normalized alarm data into a standard normal distribution form;

[0057] S125. Arrange the alarm data converted into a standard normal distribution form into a table or a vector.

[0058] It can be seen that data cleaning of alarm data includes removing duplicate data, correcting erroneous data, filling missing data, etc. Secondly, data conversion is performed, including converting text data into numerical data, converting the format of time data into a unified format, etc. Next, the alarm data is normalized and standardized. Data normalization is to scale the data to a specific range, such as between 0 and 1, to eliminate the dimensional influence between the data. Data standardization is to convert the data into a standard normal distribution form for model analysis. These processing methods can help improve the accuracy of model output, and can also improve the training effect and generalization ability of the model in training scenarios. Finally, data formatting is performed to organize the data into a format suitable for model input, such as a table form, a vector form, etc.

[0059] Among them, text data can be converted into numerical data by using natural language processing technology to extract keywords or phrases, and using the bag-of-words model to convert text data into numerical features.

[0060] It can be seen that through the acquisition and preprocessing of alarm data of alarm events, input data suitable for model processing can be obtained, which is conducive to the accurate results of subsequent model output. When collecting and preprocessing data, carefully consider the source, quality and processing method of the data to ensure that the final model output results are accurate and reliable.

[0061] S130, extracting alarm features from the preprocessed alarm data; wherein the alarm features include features related to alarm classification and grading and alarm context features;

[0062] The features related to alarm classification and grading may include at least one of the type, occurrence time, duration and alarm source of the alarm event.

[0063] The alarm context feature may include at least one of system load, network traffic and user behavior.

[0064] It is understandable that extracting features from alarm data to obtain alarm features is actually performing feature engineering on alarm data. Feature engineering refers to extracting useful features from alarm data. Alarm data may include information such as alarm type, occurrence time, impact range, and related events. By reasonably selecting and extracting these features, the accuracy of the model output can be improved.

[0065] It can be understood that feature extraction is the process of extracting key information from alarm data, which is used as input for the model in the application scenario and used to form training samples in the training scenario. The purpose of feature extraction is to convert the alarm data into a set of representative features that can accurately describe the nature and attributes of each alarm event, thereby improving the accuracy and generalization of the model output. In other words, feature extraction is an important step in alarm classification and grading. By extracting key information from the raw alarm data and converting it into a set of representative features, the accuracy and generalization of the model output can be improved.

[0066] It is understandable that the accuracy of the model output can be further improved by combining two types of information: features related to alarm classification and grading and alarm context features.

[0067] In one embodiment, before inputting the alarm feature into the pre-trained alarm analysis model in S130, the method may further include at least one of the following:

[0068] 1. Screening effective features from the alarm features to obtain effective alarm features;

[0069] 2. Using a principal component analysis method or a linear discriminant analysis method to reduce the dimension of the alarm feature to obtain an alarm feature after dimension reduction;

[0070] Correspondingly, the inputting of the alarm features into the pre-trained alarm analysis large model includes: inputting the effective alarm features or the reduced-dimensional alarm features into the alarm analysis large model.

[0071] It can be seen that the number and complexity of features can be reduced through effective feature selection and feature dimensionality reduction. Feature selection is to select a set of effective features from the alarm features to improve the accuracy and computational efficiency of the model output. Feature dimensionality reduction is to map the high-dimensional feature space to a low-dimensional space to reduce the number of features while retaining the most useful information. Common feature dimensionality reduction methods include principal component analysis, linear discriminant analysis, etc.

[0072] S140, inputting the alarm feature into a pre-trained alarm analysis model to obtain an analysis result of the alarm event; wherein the analysis result of the alarm event includes the severity and impact scope of the alarm event;

[0073] It can be seen that the role of the alarm analysis model is to analyze the input alarm features and then output the severity and impact scope of the alarm event.

