Alarm method and device, electronic equipment and storage medium

Abstract

The invention relates to an alarm method and device, electronic equipment and a storage medium, and belongs to the technical field of alarm, and the method comprises the steps: obtaining first monitoring data for a monitoring index; dividing the first monitoring data according to a plurality of preset time granularities to obtain second monitoring data corresponding to each time granularity; determining an abnormal condition of each piece of second monitoring data; and generating alarm information according to the abnormal condition of each second monitoring data. According to the invention, the first monitoring data is observed and judged under different time granularities, and the change condition of the first monitoring data can be described more comprehensively, so that the alarm information is generated according to the observation result of the first monitoring data under each time granularity, namely according to the abnormal condition of each second monitoring data; and the alarm can be more accurate.

Description

Technical Field

[0001] The present invention relates to the field of alarm technology, and in particular to an alarm method, device, electronic equipment and storage medium. Background Art

[0002] In the field of industrial production, it is crucial to detect abnormal equipment operation and trigger alarms in a timely and accurate manner. Traditional alarm systems mainly rely on pre-set thresholds, and trigger alarms when monitoring indicators exceed the thresholds. However, this single threshold is difficult to describe the dynamic characteristics of complex systems, so relying only on a single threshold to trigger alarms will result in alarms that are not timely and accurate. Summary of the invention

[0003] In view of this, it is necessary to provide an alarm method, device, electronic device and storage medium to solve the problem that the alarm in the related art is not timely and accurate enough.

[0004] In order to solve the above problems, in a first aspect, the present invention provides an alarm method, comprising: Acquire first monitoring data for a monitoring indicator; Dividing the first monitoring data according to a plurality of preset time granularities to obtain second monitoring data corresponding to each of the time granularities; Determining abnormal conditions of each of the second monitoring data; Generate alarm information according to the abnormal conditions of each of the second monitoring data.

[0005] Optionally, the determining the abnormality of each of the second monitoring data includes: Divide the second monitoring data corresponding to each of the time granularities according to a preset time window to obtain third monitoring data corresponding to each time window in each of the time granularities; Determine a first statistical feature of the third monitoring data corresponding to the current time window in each of the time granularities, and a second statistical feature of the third monitoring data corresponding to the historical time window; wherein the current time window is a time window where the current time node is located, and the historical time window is a time window where the historical time node is located; According to the difference between the first statistical feature and the second statistical feature in each of the time granularities, an abnormality score of the second monitoring data corresponding to each of the time granularities is determined.

[0006] Optionally, the first statistical feature includes a mean and a standard deviation, and the second statistical feature includes an average feature.

[0007] Optionally, the abnormal situation includes an abnormal score; then, generating alarm information according to the abnormal situation of each of the second monitoring data includes: Acquire a fuzzy rule, where the fuzzy rule is used to describe a mapping relationship between anomaly scores and alarm levels of each of the second monitoring data; According to the fuzzy rule and the abnormality score of each of the second monitoring data, a target alarm level is determined, and alarm information is generated according to the target alarm level.

[0008] Optionally, the fuzzy rules include multiple rules, each of which includes a rule antecedent and a rule consequent, the rule antecedent is used to describe the triggering condition of the fuzzy rule, and the triggering condition is set according to the abnormality score of each second monitoring data; the rule consequent is used to indicate the output alarm level when the fuzzy rule is triggered; then determining the target alarm level according to the fuzzy rule and the abnormality score of each second monitoring data includes: According to the rule antecedents of each of the fuzzy rules and the anomaly scores of each of the second monitoring data, determining the matching degree between the anomaly scores and the rule antecedents of each of the fuzzy rules; Determining whether the matching degree is greater than a preset matching degree threshold; If the matching degree is greater than a preset matching degree threshold, the fuzzy rule corresponding to the matching degree is used as the target fuzzy rule, and the alarm level set in the target fuzzy rule is output; According to the output alarm level, the target alarm level is determined.

[0009] Optionally, the target fuzzy rules include multiple ones; then determining the target alarm level according to the output alarm level includes: The output multiple alarm levels are defuzzified to obtain the target alarm level.

[0010] Optionally, the alarm information includes at least one of an alarm time, the target alarm level, an abnormality score of each of the second monitoring data, and a target fuzzy rule.