[0074] In one embodiment, the alarm analysis model can be specifically used for: if the type is a physical machine alarm, then analyzing the physical machine information in the alarm feature, the physical machine information includes hardware status and performance indicators, and outputting the severity and the scope of impact based on the physical machine information; if the type is a virtual machine alarm, then analyzing the virtual machine feature information of the alarm feature, the virtual machine feature information includes resource usage and network connection status in the virtualization environment, and outputting the severity and the scope of impact based on the virtual machine feature information; if the type is a service component alarm, then analyzing the service component feature information of the alarm feature, the service component feature information includes performance indicators and fault status, and outputting the severity and the scope of impact based on the service component feature information; if the type is an application system alarm, then analyzing the application system feature information of the alarm feature, the application system feature information includes business process status and application performance, and outputting the severity and the scope of impact based on the application system feature information.

[0075] It can be seen that the alarm analysis model can determine whether it is a physical machine alarm, virtual machine alarm, service component alarm or application system alarm based on the type of alarm feature, and then analyze the specific situation of the alarm corresponding to the type, so as to output the severity and impact range of the alarm event. In other words, the alarm analysis model is applicable to various types of alarm events.

[0076] S150, determining the urgency of the alarm event according to the severity and the impact scope;

[0077] Among them, the urgency level includes severe, major, minor or warning.

[0078] Among them, the more serious the severity, the larger the scope of impact, and the more urgent the urgency.

[0079] S160, determining the type of the alarm event according to the features related to the alarm classification and grading;

[0080] Since the alarm feature contains information about the type, the type of the alarm event can be determined directly based on the alarm feature.

[0081] S170: Return the type and urgency of the alarm event to relevant operation and maintenance personnel.

[0082] After obtaining the alarm classification, ie, type, and alarm grade, ie, urgency, based on the above steps, the alarm classification and grade information is pushed to the operation and maintenance personnel so that the operation and maintenance personnel can perform corresponding operation and maintenance processing according to the classification and grade.

[0083] In one embodiment, the training process of the alarm analysis large model includes the following 8 steps:

[0084] 1. Collect historical alarm data of various types of alarm events from multiple data sources;

[0085] As can be seen, the data collection phase involves collecting historical alarm data from various data sources. These data sources may include system monitoring tools, log files, user feedback, etc. In order to ensure the comprehensiveness and accuracy of the data, it is necessary to collect alarm data of different types of alarm events to obtain a more comprehensive perspective. At the same time, in order to protect user privacy and system security, it is necessary to comply with relevant laws and regulations and data protection policies to ensure the legality and compliance of data collection.

[0086] 2. Preprocessing the historical alarm data;

[0087] The preprocessing may include cleaning, converting text data into numerical data, converting the format of time data into a unified format, normalization, standardization, conversion into a table or vector, etc. See S121 to S125 above.

[0088] It is understandable that the quality of data preprocessing directly affects the effectiveness of model training.

[0089] 3. Extract historical alarm features from the pre-processed historical alarm data;

[0090] Among them, historical alarm features also include features related to alarm classification and grading and alarm context features.

[0091] 4. Label the historical alarm features of each alarm event to obtain a training sample; the label content is the severity and impact scope of the alarm event;

[0092] 5. Divide multiple training samples into training sets and test sets;

[0093] For example, each training sample is divided into a training set and a test set according to a sample quantity ratio of 8:2.

[0094] 6. Select the matching model algorithm based on the characteristics of the alarm event;

[0095] In other words, different machine learning algorithms can be selected according to the characteristics of the alarm event or even the characteristics of the alarm classification task, such as decision tree, support vector machine, random forest, neural network, etc. These algorithms have different principles and characteristics and are suitable for different scenarios and problems. In practical applications, it may be necessary to try multiple algorithms and select the best model through methods such as cross-validation.

[0096] 7. Using the training set, perform model training based on the model algorithm to obtain a converged large alarm analysis model;

[0097] Among them, the purpose of model training is to enable the model to learn the complex relationships and potential laws in the alarm data from the feature data, so as to improve the accuracy and effectiveness of alarm classification.

[0098] 8. Use the test set to perform performance evaluation on the alarm analysis big model, and optimize the alarm analysis big model according to the performance evaluation result to obtain the optimized alarm analysis big model.

[0099] It is understandable that during the model training process, the feature data is divided into a training set and a test set. The training set is used to train the model so that the model can learn the patterns and rules in the alarm data from the feature data. The test set is used to evaluate the performance of the model, and then adjust the parameters and structure of the model to improve the accuracy and generalization ability of the model. The model tuning process can include adjusting the parameters of the model, selecting a suitable loss function and optimization algorithm, preventing overfitting, etc. Through tuning, the model can achieve better performance and have good generalization ability.

[0100] Among them, the alarm analysis large model can be a large model formed by the fusion of multiple sub-models, and the model algorithms of the sub-models include at least two of a decision tree algorithm, a support vector machine algorithm, a random forest algorithm and a neural network algorithm.

[0101] It can be seen that model fusion technology is used here. Model fusion is to combine the results of multiple models to improve the accuracy and stability of the final output.

[0102] Of course, in addition to model fusion technology, transfer learning can also be used. Transfer learning is to apply the model to new tasks and use the knowledge learned by the model to improve the performance of the new tasks.

[0103] Since the alarm analysis model can automatically process large amounts of data, the operation and maintenance team can reduce the manual analysis of alarm data, greatly improving the efficiency and accuracy of alarm processing, thereby investing more time and energy in other more complex operation and maintenance tasks. In addition, since the alarm analysis model is trained based on a large amount of data, it can better capture the complex relationships and potential rules in the alarm data, thereby improving the accuracy of alarm classification and grading.

[0104] The embodiments of the present invention have the following beneficial effects:

[0105] (1) Improve the efficiency of alarm processing: Through the analysis capabilities of artificial intelligence, alarm events can be classified and graded, reducing the workload of manual intervention;

[0106] (2) Improve the accuracy of alarm processing: Alarm classification based on the output information of the large model can more accurately determine the urgency of the alarm event and avoid missed alarms and false alarms.

[0107] In summary, the embodiments of the present invention take advantage of the advantages of artificial intelligence technology, extract and analyze alarm data, and introduce large model technology to achieve rapid classification of alarms, thereby effectively improving the efficiency and accuracy of operation and maintenance processing.

[0108] In a second aspect, an embodiment of the present invention provides an alarm classification and grading device based on a large model, the device comprising:

[0109] A data acquisition module, used to acquire alarm data of alarm events;

[0110] A preprocessing module, used for preprocessing the alarm data;

[0111] A feature extraction module, used to extract alarm features from the preprocessed alarm data; wherein the alarm features include features related to alarm classification and grading and alarm context features;

[0112] A model analysis module, used for inputting the alarm feature into a pre-trained alarm analysis model to obtain an analysis result of the alarm event; wherein the analysis result of the alarm event includes the severity and impact scope of the alarm event;

[0113] A classification determination module, used to determine the urgency of the alarm event according to the severity and the impact scope;

[0114] A type determination module, used to determine the type of the alarm event according to the features related to the alarm classification and grading;

[0115] The result push module is used to return the type and urgency of the alarm event to the relevant operation and maintenance personnel.

[0116] In one embodiment, the preprocessing module is specifically used to: clean the alarm data; wherein the cleaning method includes at least one of deduplication, error correction and filling missing values; convert the text data in the cleaned alarm data into numerical data, and convert the format of the time data in the cleaned alarm data into a unified format; normalize the alarm data after format conversion to a preset range; convert the normalized alarm data into a standard normal distribution form; organize the alarm data converted into a standard normal distribution form into a table or vector.

[0117] In one embodiment, the device is further used for:

[0118] The feature screening module is used to perform any one of the following steps before the model analysis module inputs the alarm feature into the pre-trained alarm analysis large model: screening effective features from the alarm features to obtain effective alarm features; using the principal component analysis method or the linear discriminant analysis method to reduce the dimension of the alarm features to obtain the reduced-dimensional alarm features; correspondingly, the model analysis module is specifically used to: input the effective alarm features or the reduced-dimensional alarm features into the alarm analysis large model.

[0119] In one embodiment, the features related to alarm classification and grading include at least one of the type, occurrence time, duration and alarm source of the alarm event; the alarm context features include at least one of system load, network traffic and user behavior.