[0011] In a second aspect, the present invention further provides an alarm device, comprising: A monitoring data acquisition module, used to acquire first monitoring data for a monitoring indicator; A monitoring data division module, used to divide the monitoring data according to a plurality of preset time granularities to obtain second monitoring data corresponding to each of the time granularities; An abnormality determination module, used to determine the abnormality of each of the second monitoring data; The alarm information generating module is used to generate alarm information according to the abnormal conditions of each of the second monitoring data.

[0012] In a third aspect, the present invention also provides an electronic device comprising a memory and a processor, wherein the memory is used to store programs; and the processor is coupled to the memory and is used to execute the programs stored in the memory to implement the steps in any one of the alarm methods described above.

[0013] In a fourth aspect, the present invention further provides a computer-readable storage medium for storing a computer-readable program, wherein the program or instructions, when executed by a processor, can implement the steps in any one of the above-mentioned alarm methods.

[0014] The beneficial effects of the present invention are: After obtaining the first monitoring data for the monitoring index, the present invention divides the monitoring data according to a plurality of preset time granularities, obtains the second monitoring data corresponding to each time granularity, and determines the abnormality of each second monitoring data respectively; the first monitoring data can be observed and judged at different time granularities respectively, and the change of the first monitoring data at short-term, medium-term and long-term time granularities can be more comprehensively described. Then, according to the observation results of the first monitoring data at each time granularity, that is, according to the abnormality of the second monitoring data corresponding to each time granularity, alarm information is generated, which can make the alarm more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 A schematic diagram of a flow chart of an embodiment of the alarm method provided by the present invention; Figure 2 For the present invention Figure 1 A schematic diagram of a flow chart of an embodiment of S103; Figure 3 For the present invention Figure 1 A schematic diagram of a flow chart of an embodiment of S104; Figure 4 A schematic structural diagram of an embodiment of the alarm device provided by the present invention. DETAILED DESCRIPTION

[0016] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0017] In the description of the embodiments of the present invention, unless otherwise specified, "multiple" means two or more than two. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" may mean: A exists alone, A and B exist at the same time, and B exists alone.

[0018] The descriptions of "first", "second", etc. involved in the embodiments of the present invention are only for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the technical features defined as "first" and "second" may explicitly or implicitly include at least one of the features.

[0019] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0020] Reference Figure 1 , shows a flow chart of an embodiment of the alarm method provided by the present invention, the method comprising: S101, obtaining first monitoring data for a monitoring indicator.

[0021] S102, dividing the monitoring data according to a plurality of preset time granularities to obtain second monitoring data corresponding to each time granularity.

[0022] S103, determining the abnormal conditions of each second monitoring data.

[0023] S104: Generate alarm information according to the abnormal conditions of each second monitoring data.

[0024] The execution subject of the embodiment of the present invention can be a mobile phone, a tablet, a computer, a smart wearable device or other types of electronic devices, etc., which are not limited here.

[0025] The monitoring indicators in the embodiment of the present invention may be indicators such as temperature, noise, and operating parameters of the equipment, and the types of the monitoring indicators are not limited here.

[0026] The first monitoring data may be real-time detection and recording data for the monitoring index. For example, when the monitoring index is temperature, the first monitoring data may be real-time detection and recording data for the device temperature.

[0027] The preset time granularity may include multiple time granularities, and the multiple time granularities may be increased in sequence. For example, m time granularities g1, g2, ..., gm may be selected based on prior knowledge, and the m time granularities satisfy g1 <g2<…<gm。

[0028] After obtaining the first monitoring data and multiple preset time granularities, the first monitoring data can be divided according to the time granularity with the most recent time node in the first monitoring data as the time starting point to obtain the second monitoring data corresponding to each time granularity. For example, m=3, g1=5 minutes, g2=30 minutes, g3=60 minutes, and the first monitoring data is the monitoring data for the device temperature in the time period of 5:00-6:00. Then, the second monitoring data corresponding to the g1 time granularity is the monitoring data for the device temperature in the time period of 5:55-6:00; the second monitoring data corresponding to the g2 time granularity is the monitoring data for the device temperature in the time period of 5:30-6:00; and the second monitoring data corresponding to the g3 time granularity is the monitoring data for the device temperature in the time period of 5:00-6:00.

[0029] After dividing the first monitoring data according to multiple preset time granularities, the abnormal conditions of the second monitoring data corresponding to each time granularity can be determined. The abnormal conditions can be represented by abnormality scores, or by low, medium, and high abnormality levels. The specific method of representing the abnormal conditions is not limited here. Finally, the abnormal conditions of the second monitoring data corresponding to each time granularity can be combined to generate alarm information.