[0120] In one embodiment, the alarm analysis model is specifically used for: if the type is a physical machine alarm, then analyzing the physical machine information in the alarm feature, the physical machine information includes hardware status and performance indicators, and outputting the severity and the scope of impact based on the physical machine information; if the type is a virtual machine alarm, then analyzing the virtual machine feature information of the alarm feature, the virtual machine feature information includes resource usage and network connection status in the virtualization environment, and outputting the severity and the scope of impact based on the virtual machine feature information; if the type is a service component alarm, then analyzing the service component feature information of the alarm feature, the service component feature information includes performance indicators and fault status, and outputting the severity and the scope of impact based on the service component feature information; if the type is an application system alarm, then analyzing the application system feature information of the alarm feature, the application system feature information includes business process status and application performance, and outputting the severity and the scope of impact based on the application system feature information.

[0121] In one embodiment, the apparatus further comprises:

[0122] The model training module is used to collect historical alarm data of various types of alarm events from various data sources; preprocess the historical alarm data; extract historical alarm features from the preprocessed historical alarm data; label the historical alarm features of each alarm event to obtain a training sample; wherein the label content is the severity and impact scope of the alarm event; divide multiple training samples into a training set and a test set; based on the characteristics of the alarm event, select a matching model algorithm; use the training set to perform model training on the basis of the model algorithm to obtain the converged alarm analysis model; use the test set to perform performance evaluation on the alarm analysis model, and tune the alarm analysis model according to the performance evaluation results to obtain the tuned alarm analysis model.

[0123] In one embodiment, the alarm analysis large model is a large model formed by fusing multiple sub-models, and the model algorithms of the sub-models include at least two of a decision tree algorithm, a support vector machine algorithm, a random forest algorithm, and a neural network algorithm.

[0124] It is understandable that the explanation, specific implementation, beneficial effects, examples, etc. of the relevant contents in the device provided in the embodiment of the present invention can be found in the corresponding parts of the method provided in the first aspect, and will not be repeated here.

[0125] In a third aspect, an embodiment of the present invention provides a computer-readable medium, on which computer instructions are stored. When the computer instructions are executed by a processor, the processor executes the method provided in the first aspect.

[0126] Specifically, a system or device equipped with a storage medium can be provided, on which software program code that implements the functions of any of the above-mentioned embodiments is stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program code stored in the storage medium.

[0127] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute a part of the present invention.

[0128] The storage medium embodiments for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer by a communication network.

[0129] In addition, it should be clear that the functions of any of the above embodiments can be implemented not only by executing the program code read by the computer, but also by enabling an operating system operating on the computer to complete part or all of the actual operations based on instructions from the program code.

[0130] In addition, it can be understood that the program code read from the storage medium is written to a memory provided in an expansion board inserted into the computer or to a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above-mentioned embodiments.

[0131] It is understandable that the explanation, specific implementation methods, beneficial effects, examples, etc. of the relevant contents in the computer-readable medium provided in the embodiment of the present invention can be found in the corresponding parts of the method provided in the first aspect, and will not be repeated here.

[0132] In a fourth aspect, an embodiment of the present specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements the method in any embodiment of the specification.

[0133] It is understandable that the explanation, specific implementation, beneficial effects, examples, etc. of the relevant contents in the computing device provided in the embodiment of the present invention can be found in the corresponding parts of the method provided in the first aspect, and will not be repeated here.

[0134] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0135] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the present invention can be implemented by hardware, software, widgets, or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0136] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for classifying and grading alarms based on a large model, characterized in that: include: Get the alarm data of the alarm event; Preprocessing the warning data; Extracting alarm features from the preprocessed alarm data; wherein the alarm features include features related to alarm classification and grading and alarm context features; Inputting the alarm feature into the pre-trained alarm analysis model to obtain the analysis result of the alarm event; wherein the analysis result of the alarm event includes the severity and impact scope of the alarm event; Determine the urgency of the alarm event according to the severity and the impact scope; Determining the type of the alarm event according to the features related to the alarm classification and grading; The type and urgency of the alarm event are returned to the relevant operation and maintenance personnel.