[0030] In the field of industrial production, traditional alarm systems mainly rely on pre-set thresholds, and alarms are triggered when monitoring indicators exceed the thresholds. However, this single threshold is difficult to characterize the dynamic characteristics of complex systems, which results in the alarm not being timely and accurate enough. With the rapid development of artificial intelligence, there are also methods for building anomaly detection models for alarm systems by training historical data, but most of the existing machine learning methods only target single time granularity data, lack modeling of multi-time scale features, and have limited model generalization capabilities. Therefore, in an embodiment of the present invention, by observing the dynamic changes of the first monitoring data at different time scales, comprehensively characterizing the abnormal conditions of the first monitoring data, and comprehensively generating alarm information based on the abnormal conditions of the first monitoring data at each time scale, the alarm can be made more accurate and timely.

[0031] Reference Figure 2 , showing that the present invention Figure 1 The flowchart of an embodiment of S103 is shown in FIG. 1 , and the specific implementation steps of S103 may include: S201, dividing the second monitoring data corresponding to each time granularity according to a preset time window to obtain the third monitoring data corresponding to each time window in each time granularity.

[0032] S202, determine the first statistical feature of the third monitoring data corresponding to the current time window in each time granularity, and the second statistical feature of the third monitoring data corresponding to the historical time window; wherein the current time window is the time window where the current time node is located, and the historical time window is the time window where the historical time node is located.

[0033] S203: Determine an abnormality score of the second monitoring data corresponding to each time granularity according to the difference between the first statistical feature and the second statistical feature in each time granularity.

[0034] In this embodiment, the second monitoring data corresponding to each time granularity can be further divided according to the preset time window. For example, the preset time window is 1 minute, and the second monitoring data corresponding to the g1 time granularity is the monitoring data for the device temperature in the time period of 5:55-6:00, then the g1 time granularity can be divided into 5 time windows, and the third monitoring data corresponding to the 5 time windows are: the monitoring data for the device temperature in the time period of 5:59-6:00, the monitoring data for the device temperature in the time period of 5:58-5:59, the monitoring data for the device temperature in the time period of 5:57-5:58, etc.

[0035] After the division, the third monitoring data corresponding to the current time window and the third monitoring data corresponding to the historical time window within each time granularity can be determined. Among them, the current time window is the time window where the current time node is located. Continuing with the above example, 5:59-6:00 is the time window where the current time node is located. The historical time window is the time window where the historical time node is located. Continuing with the above example, the four time nodes corresponding to 5:55-5:59 are the time windows where the historical time nodes are located.

[0036] Furthermore, feature extraction can be performed on the third monitoring data corresponding to the current time window and the third monitoring data corresponding to the historical time window in each time granularity to obtain the first statistical feature and the second statistical feature respectively, and the first statistical feature and the second statistical feature are calculated according to the calculation method such as the Euclidean distance calculation formula to obtain the difference measure between the two. Finally, the difference measure corresponding to each time granularity can be normalized using Sigmoid to obtain the anomaly score corresponding to each time granularity. Among them, the first statistical feature can be a mean, a standard deviation, etc., and the second statistical feature can be an average feature, etc.

[0037] Reference Figure 3 , showing that the present invention Figure 1 The specific implementation steps of S104 may include: S301, obtaining fuzzy rules, where the fuzzy rules are used to describe the mapping relationship between the abnormality score and the alarm level of each second monitoring data.

[0038] S302, determining a target alarm level according to the fuzzy rule and the abnormality score of each second monitoring data, and generating alarm information according to the target alarm level.

[0039] Fuzzy rules are the core component of fuzzy logic systems, which are used to process and reason about information with uncertainty and ambiguity. Fuzzy rules can be constructed based on domain expert knowledge. The fuzzy rules constructed in this embodiment can be used to describe the mapping relationship between the anomaly score and the alarm level corresponding to each time granularity. For example, when the anomaly score corresponding to the g1 time granularity is high, the alarm level is severe; when the anomaly score corresponding to the g1 time granularity is low, the anomaly score corresponding to the g2 time granularity is low, and the anomaly score corresponding to the g3 time granularity is low, the alarm level is normal.

[0040] According to the fuzzy rules and the abnormality scores of each second monitoring data, the target alarm level can be determined.