2. The method according to claim 1, characterized in that The preprocessing of the alarm data comprises: Cleaning the alarm data; wherein the cleaning method includes at least one of deduplication, error correction and missing value filling; Converting text data in the cleaned alarm data into numerical data, and converting the format of time data in the cleaned alarm data into a unified format; Normalize the alarm data after format conversion to a preset range; Convert the normalized alarm data into a standard normal distribution form; The alarm data converted into the standard normal distribution form is organized into a table or vector.

3. The method according to claim 1, characterized in that Before inputting the alarm feature into the pre-trained alarm analysis model, the method further includes at least one of the following: Screening effective features from the alarm features to obtain effective alarm features; Using a principal component analysis method or a linear discriminant analysis method to reduce the dimension of the alarm feature to obtain a reduced-dimensional alarm feature; Correspondingly, the inputting of the alarm features into the pre-trained alarm analysis large model includes: inputting the effective alarm features or the reduced-dimensional alarm features into the alarm analysis large model.

4. The method according to claim 1, characterized in that: The features related to alarm classification and grading include at least one of the type, occurrence time, duration and alarm source of the alarm event; the alarm context features include at least one of system load, network traffic and user behavior.

5. The method according to claim 1, characterized in that The alarm analysis model is specifically used for: if the type is a physical machine alarm, then analyzing the physical machine information in the alarm feature, the physical machine information includes hardware status and performance indicators, and outputting the severity and the scope of impact based on the physical machine information; if the type is a virtual machine alarm, then analyzing the virtual machine feature information of the alarm feature, the virtual machine feature information includes resource usage and network connection status in the virtualization environment, and outputting the severity and the scope of impact based on the virtual machine feature information; if the type is a service component alarm, then analyzing the service component feature information of the alarm feature, the service component feature information includes performance indicators and fault status, and outputting the severity and the scope of impact based on the service component feature information; if the type is an application system alarm, then analyzing the application system feature information of the alarm feature, the application system feature information includes business process status and application performance, and outputting the severity and the scope of impact based on the application system feature information.

6. The method according to claim 1, characterized in that The training process of the alarm analysis large model includes: Collect historical alarm data of various types of alarm events from multiple data sources; Preprocessing the historical alarm data; Extracting historical alarm features from the pre-processed historical alarm data; Label the historical alarm features of each alarm event to obtain a training sample; the label content is the severity and impact scope of the alarm event; Divide multiple training samples into training sets and test sets; Select the matching model algorithm based on the characteristics of the alarm event; Using the training set, model training is performed on the basis of the model algorithm to obtain a converged large alarm analysis model; The test set is used to perform a performance evaluation on the alarm analysis large model, and the alarm analysis large model is optimized according to the performance evaluation result to obtain the optimized alarm analysis large model.

7. The method according to claim 6, characterized in that The alarm analysis large model is a large model formed by the fusion of multiple sub-models, and the model algorithms of the sub-models include at least two of a decision tree algorithm, a support vector machine algorithm, a random forest algorithm, and a neural network algorithm.

8. A large model-based alarm classification and grading device, characterized in that: include: A data acquisition module, used to acquire alarm data of alarm events; A preprocessing module, used for preprocessing the alarm data; A feature extraction module, used to extract alarm features from the preprocessed alarm data; wherein the alarm features include features related to alarm classification and grading and alarm context features; A model analysis module, used for inputting the alarm feature into a pre-trained alarm analysis model to obtain an analysis result of the alarm event; wherein the analysis result of the alarm event includes the severity and impact scope of the alarm event; A classification determination module, used to determine the urgency of the alarm event according to the severity and the impact scope; A type determination module, used to determine the type of the alarm event according to the features related to the alarm classification and grading; The result push module is used to return the type and urgency of the alarm event to the relevant operation and maintenance personnel.

9. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed in a computer, the computer is caused to execute the method according to any one of claims 1 to 7.

10. A computing device, characterized in that: The method comprises a memory and a processor, wherein the memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 7 is implemented.

Images