[0041] This embodiment introduces fuzzy rules, and fuzzy rules are usually constructed based on domain expert knowledge. Therefore, this embodiment can combine more domain expert knowledge to judge abnormal situations of monitoring data, making the judgment more accurate.

[0042] In one embodiment, a fuzzy rule base may be constructed. The fuzzy rule base is constructed as follows: Step 1: Define language variables. Define language variables representing the abnormality scores of each time granularity and language variables representing the alarm level.

[0043] For example, nine language variables can be defined: g1_low, g1_medium, g1_high; g2_low, g2_medium, g2_high; g3_low, g3_medium, g3_high, which represent the abnormality score levels at the three time granularities of g1, g2, and g3 respectively. Three more language variables can be defined: alarm_critical, alarm_warning, and alarm_normal, which represent the three alarm levels respectively.

[0044] Step 2: Define the membership function. Define a series of fuzzy subsets for each linguistic variable and define the corresponding membership function. The membership function can be constructed by combining trigonometric functions with trapezoidal functions.

[0045] Step 3: Generate fuzzy rules. Based on expert knowledge, a series of IF-THEN fuzzy rules are generated to describe the correspondence between multi-granularity anomaly scores and alarm levels.

[0046] For example, rule 1: If the score of the short-term monitoring indicator g1 is high g1_high, the alarm level is severe alarm_critical; Rule 2: If the mid-term monitoring indicator g2 is scored as g2_high and the long-term monitoring indicator g3 is scored as medium, the alarm level is warning alarm_warning; Rule 3: If the short-term monitoring indicator g1 is low, the mid-term monitoring indicator g2 is low, and the long-term monitoring indicator g3 is low, the alarm level is normal alarm_normal; The fuzzy rules defined in this embodiment are only used as an example, and the fuzzy rules can be designed according to the usage scenario.

[0047] In one embodiment, the fuzzy rules may include multiple rules, each of which includes a rule antecedent and a rule consequent, the rule antecedent is used to describe the triggering condition of the fuzzy rule, and the triggering condition is set according to the anomaly score of each second monitoring data; the rule consequent is used to indicate the output alarm level when the fuzzy rule is triggered; then, step S302 may specifically include: determining the matching degree between the anomaly score and the rule antecedent of each fuzzy rule according to the rule antecedent of each fuzzy rule and the anomaly score of each second monitoring data; judging whether the matching degree is greater than a preset matching degree threshold; if the matching degree is greater than the preset matching degree threshold, taking the fuzzy rule corresponding to the matching degree as the target fuzzy rule, and outputting the alarm level set in the target fuzzy rule; determining the target alarm level according to the output alarm level.

[0048] Continuing with the above example, in Rule 1, the rule antecedent is: If the short-term monitoring indicator g1 scores high g1_high, the rule consequent is: Then the alarm level is severe alarm_critical. The triggering probability of each fuzzy rule can be calculated in combination with the anomaly scores corresponding to each time granularity, that is, the matching degree between the anomaly score and the rule antecedent of each fuzzy rule is calculated. When the matching degree is greater than the preset matching degree threshold, it is determined that the fuzzy rule is triggered, and the alarm level set in the fuzzy rule is output. For example, if the matching degree threshold is 0.6, when the matching degree between the anomaly score and the rule antecedent of Rule 1 is 0.7, which is greater than the matching degree threshold, the output alarm level is alarm_critical.

[0049] In one embodiment, the target fuzzy rules include multiple ones; then, step S302 may specifically include: performing defuzzification processing on the output multiple alarm levels to obtain the target alarm level.

[0050] When the target fuzzy rules include multiple ones, that is, when multiple fuzzy rules are triggered, multiple alarm levels will be output. For example, when both rule 1 and rule 2 are triggered, two alarm levels will be output. In order to obtain a clear final alarm level (target alarm level), the centroid method or other similar defuzzification methods can be used to convert the output multiple alarm levels into a specific and clear target alarm level. The execution subject can then take corresponding actions or issue corresponding alarms according to the target alarm level.

[0051] In one embodiment, the alarm information includes at least one of an alarm time, a target alarm level, an abnormality score of each second monitoring data, and a target fuzzy rule.

[0052] Reference Figure 4 , shows a schematic diagram of the structure of an embodiment of an alarm device provided by the present invention. The alarm device 400 may specifically include the following modules: The monitoring data acquisition module 401 is used to acquire first monitoring data for a monitoring indicator; The monitoring data division module 402 is used to divide the monitoring data according to a plurality of preset time granularities to obtain second monitoring data corresponding to each time granularity; The abnormality determination module 403 is used to determine the abnormality of each second monitoring data; The alarm information generating module 404 is used to generate alarm information according to the abnormal conditions of each second monitoring data.

[0053] It should be noted that the implementation principle or implementation process of the above modules can refer to the embodiments of the above alarm method, and will not be described one by one here.

[0054] In one embodiment, the present invention further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of any of the above-mentioned alarm methods are implemented.

[0055] In one embodiment, the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by the processor, the steps of any of the above-mentioned alarm methods are implemented.

[0056] Those skilled in the art will appreciate that all or part of the processes of the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, wherein the computer-readable storage medium is a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0057] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by any technician familiar with the technical field within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.

Claims

1. An alarm method, characterized in that: include: Acquire first monitoring data for a monitoring indicator; Dividing the first monitoring data according to a plurality of preset time granularities to obtain second monitoring data corresponding to each of the time granularities; Determining abnormal conditions of each of the second monitoring data; Generate alarm information according to the abnormal conditions of each of the second monitoring data.

2. The alarm method according to claim 1, characterized in that: The determining of the abnormality of each of the second monitoring data includes: Divide the second monitoring data corresponding to each of the time granularities according to a preset time window to obtain third monitoring data corresponding to each time window in each of the time granularities; Determine a first statistical feature of the third monitoring data corresponding to the current time window in each of the time granularities, and a second statistical feature of the third monitoring data corresponding to the historical time window; wherein the current time window is a time window where the current time node is located, and the historical time window is a time window where the historical time node is located; According to the difference between the first statistical feature and the second statistical feature in each of the time granularities, an abnormality score of the second monitoring data corresponding to each of the time granularities is determined.

3. The alarm method according to claim 2, characterized in that: The first statistical feature includes a mean and a standard deviation, and the second statistical feature includes an average feature.

4. The alarm method according to claim 1, characterized in that: The abnormal situation includes an abnormal score; then generating alarm information according to the abnormal situation of each of the second monitoring data includes: Acquire a fuzzy rule, where the fuzzy rule is used to describe a mapping relationship between anomaly scores and alarm levels of each of the second monitoring data; According to the fuzzy rule and the abnormality score of each of the second monitoring data, a target alarm level is determined, and alarm information is generated according to the target alarm level.

5. The alarm method according to claim 4, characterized in that: The fuzzy rules include a plurality of rules, each of which includes a rule antecedent and a rule consequent, the rule antecedent is used to describe a triggering condition of the fuzzy rule, and the triggering condition is set according to anomaly scores of each of the second monitoring data; the rule consequent is used to indicate an alarm level to be output when the fuzzy rule is triggered; Then, determining the target alarm level according to the fuzzy rule and the abnormality score of each of the second monitoring data includes: According to the rule antecedents of each of the fuzzy rules and the anomaly scores of each of the second monitoring data, determining the matching degree between the anomaly scores and the rule antecedents of each of the fuzzy rules; Determining whether the matching degree is greater than a preset matching degree threshold; If the matching degree is greater than a preset matching degree threshold, the fuzzy rule corresponding to the matching degree is used as the target fuzzy rule, and the alarm level set in the target fuzzy rule is output; According to the output alarm level, the target alarm level is determined.

6. The alarm method according to claim 5, characterized in that: The target fuzzy rules include multiple ones; then the target alarm level is determined according to the output alarm level, including: The output multiple alarm levels are defuzzified to obtain the target alarm level.

7. The alarm method according to claim 6, characterized in that: The alarm information includes at least one of an alarm time, the target alarm level, an abnormality score of each of the second monitoring data, and a target fuzzy rule.

8. An alarm device, characterized in that: include: A monitoring data acquisition module, used to acquire first monitoring data for a monitoring indicator; A monitoring data division module, used to divide the first monitoring data according to a plurality of preset time granularities to obtain second monitoring data corresponding to each of the time granularities; An abnormality determination module, used to determine the abnormality of each of the second monitoring data; The alarm information generating module is used to generate alarm information according to the abnormal conditions of each of the second monitoring data.

9. An electronic device, characterized in that: comprising a memory and a processor, wherein: The memory is used to store programs; The processor is coupled to the memory and is used to execute the program stored in the memory to implement the steps in the alarm method described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store computer-readable programs, which, when executed by a processor, can implement the steps of the alarm method described in any one of claims 1 to 7.

Images